commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 Author: Linus Torvalds Date: Sun Jun 25 16:29:58 2023 -0700 Linux 6.4 commit e3b2e2c14bcc12da2c463a7179db39139f682573 Merge: 547cc9be86f4c e69b9bc170c6d Author: Linus Torvalds Date: Sun Jun 25 15:36:01 2023 -0700 Merge tag 'i2c-for-6.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Nothing fancy. Two driver and one DT binding fix" * tag 'i2c-for-6.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle i2c: qup: Add missing unwind goto in qup_i2c_probe() dt-bindings: i2c: opencores: Add missing type for "regstep" commit 547cc9be86f4c51c51fd429ace6c2e1ef9050d15 Merge: 300edd751b102 a6742cb90b567 Author: Linus Torvalds Date: Sun Jun 25 10:13:17 2023 -0700 Merge tag 'perf_urgent_for_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Drop the __weak attribute from a function prototype as it otherwise leads to the function getting replaced by a dummy stub - Fix the umask value setup of the frontend event as former is different on two Intel cores * tag 'perf_urgent_for_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Fix the FRONTEND encoding on GNR and MTL perf/core: Drop __weak attribute from arch_perf_update_userpage() prototype commit 300edd751b102715dda0fe44b4bf8442f6ccf9db Merge: 661e723b6fc72 b9f174c811e3a Author: Linus Torvalds Date: Sun Jun 25 10:00:17 2023 -0700 Merge tag 'objtool_urgent_for_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Borislav Petkov: - Add a ORC format hash to vmlinux and modules in order for other tools which use it, to detect changes to it and adapt accordingly * tag 'objtool_urgent_for_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/unwind/orc: Add ELF section with ORC version identifier commit 661e723b6fc7247e8aa6704651c49cd25c559f75 Merge: a92b7d26c743b 85d38d5810e28 Author: Linus Torvalds Date: Sun Jun 25 09:47:04 2023 -0700 Merge tag 'x86_urgent_for_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Do not use set_pgd() when updating the KASLR trampoline pgd entry because that updates the user PGD too on KPTI builds, resulting in memory corruption - Prevent a panic in the IO-APIC setup code due to conflicting command line parameters * tag 'x86_urgent_for_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys x86/mm: Avoid using set_pgd() outside of real PGD pages commit a92b7d26c743b9dc06d520f863d624e94978a1d9 Merge: 0f56e657488fe 9bd9be5cbaf8a Author: Linus Torvalds Date: Fri Jun 23 16:33:26 2023 -0700 Merge tag 'drm-fixes-2023-06-23' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Very quiet last week, just two misc fixes, one dp-mst and one qaic: qaic: - dma-buf import fix dp-mst: - fix NULL ptr deref" [ It turns out it was a quiet week because Alex Deucher hadn't sent in his pending AMD changes. So they are coming next - Linus ] * tag 'drm-fixes-2023-06-23' of git://anongit.freedesktop.org/drm/drm: drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2 accel/qaic: Call DRM helper function to destroy prime GEM commit 0f56e657488fe35e543fc17bc192fb7c7ac07ac6 Merge: 569fa9392d2d4 ed8ff046eddd9 Author: Linus Torvalds Date: Fri Jun 23 16:21:59 2023 -0700 Merge tag 'arm-fixes-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "The final bug fixes for Qualcomm and Rockchips came in, all of them for devicetree files: - Devices on Qualcomm SC7180/SC7280 that are cache coherent are now marked so correctly to fix a regression after a change in kernel behavior - Rockchips has a few minor changes for correctness of regulator and cache properties, as well as fixes for incorrect behavior of the RK3568 PCI controller and reset pins on two boards" * tag 'arm-fixes-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: dts: qcom: sc7280: Mark SCM as dma-coherent for chrome devices arm64: dts: qcom: sc7180: Mark SCM as dma-coherent for trogdor arm64: dts: qcom: sc7180: Mark SCM as dma-coherent for IDP dt-bindings: firmware: qcom,scm: Document that SCM can be dma-coherent arm64: dts: rockchip: Fix rk356x PCIe register and range mappings arm64: dts: rockchip: fix button reset pin for nanopi r5c arm64: dts: rockchip: fix nEXTRST on SOQuartz arm64: dts: rockchip: add missing cache properties arm64: dts: rockchip: fix USB regulator on ROCK64 commit 569fa9392d2d48e35955b69775d11507ea96b36a Merge: 9cb38381bac9f cb091225a5380 Author: Linus Torvalds Date: Fri Jun 23 16:09:53 2023 -0700 Merge tag 'for-6.4-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "Unfortunately the recent u32 overflow fix was not complete, there was one conversion left, assertion not triggered by my tests but caught by Qu's fstests case. The "cleanup for later" has been promoted to a proper fix and wraps all uses of the stripe left shift so the diffstat has grown but leaves no potentially problematic uses. We should have done it that way before, sorry" * tag 'for-6.4-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix remaining u32 overflows when left shifting stripe_nr commit 9cb38381bac9f629fd4e7eafef27066c23c3eaf9 Merge: 917b3c7c0bcf8 9c39b7a905d84 Author: Linus Torvalds Date: Fri Jun 23 16:04:35 2023 -0700 Merge tag 'block-6.4-2023-06-23' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "It's apparently the week of 'fixup something from last week', because the same is true for this block pull request. Fix up a lock grab that needs to be IRQ saving, rather than just IRQ disabling, in the block cgroup code" * tag 'block-6.4-2023-06-23' of git://git.kernel.dk/linux: block: make sure local irq is disabled when calling __blkcg_rstat_flush commit 917b3c7c0bcf82f62afc1d046352933bd68db931 Merge: 61dabacdad4e7 5b00369fcf6d1 Author: Linus Torvalds Date: Fri Jun 23 15:56:44 2023 -0700 Merge tag 'iommu-fix-v6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fix from Joerg Roedel: - Fix potential memory leak in AMD IOMMU domain allocation path * tag 'iommu-fix-v6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Fix possible memory leak of 'domain' commit 61dabacdad4e7d464c11f715ae6b065151a73078 Merge: 6edecb9986eef 6f9441f4e3ebf Author: Linus Torvalds Date: Fri Jun 23 15:43:01 2023 -0700 Merge tag 'sound-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Three oneliner fixes: one for a thinko in SOF SoundWire code and two HD-audio quirks for ASUS laptops. All device-specific and should be safe to apply" * tag 'sound-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Add quirk for ASUS ROG GV601V ALSA: hda/realtek: Add quirk for ASUS ROG G634Z ASoC: intel: sof_sdw: Fixup typo in device link checking commit 6edecb9986eeffbf67e89aa510bc07835067cf60 Merge: afa4bb778e48d ff7a1790fbf92 Author: Linus Torvalds Date: Fri Jun 23 15:24:09 2023 -0700 Merge tag 'gpio-fixes-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix IRQ initialization in gpiochip_irqchip_add_domain() - add a missing return value check for platform_get_irq() in gpio-sifive - don't free irq_domains which GPIOLIB does not manage * tag 'gpio-fixes-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: Fix irq_domain resource tracking for gpiochip_irqchip_add_domain() gpio: sifive: add missing check for platform_get_irq gpiolib: Fix GPIO chip IRQ initialization restriction commit ed8ff046eddd916627e1e9a549eacd9c043fde7d Merge: 5b017b5ed2bcc 7b59e8ae92fe0 Author: Arnd Bergmann Date: Fri Jun 23 22:13:22 2023 +0200 Merge tag 'qcom-arm64-fixes-for-6.4-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes One last Qualcomm ARM64 DeviceTree fix for v6.4 Changes related to cache management for DMA memory caused WiFi to stop work on SC7180 and SC7280 based products, using TF-A. These changes marks the relevant device dma-coherent to correct the behavior. * tag 'qcom-arm64-fixes-for-6.4-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: sc7280: Mark SCM as dma-coherent for chrome devices arm64: dts: qcom: sc7180: Mark SCM as dma-coherent for trogdor arm64: dts: qcom: sc7180: Mark SCM as dma-coherent for IDP dt-bindings: firmware: qcom,scm: Document that SCM can be dma-coherent Link: https://lore.kernel.org/r/20230622203248.106422-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit afa4bb778e48d79e4a642ed41e3b4e0de7489a6c Author: Linus Torvalds Date: Fri Jun 23 12:08:14 2023 -0700 workqueue: clean up WORK_* constant types, clarify masking Dave Airlie reports that gcc-13.1.1 has started complaining about some of the workqueue code in 32-bit arm builds: kernel/workqueue.c: In function ‘get_work_pwq’: kernel/workqueue.c:713:24: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] 713 | return (void *)(data & WORK_STRUCT_WQ_DATA_MASK); | ^ [ ... a couple of other cases ... ] and while it's not immediately clear exactly why gcc started complaining about it now, I suspect it's some C23-induced enum type handlign fixup in gcc-13 is the cause. Whatever the reason for starting to complain, the code and data types are indeed disgusting enough that the complaint is warranted. The wq code ends up creating various "helper constants" (like that WORK_STRUCT_WQ_DATA_MASK) using an enum type, which is all kinds of confused. The mask needs to be 'unsigned long', not some unspecified enum type. To make matters worse, the actual "mask and cast to a pointer" is repeated a couple of times, and the cast isn't even always done to the right pointer, but - as the error case above - to a 'void *' with then the compiler finishing the job. That's now how we roll in the kernel. So create the masks using the proper types rather than some ambiguous enumeration, and use a nice helper that actually does the type conversion in one well-defined place. Incidentally, this magically makes clang generate better code. That, admittedly, is really just a sign of clang having been seriously confused before, and cleaning up the typing unconfuses the compiler too. Reported-by: Dave Airlie Link: https://lore.kernel.org/lkml/CAPM=9twNnV4zMCvrPkw3H-ajZOH-01JVh_kDrxdPYQErz8ZTdA@mail.gmail.com/ Cc: Arnd Bergmann Cc: Tejun Heo Cc: Nick Desaulniers Cc: Nathan Chancellor Signed-off-by: Linus Torvalds commit e69b9bc170c6d93ee375a5cbfd15f74c0fb59bdd Author: Clark Wang Date: Mon May 29 16:02:51 2023 +0800 i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle Claim clkhi and clklo as integer type to avoid possible calculation errors caused by data overflow. Fixes: a55fa9d0e42e ("i2c: imx-lpi2c: add low power i2c bus driver") Signed-off-by: Clark Wang Signed-off-by: Carlos Song Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit cd9489623c29aa2f8cc07088168afb6e0d5ef06d Author: Shuai Jiang Date: Tue Apr 18 21:56:12 2023 +0800 i2c: qup: Add missing unwind goto in qup_i2c_probe() Smatch Warns: drivers/i2c/busses/i2c-qup.c:1784 qup_i2c_probe() warn: missing unwind goto? The goto label "fail_runtime" and "fail" will disable qup->pclk, but here qup->pclk failed to obtain, in order to be consistent, change the direct return to goto label "fail_dma". Fixes: 9cedf3b2f099 ("i2c: qup: Add bam dma capabilities") Signed-off-by: Shuai Jiang Reviewed-by: Dongliang Mu Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang Cc: # v4.6+ commit bd5c7104d41b62a2ae5d7f11d07e7c5f232eee42 Author: Rob Herring Date: Tue Jun 13 14:11:04 2023 -0600 dt-bindings: i2c: opencores: Add missing type for "regstep" "regstep" may be deprecated, but it still needs a type. Fixes: 8ad69f490516 ("dt-bindings: i2c: convert ocores binding to yaml") Signed-off-by: Rob Herring Reviewed-by: Andrew Lunn Reviewed-by: Peter Korsgaard Reviewed-by: Conor Dooley Acked-by: Andi Shyti Signed-off-by: Wolfram Sang commit 9bd9be5cbaf8a8faa175ef4fba04a5623281debe Merge: 45a3e24f65e90 54d217406afe2 Author: Dave Airlie Date: Fri Jun 23 12:16:47 2023 +1000 Merge tag 'drm-misc-fixes-2023-06-21' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v6.4: - Qaic imported dma-buf fix. - Fix null pointer deref when printing a dp-mst message. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/e96b1965-ba67-7cc5-2358-826eb5b9b998@lankhorst.se commit 8a28a0b6f1a1dcbf5a834600a9acfbe2ba51e5eb Merge: 412d070b31c3e 2ba7e7ebb6a71 Author: Linus Torvalds Date: Thu Jun 22 17:59:51 2023 -0700 Merge tag 'net-6.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from ipsec, bpf, mptcp and netfilter. Current release - regressions: - netfilter: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain - eth: mlx5e: - fix scheduling of IPsec ASO query while in atomic - free IRQ rmap and notifier on kernel shutdown Current release - new code bugs: - phy: manual remove LEDs to ensure correct ordering Previous releases - regressions: - mptcp: fix possible divide by zero in recvmsg() - dsa: revert "net: phy: dp83867: perform soft reset and retain established link" Previous releases - always broken: - sched: netem: acquire qdisc lock in netem_change() - bpf: - fix verifier id tracking of scalars on spill - fix NULL dereference on exceptions - accept function names that contain dots - netfilter: disallow element updates of bound anonymous sets - mptcp: ensure listener is unhashed before updating the sk status - xfrm: - add missed call to delete offloaded policies - fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets - selftests: fixes for FIPS mode - dsa: mt7530: fix multiple CPU ports, BPDU and LLDP handling - eth: sfc: use budget for TX completions Misc: - wifi: iwlwifi: add support for SO-F device with PCI id 0x7AF0" * tag 'net-6.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (74 commits) revert "net: align SO_RCVMARK required privileges with SO_MARK" net: wwan: iosm: Convert single instance struct member to flexible array sch_netem: acquire qdisc lock in netem_change() selftests: forwarding: Fix race condition in mirror installation wifi: mac80211: report all unusable beacon frames mptcp: ensure listener is unhashed before updating the sk status mptcp: drop legacy code around RX EOF mptcp: consolidate fallback and non fallback state machine mptcp: fix possible list corruption on passive MPJ mptcp: fix possible divide by zero in recvmsg() mptcp: handle correctly disconnect() failures bpf: Force kprobe multi expected_attach_type for kprobe_multi link bpf/btf: Accept function names that contain dots Revert "net: phy: dp83867: perform soft reset and retain established link" net: mdio: fix the wrong parameters netfilter: nf_tables: Fix for deleting base chains with payload netfilter: nfnetlink_osf: fix module autoload netfilter: nf_tables: drop module reference after updating chain netfilter: nf_tables: disallow timeout for anonymous sets netfilter: nf_tables: disallow updates of anonymous sets ... commit 412d070b31c3e4018afc6bb1712709df0464da48 Merge: e7758c0ddbc48 2623b3dc875a3 Author: Linus Torvalds Date: Thu Jun 22 17:54:10 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Correctly save/restore PMUSERNR_EL0 when host userspace is using PMU counters directly - Fix GICv2 emulation on GICv3 after the locking rework - Don't use smp_processor_id() in kvm_pmu_probe_armpmu(), and document why Generic: - Avoid setting page table entries pointing to a deleted memslot if a host page table entry is changed concurrently with the deletion" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: Avoid illegal stage2 mapping on invalid memory slot KVM: arm64: Use raw_smp_processor_id() in kvm_pmu_probe_armpmu() KVM: arm64: Restore GICv2-on-GICv3 functionality KVM: arm64: PMU: Don't overwrite PMUSERENR with vcpu loaded KVM: arm64: PMU: Restore the host's PMUSERENR_EL0 commit e7758c0ddbc48fec149baea667d2abc85229a997 Merge: 4a426aa1a2967 dfaed3e1fa709 Author: Linus Torvalds Date: Thu Jun 22 17:49:40 2023 -0700 Merge tag 'powerpc-6.4-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - Disable IRQs when switching mm in exit_lazy_flush_tlb() called from exit_mmap() Thanks to Nicholas Piggin and Sachin Sant. * tag 'powerpc-6.4-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/64s/radix: Fix exit lazy tlb mm switch with irqs enabled commit 4a426aa1a2967e4963a77bddaeab143f1d1f821f Merge: 937650021171f 40994ce0ea010 Author: Linus Torvalds Date: Thu Jun 22 17:47:07 2023 -0700 Merge tag 'pci-v6.4-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Transfer Intel LGM GW PCIe maintenance from Rahul Tanwar to Chuanhua Lei (Zhu YiXin) * tag 'pci-v6.4-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: MAINTAINERS: Add Chuanhua Lei as Intel LGM GW PCIe maintainer commit 937650021171f20e3fc743ef34fb4792f111946d Merge: 65d48989f81b9 413db49973024 Author: Linus Torvalds Date: Thu Jun 22 17:42:07 2023 -0700 Merge tag 'mmc-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - Fix support for deferred probing for several host drivers - litex_mmc: Use async probe as it's common for all mmc hosts - meson-gx: Fix bug when scheduling while atomic - mmci_stm32: Fix max busy timeout calculation - sdhci-msm: Disable broken 64-bit DMA on MSM8916 * tag 'mmc-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: usdhi60rol0: fix deferred probing mmc: sunxi: fix deferred probing mmc: sh_mmcif: fix deferred probing mmc: sdhci-spear: fix deferred probing mmc: sdhci-acpi: fix deferred probing mmc: owl: fix deferred probing mmc: omap_hsmmc: fix deferred probing mmc: omap: fix deferred probing mmc: mvsdio: fix deferred probing mmc: mtk-sd: fix deferred probing mmc: meson-gx: fix deferred probing mmc: bcm2835: fix deferred probing mmc: litex_mmc: set PROBE_PREFER_ASYNCHRONOUS mmc: meson-gx: remove redundant mmc_request_done() call from irq context mmc: mmci: stm32: fix max busy timeout calculation mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916 commit 65d48989f81b976b43c8b42c050f157900f61321 Merge: c213de632f7ae 146b6f6855e76 Author: Linus Torvalds Date: Thu Jun 22 17:38:11 2023 -0700 Merge tag 'platform-drivers-x86-v6.4-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fix from Hans de Goede: "One small fix for an AMD PMF driver issue which is causing issues for users of just released AMD laptop models" * tag 'platform-drivers-x86-v6.4-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/amd/pmf: Register notify handler only if SPS is enabled commit c213de632f7ae293409051733d24c7c6afc15292 Merge: 5950a0066f415 26fed83653d01 Author: Linus Torvalds Date: Thu Jun 22 17:32:34 2023 -0700 Merge tag 'io_uring-6.4-2023-06-21' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "A fix for a race condition with poll removal and linked timeouts, and then a few followup fixes/tweaks for the msg_control patch from last week. Not super important, particularly the sparse fixup, as it was broken before that recent commit. But let's get it sorted for real for this release, rather than just have it broken a bit differently" * tag 'io_uring-6.4-2023-06-21' of git://git.kernel.dk/linux: io_uring/net: use the correct msghdr union member in io_sendmsg_copy_hdr io_uring/net: disable partial retries for recvmsg with cmsg io_uring/net: clear msg_controllen on partial sendmsg retry io_uring/poll: serialize poll linked timer start with poll removal commit 5950a0066f415e4409a3b39ed6c5de1a04131894 Merge: dad9774deaf1c 6f363f5aa8455 Author: Linus Torvalds Date: Thu Jun 22 17:27:16 2023 -0700 Merge tag 'cgroup-for-6.4-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "It's late but here are two bug fixes. Both fix problems which can be severe but are very confined in scope. The risk to most use cases should be minimal. - Fix for an old bug which triggers if a cgroup subsystem is remounted to a different hierarchy while someone is reading its cgroup.procs/tasks file. The risk is pretty low given how seldom cgroup subsystems are moved across hierarchies. - We moved cpus_read_lock() outside of cgroup internal locks a while ago but forgot to update the legacy_freezer leading to lockdep triggers. Fixed" * tag 'cgroup-for-6.4-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Do not corrupt task iteration when rebinding subsystem cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex in freezer_css_{online,offline}() commit 2623b3dc875a3c92dd0e0775cd19fbaeef0574ca Merge: 2230f9e1171a2 30c60dda219dd Author: Paolo Bonzini Date: Thu Jun 22 15:28:26 2023 -0400 Merge tag 'kvmarm-fixes-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.4, take #4 - Correctly save/restore PMUSERNR_EL0 when host userspace is using PMU counters directly - Fix GICv2 emulation on GICv3 after the locking rework - Don't use smp_processor_id() in kvm_pmu_probe_armpmu(), and document why... commit 7b59e8ae92fe089fed8ff1b23e53442ae5b204c9 Author: Douglas Anderson Date: Fri Jun 16 08:14:41 2023 -0700 arm64: dts: qcom: sc7280: Mark SCM as dma-coherent for chrome devices Just like for sc7180 devices using the Chrome bootflow (AKA trogdor and IDP), sc7280 devices using the Chrome bootflow also need their firmware marked dma-coherent. On sc7280 this wasn't causing WiFi to fail to startup, since WiFi works differently there. However, on sc7280 devices we were still getting the message at bootup after commit 7bd6680b47fa ("Revert "Revert "arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()"""): qcom_scm firmware:scm: Assign memory protection call failed -22 qcom_rmtfs_mem 9c900000.memory: assign memory failed qcom_rmtfs_mem: probe of 9c900000.memory failed with error -22 We should mark SCM properly just like we did for trogdor. Fixes: 7bd6680b47fa ("Revert "Revert "arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()""") Fixes: 7a1f4e7f740d ("arm64: dts: qcom: sc7280: Add basic dts/dtsi files for sc7280 soc") Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20230616081440.v2.4.I21dc14a63327bf81c6bb58fe8ed91dbdc9849ee2@changeid Signed-off-by: Bjorn Andersson commit a54b7fa6b9ab6b4ecb7d9aba6b1a0ce1bcc961e3 Author: Douglas Anderson Date: Fri Jun 16 08:14:40 2023 -0700 arm64: dts: qcom: sc7180: Mark SCM as dma-coherent for trogdor Trogdor devices use firmware backed by TF-A instead of Qualcomm's normal TZ. On TF-A we end up mapping memory as cacheable. Specifically, you can see in Trogdor's TF-A code [1] in qti_sip_mem_assign() that we call qti_mmap_add_dynamic_region() with MT_RO_DATA. This translates down to MT_MEMORY instead of MT_NON_CACHEABLE or MT_DEVICE. Apparently Qualcomm's normal TZ implementation maps the memory as non-cacheable. Let's add the "dma-coherent" attribute to the SCM for trogdor. Adding "dma-coherent" like this fixes WiFi on sc7180-trogdor devices. WiFi was broken as of commit 7bd6680b47fa ("Revert "Revert "arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()"""). Specifically at bootup we'd get: qcom_scm firmware:scm: Assign memory protection call failed -22 qcom_rmtfs_mem 94600000.memory: assign memory failed qcom_rmtfs_mem: probe of 94600000.memory failed with error -22 From discussion on the mailing lists [2] and over IRC [3], it was determined that we should always have been tagging the SCM as dma-coherent on trogdor but that the old "invalidate" happened to make things work most of the time. Tagging it properly like this is a much more robust solution. [1] https://chromium.googlesource.com/chromiumos/third_party/arm-trusted-firmware/+/refs/heads/firmware-trogdor-13577.B/plat/qti/common/src/qti_syscall.c [2] https://lore.kernel.org/r/20230614165904.1.I279773c37e2c1ed8fbb622ca6d1397aea0023526@changeid [3] https://oftc.irclog.whitequark.org/linux-msm/2023-06-15 Fixes: 7bd6680b47fa ("Revert "Revert "arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()""") Fixes: 7ec3e67307f8 ("arm64: dts: qcom: sc7180-trogdor: add initial trogdor and lazor dt") Reviewed-by: Konrad Dybcio Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20230616081440.v2.3.Ic62daa649b47b656b313551d646c4de9a7da4bd4@changeid Signed-off-by: Bjorn Andersson commit 9a5f0b11e49e27f0a01a73c31d05df4a95bea3fa Author: Douglas Anderson Date: Fri Jun 16 08:14:39 2023 -0700 arm64: dts: qcom: sc7180: Mark SCM as dma-coherent for IDP sc7180-idp is, for most intents and purposes, a trogdor device. Specifically, sc7180-idp is designed to run the same style of firmware as trogdor devices. This can be seen from the fact that IDP has the same "Reserved memory changes" in its device tree that trogdor has. Recently it was realized that we need to mark SCM as dma-coherent to match what trogdor's style of firmware (based on TF-A) does [1]. That means we need this dma-coherent tag on IDP as well. Without this, on newer versions of Linux, specifically those with commit 7bd6680b47fa ("Revert "Revert "arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()"""), WiFi will fail to work. At bootup you'll see: qcom_scm firmware:scm: Assign memory protection call failed -22 qcom_rmtfs_mem 94600000.memory: assign memory failed qcom_rmtfs_mem: probe of 94600000.memory failed with error -22 [1] https://lore.kernel.org/r/20230615145253.1.Ic62daa649b47b656b313551d646c4de9a7da4bd4@changeid Fixes: 7bd6680b47fa ("Revert "Revert "arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()""") Fixes: f5ab220d162c ("arm64: dts: qcom: sc7180: Add remoteproc enablers") Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20230616081440.v2.2.I3c17d546d553378aa8a0c68c3fe04bccea7cba17@changeid Signed-off-by: Bjorn Andersson commit c0877829ada0406233aee5bd54f6813db79d5f1f Author: Douglas Anderson Date: Fri Jun 16 08:14:38 2023 -0700 dt-bindings: firmware: qcom,scm: Document that SCM can be dma-coherent Trogdor devices use firmware backed by TF-A instead of Qualcomm's normal TZ. On TF-A we end up mapping memory as cacheable. Specifically, you can see in Trogdor's TF-A code [1] in qti_sip_mem_assign() that we call qti_mmap_add_dynamic_region() with MT_RO_DATA. This translates down to MT_MEMORY instead of MT_NON_CACHEABLE or MT_DEVICE. Let's allow devices like trogdor to be described properly by allowing "dma-coherent" in the SCM node. Signed-off-by: Douglas Anderson Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230616081440.v2.1.Ie79b5f0ed45739695c9970df121e11d724909157@changeid Signed-off-by: Bjorn Andersson commit 2230f9e1171a2e9731422a14d1bbc313c0b719d1 Author: Gavin Shan Date: Thu Jun 15 15:42:59 2023 +1000 KVM: Avoid illegal stage2 mapping on invalid memory slot We run into guest hang in edk2 firmware when KSM is kept as running on the host. The edk2 firmware is waiting for status 0x80 from QEMU's pflash device (TYPE_PFLASH_CFI01) during the operation of sector erasing or buffered write. The status is returned by reading the memory region of the pflash device and the read request should have been forwarded to QEMU and emulated by it. Unfortunately, the read request is covered by an illegal stage2 mapping when the guest hang issue occurs. The read request is completed with QEMU bypassed and wrong status is fetched. The edk2 firmware runs into an infinite loop with the wrong status. The illegal stage2 mapping is populated due to same page sharing by KSM at (C) even the associated memory slot has been marked as invalid at (B) when the memory slot is requested to be deleted. It's notable that the active and inactive memory slots can't be swapped when we're in the middle of kvm_mmu_notifier_change_pte() because kvm->mn_active_invalidate_count is elevated, and kvm_swap_active_memslots() will busy loop until it reaches to zero again. Besides, the swapping from the active to the inactive memory slots is also avoided by holding &kvm->srcu in __kvm_handle_hva_range(), corresponding to synchronize_srcu_expedited() in kvm_swap_active_memslots(). CPU-A CPU-B ----- ----- ioctl(kvm_fd, KVM_SET_USER_MEMORY_REGION) kvm_vm_ioctl_set_memory_region kvm_set_memory_region __kvm_set_memory_region kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE) kvm_invalidate_memslot kvm_copy_memslot kvm_replace_memslot kvm_swap_active_memslots (A) kvm_arch_flush_shadow_memslot (B) same page sharing by KSM kvm_mmu_notifier_invalidate_range_start : kvm_mmu_notifier_change_pte kvm_handle_hva_range __kvm_handle_hva_range kvm_set_spte_gfn (C) : kvm_mmu_notifier_invalidate_range_end Fix the issue by skipping the invalid memory slot at (C) to avoid the illegal stage2 mapping so that the read request for the pflash's status is forwarded to QEMU and emulated by it. In this way, the correct pflash's status can be returned from QEMU to break the infinite loop in the edk2 firmware. We tried a git-bisect and the first problematic commit is cd4c71835228 (" KVM: arm64: Convert to the gfn-based MMU notifier callbacks"). With this, clean_dcache_guest_page() is called after the memory slots are iterated in kvm_mmu_notifier_change_pte(). clean_dcache_guest_page() is called before the iteration on the memory slots before this commit. This change literally enlarges the racy window between kvm_mmu_notifier_change_pte() and memory slot removal so that we're able to reproduce the issue in a practical test case. However, the issue exists since commit d5d8184d35c9 ("KVM: ARM: Memory virtualization setup"). Cc: stable@vger.kernel.org # v3.9+ Fixes: d5d8184d35c9 ("KVM: ARM: Memory virtualization setup") Reported-by: Shuai Hu Reported-by: Zhenyu Zhang Signed-off-by: Gavin Shan Reviewed-by: David Hildenbrand Reviewed-by: Oliver Upton Reviewed-by: Peter Xu Reviewed-by: Sean Christopherson Reviewed-by: Shaoqin Huang Message-Id: <20230615054259.14911-1-gshan@redhat.com> Signed-off-by: Paolo Bonzini commit cb091225a538005965b7c59c7c33ebe5358a5815 Author: Qu Wenruo Date: Thu Jun 22 14:42:40 2023 +0800 btrfs: fix remaining u32 overflows when left shifting stripe_nr There was regression caused by a97699d1d610 ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") and supposedly fixed by a7299a18a179 ("btrfs: fix u32 overflows when left shifting stripe_nr"). To avoid code churn the fix was open coding the type casts but unfortunately missed one which was still possible to hit [1]. The missing place was assignment of bioc->full_stripe_logical inside btrfs_map_block(). Fix it by adding a helper that does the safe calculation of the offset and use it everywhere even though it may not be strictly necessary due to already using u64 types. This replaces all remaining "<< BTRFS_STRIPE_LEN_SHIFT" calls. [1] https://lore.kernel.org/linux-btrfs/20230622065438.86402-1-wqu@suse.com/ Fixes: a7299a18a179 ("btrfs: fix u32 overflows when left shifting stripe_nr") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit 9c39b7a905d84b7da5f59d80f2e455853fea7217 Author: Ming Lei Date: Thu Jun 22 16:42:49 2023 +0800 block: make sure local irq is disabled when calling __blkcg_rstat_flush When __blkcg_rstat_flush() is called from cgroup_rstat_flush*() code path, interrupt is always disabled. When we start to flush blkcg per-cpu stats list in __blkg_release() for avoiding to leak blkcg_gq's reference in commit 20cb1c2fb756 ("blk-cgroup: Flush stats before releasing blkcg_gq"), local irq isn't disabled yet, then lockdep warning may be triggered because the dependent cgroup locks may be acquired from irq(soft irq) handler. Fix the issue by disabling local irq always. Fixes: 20cb1c2fb756 ("blk-cgroup: Flush stats before releasing blkcg_gq") Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/linux-block/pz2wzwnmn5tk3pwpskmjhli6g3qly7eoknilb26of376c7kwxy@qydzpvt6zpis/T/#u Cc: stable@vger.kernel.org Cc: Jay Shin Cc: Tejun Heo Cc: Waiman Long Signed-off-by: Ming Lei Reviewed-by: Waiman Long Link: https://lore.kernel.org/r/20230622084249.1208005-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 2ba7e7ebb6a71407cbe25cd349c9b05d40520bf0 Merge: a9628e88776eb 42e344f016884 Author: Paolo Abeni Date: Thu Jun 22 14:39:06 2023 +0200 Merge tag 'nf-23-06-21' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net This is v3, including a crash fix for patch 01/14. The following patchset contains Netfilter/IPVS fixes for net: 1) Fix UDP segmentation with IPVS tunneled traffic, from Terin Stock. 2) Fix chain binding transaction logic, add a bound flag to rule transactions. Remove incorrect logic in nft_data_hold() and nft_data_release(). 3) Add a NFT_TRANS_PREPARE_ERROR deactivate state to deal with releasing the set/chain as a follow up to 1240eb93f061 ("netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE") 4) Drop map element references from preparation phase instead of set destroy path, otherwise bogus EBUSY with transactions such as: flush chain ip x y delete chain ip x w where chain ip x y contains jump/goto from set elements. 5) Pipapo set type does not regard generation mask from the walk iteration. 6) Fix reference count underflow in set element reference to stateful object. 7) Several patches to tighten the nf_tables API: - disallow set element updates of bound anonymous set - disallow unbound anonymous set/chain at the end of transaction. - disallow updates of anonymous set. - disallow timeout configuration for anonymous sets. 8) Fix module reference leak in chain updates. 9) Fix nfnetlink_osf module autoload. 10) Fix deletion of basechain when NFTA_CHAIN_HOOK is specified as in iptables-nft. This Netfilter batch is larger than usual at this stage, I am aware we are fairly late in the -rc cycle, if you prefer to route them through net-next, please let me know. netfilter pull request 23-06-21 * tag 'nf-23-06-21' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: Fix for deleting base chains with payload netfilter: nfnetlink_osf: fix module autoload netfilter: nf_tables: drop module reference after updating chain netfilter: nf_tables: disallow timeout for anonymous sets netfilter: nf_tables: disallow updates of anonymous sets netfilter: nf_tables: reject unbound chain set before commit phase netfilter: nf_tables: reject unbound anonymous set before commit phase netfilter: nf_tables: disallow element updates of bound anonymous sets netfilter: nf_tables: fix underflow in object reference counter netfilter: nft_set_pipapo: .walk does not deal with generations netfilter: nf_tables: drop map element references from preparation phase netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain netfilter: nf_tables: fix chain binding transaction logic ipvs: align inner_mac_header for encapsulation ==================== Link: https://lore.kernel.org/r/20230621100731.68068-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit a9628e88776eb7d045cf46467f1afdd0f7fe72ea Author: Maciej Żenczykowski Date: Sun Jun 18 03:31:30 2023 -0700 revert "net: align SO_RCVMARK required privileges with SO_MARK" This reverts commit 1f86123b9749 ("net: align SO_RCVMARK required privileges with SO_MARK") because the reasoning in the commit message is not really correct: SO_RCVMARK is used for 'reading' incoming skb mark (via cmsg), as such it is more equivalent to 'getsockopt(SO_MARK)' which has no priv check and retrieves the socket mark, rather than 'setsockopt(SO_MARK) which sets the socket mark and does require privs. Additionally incoming skb->mark may already be visible if sysctl_fwmark_reflect and/or sysctl_tcp_fwmark_accept are enabled. Furthermore, it is easier to block the getsockopt via bpf (either cgroup setsockopt hook, or via syscall filters) then to unblock it if it requires CAP_NET_RAW/ADMIN. On Android the socket mark is (among other things) used to store the network identifier a socket is bound to. Setting it is privileged, but retrieving it is not. We'd like unprivileged userspace to be able to read the network id of incoming packets (where mark is set via iptables [to be moved to bpf])... An alternative would be to add another sysctl to control whether setting SO_RCVMARK is privilged or not. (or even a MASK of which bits in the mark can be exposed) But this seems like over-engineering... Note: This is a non-trivial revert, due to later merged commit e42c7beee71d ("bpf: net: Consider has_current_bpf_ctx() when testing capable() in sk_setsockopt()") which changed both 'ns_capable' into 'sockopt_ns_capable' calls. Fixes: 1f86123b9749 ("net: align SO_RCVMARK required privileges with SO_MARK") Cc: Larysa Zaremba Cc: Simon Horman Cc: Paolo Abeni Cc: Eyal Birger Cc: Jakub Kicinski Cc: Eric Dumazet Cc: Patrick Rohr Signed-off-by: Maciej Żenczykowski Reviewed-by: Simon Horman Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230618103130.51628-1-maze@google.com Signed-off-by: Paolo Abeni commit dec24b3b339487e58ce2da2875e9ee0316cc7e70 Author: Kees Cook Date: Tue Jun 20 12:42:38 2023 -0700 net: wwan: iosm: Convert single instance struct member to flexible array struct mux_adth actually ends with multiple struct mux_adth_dg members. This is seen both in the comments about the member: /** * struct mux_adth - Structure of the Aggregated Datagram Table Header. ... * @dg: datagramm table with variable length */ and in the preparation for populating it: adth_dg_size = offsetof(struct mux_adth, dg) + ul_adb->dg_count[i] * sizeof(*dg); ... adth_dg_size -= offsetof(struct mux_adth, dg); memcpy(&adth->dg, ul_adb->dg[i], adth_dg_size); This was reported as a run-time false positive warning: memcpy: detected field-spanning write (size 16) of single field "&adth->dg" at drivers/net/wwan/iosm/iosm_ipc_mux_codec.c:852 (size 8) Adjust the struct mux_adth definition and associated sizeof() math; no binary output differences are observed in the resulting object file. Reported-by: Florian Klink Closes: https://lore.kernel.org/lkml/dbfa25f5-64c8-5574-4f5d-0151ba95d232@gmail.com/ Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support") Cc: M Chetan Kumar Cc: Bagas Sanjaya Cc: Intel Corporation Cc: Loic Poulain Cc: Sergey Ryazanov Cc: Johannes Berg Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: "Gustavo A. R. Silva" Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230620194234.never.023-kees@kernel.org Signed-off-by: Paolo Abeni commit 2174a08db80d1efeea382e25ac41c4e7511eb6d6 Author: Eric Dumazet Date: Tue Jun 20 18:44:25 2023 +0000 sch_netem: acquire qdisc lock in netem_change() syzbot managed to trigger a divide error [1] in netem. It could happen if q->rate changes while netem_enqueue() is running, since q->rate is read twice. It turns out netem_change() always lacked proper synchronization. [1] divide error: 0000 [#1] SMP KASAN CPU: 1 PID: 7867 Comm: syz-executor.1 Not tainted 6.1.30-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 RIP: 0010:div64_u64 include/linux/math64.h:69 [inline] RIP: 0010:packet_time_ns net/sched/sch_netem.c:357 [inline] RIP: 0010:netem_enqueue+0x2067/0x36d0 net/sched/sch_netem.c:576 Code: 89 e2 48 69 da 00 ca 9a 3b 42 80 3c 28 00 4c 8b a4 24 88 00 00 00 74 0d 4c 89 e7 e8 c3 4f 3b fd 48 8b 4c 24 18 48 89 d8 31 d2 <49> f7 34 24 49 01 c7 4c 8b 64 24 48 4d 01 f7 4c 89 e3 48 c1 eb 03 RSP: 0018:ffffc9000dccea60 EFLAGS: 00010246 RAX: 000001a442624200 RBX: 000001a442624200 RCX: ffff888108a4f000 RDX: 0000000000000000 RSI: 000000000000070d RDI: 000000000000070d RBP: ffffc9000dcceb90 R08: ffffffff849c5e26 R09: fffffbfff10e1297 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888108a4f358 R13: dffffc0000000000 R14: 0000001a8cd9a7ec R15: 0000000000000000 FS: 00007fa73fe18700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa73fdf7718 CR3: 000000011d36e000 CR4: 0000000000350ee0 Call Trace: [] __dev_xmit_skb net/core/dev.c:3931 [inline] [] __dev_queue_xmit+0xcf5/0x3370 net/core/dev.c:4290 [] dev_queue_xmit include/linux/netdevice.h:3030 [inline] [] neigh_hh_output include/net/neighbour.h:531 [inline] [] neigh_output include/net/neighbour.h:545 [inline] [] ip_finish_output2+0xb92/0x10d0 net/ipv4/ip_output.c:235 [] __ip_finish_output+0xc3/0x2b0 [] ip_finish_output+0x31/0x2a0 net/ipv4/ip_output.c:323 [] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [] ip_output+0x224/0x2a0 net/ipv4/ip_output.c:437 [] dst_output include/net/dst.h:444 [inline] [] ip_local_out net/ipv4/ip_output.c:127 [inline] [] __ip_queue_xmit+0x1425/0x2000 net/ipv4/ip_output.c:542 [] ip_queue_xmit+0x4c/0x70 net/ipv4/ip_output.c:556 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Stephen Hemminger Cc: Jamal Hadi Salim Cc: Cong Wang Cc: Jiri Pirko Reviewed-by: Jamal Hadi Salim Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230620184425.1179809-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 146b6f6855e7656e8329910606595220c761daac Author: Shyam Sundar S K Date: Thu Jun 22 11:33:09 2023 +0530 platform/x86/amd/pmf: Register notify handler only if SPS is enabled Power source notify handler is getting registered even when none of the PMF feature in enabled leading to a crash. ... [ 22.592162] Call Trace: [ 22.592164] [ 22.592164] ? rcu_note_context_switch+0x5e0/0x660 [ 22.592166] ? __warn+0x81/0x130 [ 22.592171] ? rcu_note_context_switch+0x5e0/0x660 [ 22.592172] ? report_bug+0x171/0x1a0 [ 22.592175] ? prb_read_valid+0x1b/0x30 [ 22.592177] ? handle_bug+0x3c/0x80 [ 22.592178] ? exc_invalid_op+0x17/0x70 [ 22.592179] ? asm_exc_invalid_op+0x1a/0x20 [ 22.592182] ? rcu_note_context_switch+0x5e0/0x660 [ 22.592183] ? acpi_ut_delete_object_desc+0x86/0xb0 [ 22.592186] ? acpi_ut_update_ref_count.part.0+0x22d/0x930 [ 22.592187] __schedule+0xc0/0x1410 [ 22.592189] ? ktime_get+0x3c/0xa0 [ 22.592191] ? lapic_next_event+0x1d/0x30 [ 22.592193] ? hrtimer_start_range_ns+0x25b/0x350 [ 22.592196] schedule+0x5e/0xd0 [ 22.592197] schedule_hrtimeout_range_clock+0xbe/0x140 [ 22.592199] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 22.592200] usleep_range_state+0x64/0x90 [ 22.592203] amd_pmf_send_cmd+0x106/0x2a0 [amd_pmf bddfe0fe3712aaa99acce3d5487405c5213c6616] [ 22.592207] amd_pmf_update_slider+0x56/0x1b0 [amd_pmf bddfe0fe3712aaa99acce3d5487405c5213c6616] [ 22.592210] amd_pmf_set_sps_power_limits+0x72/0x80 [amd_pmf bddfe0fe3712aaa99acce3d5487405c5213c6616] [ 22.592213] amd_pmf_pwr_src_notify_call+0x49/0x90 [amd_pmf bddfe0fe3712aaa99acce3d5487405c5213c6616] [ 22.592216] notifier_call_chain+0x5a/0xd0 [ 22.592218] atomic_notifier_call_chain+0x32/0x50 ... Fix this by moving the registration of source change notify handler only when SPS(Static Slider) is advertised as supported. Reported-by: Allen Zhong Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217571 Fixes: 4c71ae414474 ("platform/x86/amd/pmf: Add support SPS PMF feature") Tested-by: Patil Rajesh Reddy Reviewed-by: Mario Limonciello Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20230622060309.310001-1-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit c7c059fba6fb19c3bc924925c984772e733cb594 Author: Danielle Ratson Date: Tue Jun 20 14:45:15 2023 +0200 selftests: forwarding: Fix race condition in mirror installation When mirroring to a gretap in hardware the device expects to be programmed with the egress port and all the encapsulating headers. This requires the driver to resolve the path the packet will take in the software data path and program the device accordingly. If the path cannot be resolved (in this case because of an unresolved neighbor), then mirror installation fails until the path is resolved. This results in a race that causes the test to sometimes fail. Fix this by setting the neighbor's state to permanent in a couple of tests, so that it is always valid. Fixes: 35c31d5c323f ("selftests: forwarding: Test mirror-to-gretap w/ UL 802.1d") Fixes: 239e754af854 ("selftests: forwarding: Test mirror-to-gretap w/ UL 802.1q") Signed-off-by: Danielle Ratson Reviewed-by: Petr Machata Signed-off-by: Petr Machata Link: https://lore.kernel.org/r/268816ac729cb6028c7a34d4dda6f4ec7af55333.1687264607.git.petrm@nvidia.com Signed-off-by: Paolo Abeni commit 7f4e09700bdc13ce9aafa279bc999051e9bcda35 Author: Benjamin Berg Date: Wed Jun 21 14:05:44 2023 +0200 wifi: mac80211: report all unusable beacon frames Properly check for RX_DROP_UNUSABLE now that the new drop reason infrastructure is used. Without this change, the comparison will always be false as a more specific reason is given in the lower bits of result. Fixes: baa951a1c177 ("mac80211: use the new drop reasons infrastructure") Signed-off-by: Benjamin Berg Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20230621120543.412920-2-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 533aa0baaa1fe1f9f7f3ae0a368c22df8f3cf127 Merge: 59bb14bda2f86 57fc0f1ceaa40 Author: Jakub Kicinski Date: Wed Jun 21 22:44:59 2023 -0700 Merge branch 'mptcp-fixes-for-6-4' Matthieu Baerts says: ==================== mptcp: fixes for 6.4 Patch 1 correctly handles disconnect() failures that can happen in some specific cases: now the socket state is set as unconnected as expected. That fixes an issue introduced in v6.2. Patch 2 fixes a divide by zero bug in mptcp_recvmsg() with a fix similar to a recent one from Eric Dumazet for TCP introducing sk_wait_pending flag. It should address an issue present in MPTCP from almost the beginning, from v5.9. Patch 3 fixes a possible list corruption on passive MPJ even if the race seems very unlikely, better be safe than sorry. The possible issue is present from v5.17. Patch 4 consolidates fallback and non fallback state machines to avoid leaking some MPTCP sockets. The fix is likely needed for versions from v5.11. Patch 5 drops code that is no longer used after the introduction of patch 4/6. This is not really a fix but this patch can probably land in the -net tree as well not to leave unused code. Patch 6 ensures listeners are unhashed before updating their sk status to avoid possible deadlocks when diag info are going to be retrieved with a lock. Even if it should not be visible with the way we are currently getting diag info, the issue is present from v5.17. ==================== Link: https://lore.kernel.org/r/20230620-upstream-net-20230620-misc-fixes-for-v6-4-v1-0-f36aa5eae8b9@tessares.net Signed-off-by: Jakub Kicinski commit 57fc0f1ceaa4016354cf6f88533e20b56190e41a Author: Paolo Abeni Date: Tue Jun 20 18:24:23 2023 +0200 mptcp: ensure listener is unhashed before updating the sk status The MPTCP protocol access the listener subflow in a lockless manner in a couple of places (poll, diag). That works only if the msk itself leaves the listener status only after that the subflow itself has been closed/disconnected. Otherwise we risk deadlock in diag, as reported by Christoph. Address the issue ensuring that the first subflow (the listener one) is always disconnected before updating the msk socket status. Reported-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/407 Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit b7535cfed223a9f02f9530853616f197b386d775 Author: Paolo Abeni Date: Tue Jun 20 18:24:22 2023 +0200 mptcp: drop legacy code around RX EOF Thanks to the previous patch -- "mptcp: consolidate fallback and non fallback state machine" -- we can finally drop the "temporary hack" used to detect rx eof. Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 81c1d029016001f994ce1c46849c5e9900d8eab8 Author: Paolo Abeni Date: Tue Jun 20 18:24:21 2023 +0200 mptcp: consolidate fallback and non fallback state machine An orphaned msk releases the used resources via the worker, when the latter first see the msk in CLOSED status. If the msk status transitions to TCP_CLOSE in the release callback invoked by the worker's final release_sock(), such instance of the workqueue will not take any action. Additionally the MPTCP code prevents scheduling the worker once the socket reaches the CLOSE status: such msk resources will be leaked. The only code path that can trigger the above scenario is the __mptcp_check_send_data_fin() in fallback mode. Address the issue removing the special handling of fallback socket in __mptcp_check_send_data_fin(), consolidating the state machine for fallback and non fallback socket. Since non-fallback sockets do not send and do not receive data_fin, the mptcp code can update the msk internal status to match the next step in the SM every time data fin (ack) should be generated or received. As a consequence we can remove a bunch of checks for fallback from the fastpath. Fixes: 6e628cd3a8f7 ("mptcp: use mptcp release_cb for delayed tasks") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 56a666c48b038e91b76471289e2cf60c79d326b9 Author: Paolo Abeni Date: Tue Jun 20 18:24:20 2023 +0200 mptcp: fix possible list corruption on passive MPJ At passive MPJ time, if the msk socket lock is held by the user, the new subflow is appended to the msk->join_list under the msk data lock. In mptcp_release_cb()/__mptcp_flush_join_list(), the subflows in that list are moved from the join_list into the conn_list under the msk socket lock. Append and removal could race, possibly corrupting such list. Address the issue splicing the join list into a temporary one while still under the msk data lock. Found by code inspection, the race itself should be almost impossible to trigger in practice. Fixes: 3e5014909b56 ("mptcp: cleanup MPJ subflow list handling") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 0ad529d9fd2bfa3fc619552a8d2fb2f2ef0bce2e Author: Paolo Abeni Date: Tue Jun 20 18:24:19 2023 +0200 mptcp: fix possible divide by zero in recvmsg() Christoph reported a divide by zero bug in mptcp_recvmsg(): divide error: 0000 [#1] PREEMPT SMP CPU: 1 PID: 19978 Comm: syz-executor.6 Not tainted 6.4.0-rc2-gffcc7899081b #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:__tcp_select_window+0x30e/0x420 net/ipv4/tcp_output.c:3018 Code: 11 ff 0f b7 cd c1 e9 0c b8 ff ff ff ff d3 e0 89 c1 f7 d1 01 cb 21 c3 eb 17 e8 2e 83 11 ff 31 db eb 0e e8 25 83 11 ff 89 d8 99 7c 24 04 29 d3 65 48 8b 04 25 28 00 00 00 48 3b 44 24 10 75 60 RSP: 0018:ffffc90000a07a18 EFLAGS: 00010246 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000040000 RDX: 0000000000000000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: 000000000000ffd7 R08: ffffffff820cf297 R09: 0000000000000001 R10: 0000000000000000 R11: ffffffff8103d1a0 R12: 0000000000003f00 R13: 0000000000300000 R14: ffff888101cf3540 R15: 0000000000180000 FS: 00007f9af4c09640(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33824000 CR3: 000000012f241001 CR4: 0000000000170ee0 Call Trace: __tcp_cleanup_rbuf+0x138/0x1d0 net/ipv4/tcp.c:1611 mptcp_recvmsg+0xcb8/0xdd0 net/mptcp/protocol.c:2034 inet_recvmsg+0x127/0x1f0 net/ipv4/af_inet.c:861 ____sys_recvmsg+0x269/0x2b0 net/socket.c:1019 ___sys_recvmsg+0xe6/0x260 net/socket.c:2764 do_recvmmsg+0x1a5/0x470 net/socket.c:2858 __do_sys_recvmmsg net/socket.c:2937 [inline] __se_sys_recvmmsg net/socket.c:2953 [inline] __x64_sys_recvmmsg+0xa6/0x130 net/socket.c:2953 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x47/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f9af58fc6a9 Code: 5c c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 37 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007f9af4c08cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f9af58fc6a9 RDX: 0000000000000001 RSI: 0000000020000140 RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000f00 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 mptcp_recvmsg is allowed to release the msk socket lock when blocking, and before re-acquiring it another thread could have switched the sock to TCP_LISTEN status - with a prior connect(AF_UNSPEC) - also clearing icsk_ack.rcv_mss. Address the issue preventing the disconnect if some other process is concurrently performing a blocking syscall on the same socket, alike commit 4faeee0cf8a5 ("tcp: deny tcp_disconnect() when threads are waiting"). Fixes: a6b118febbab ("mptcp: add receive buffer auto-tuning") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/404 Signed-off-by: Paolo Abeni Tested-by: Christoph Paasch Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit c2b2ae3925b65070adb27d5a31a31c376f26dec7 Author: Paolo Abeni Date: Tue Jun 20 18:24:18 2023 +0200 mptcp: handle correctly disconnect() failures Currently the mptcp code has assumes that disconnect() can fail only at mptcp_sendmsg_fastopen() time - to avoid a deadlock scenario - and don't even bother returning an error code. Soon mptcp_disconnect() will handle more error conditions: let's track them explicitly. As a bonus, explicitly annotate TCP-level disconnect as not failing: the mptcp code never blocks for event on the subflows. Fixes: 7d803344fdc3 ("mptcp: fix deadlock in fastopen error path") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Tested-by: Christoph Paasch Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 59bb14bda2f86550d10e65c9091ba442a0ac4b45 Merge: a129b41fe0a8b db8eae6bc5c70 Author: Jakub Kicinski Date: Wed Jun 21 13:59:46 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-06-21 We've added 7 non-merge commits during the last 14 day(s) which contain a total of 7 files changed, 181 insertions(+), 15 deletions(-). The main changes are: 1) Fix a verifier id tracking issue with scalars upon spill, from Maxim Mikityanskiy. 2) Fix NULL dereference if an exception is generated while a BPF subprogram is running, from Krister Johansen. 3) Fix a BTF verification failure when compiling kernel with LLVM_IAS=0, from Florent Revest. 4) Fix expected_attach_type enforcement for kprobe_multi link, from Jiri Olsa. 5) Fix a bpf_jit_dump issue for x86_64 to pick the correct JITed image, from Yonghong Song. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Force kprobe multi expected_attach_type for kprobe_multi link bpf/btf: Accept function names that contain dots selftests/bpf: add a test for subprogram extables bpf: ensure main program has an extable bpf: Fix a bpf_jit_dump issue for x86_64 with sysctl bpf_jit_enable. selftests/bpf: Add test cases to assert proper ID tracking on spill bpf: Fix verifier id tracking of scalars on spill ==================== Link: https://lore.kernel.org/r/20230621101116.16122-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit dad9774deaf1cf8e8f7483310dfb2690310193d2 Merge: 007034977130b 13bb06f8dd420 Author: Linus Torvalds Date: Wed Jun 21 12:36:34 2023 -0700 Merge tag 'timers-urgent-2023-06-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "A single regression fix for a regression fix: For a long time the tick was aligned to clock MONOTONIC so that the tick event happened at a multiple of nanoseconds per tick starting from clock MONOTONIC = 0. At some point this changed as the refined jiffies clocksource which is used during boot before the TSC or other clocksources becomes usable, was adjusted with a boot offset, so that time 0 is closer to the point where the kernel starts. This broke the assumption in the tick code that when the tick setup happens early on ktime_get() will return a multiple of nanoseconds per tick. As a consequence applications which aligned their periodic execution so that it does not collide with the tick were not longer guaranteed that the tick period starts from time 0. The fix for this regression was to realign the tick when it is initially set up to a multiple of tick periods. That works as long as the underlying tick device supports periodic mode, but breaks under certain conditions when the tick device supports only one shot mode. Depending on the offset, the alignment delta to clock MONOTONIC can get in a range where the minimal programming delta of the underlying clock event device is larger than the calculated delta to the next tick. This results in a boot hang as the tick code tries to play catch up, but as the tick never fires jiffies are not advanced so it keeps trying for ever. Solve this by moving the tick alignement into the NOHZ / HIGHRES enablement code because at that point it is guaranteed that the underlying clocksource is high resolution capable and not longer depending on the tick. This is far before user space starts, so at the point where applications try to align their timers, the old behaviour of the tick happening at a multiple of nanoseconds per tick starting from clock MONOTONIC = 0 is restored" * tag 'timers-urgent-2023-06-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tick/common: Align tick period during sched_timer setup commit 007034977130b49b618a5206aad54f634d9f169c Merge: 69cbeb61ff909 afd384f0dbea2 Author: Linus Torvalds Date: Wed Jun 21 11:10:40 2023 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fix from Michael Tsirkin: "A last minute revert to fix a regression" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: Revert "virtio-blk: support completion batching for the IRQ path" commit 69cbeb61ff9093a9155cb19a36d633033f71093a Author: Linus Torvalds Date: Wed Jun 21 10:58:46 2023 -0700 Revert "efi: random: refresh non-volatile random seed when RNG is initialized" This reverts commit e7b813b32a42a3a6281a4fd9ae7700a0257c1d50 (and the subsequent fix for it: 41a15855c1ee "efi: random: fix NULL-deref when refreshing seed"). It turns otu to cause non-deterministic boot stalls on at least a HP 6730b laptop. Reported-and-bisected-by: Sami Korkalainen Link: https://lore.kernel.org/all/GQUnKz2al3yke5mB2i1kp3SzNHjK8vi6KJEh7rnLrOQ24OrlljeCyeWveLW9pICEmB9Qc8PKdNt3w1t_g3-Uvxq1l8Wj67PpoMeWDoH8PKk=@proton.me/ Cc: Jason A. Donenfeld Cc: Bagas Sanjaya Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 2214170caabbff673935eb046a7edf4621213931 Merge: 6e6fb54de1ef3 9d7054fb3ac2e Author: Linus Torvalds Date: Wed Jun 21 10:32:42 2023 -0700 Merge tag 'spi-fix-v6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One last fix for SPI, just a simple fix for incorrect handling of probe deferral for DMA in the Qualcomm GENI driver" * tag 'spi-fix-v6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-geni-qcom: correctly handle -EPROBE_DEFER from dma_request_chan() commit 6e6fb54de1ef34fd20a0bdd99ce72a657814391b Merge: e075d681a27ee 7257d930aadcd Author: Linus Torvalds Date: Wed Jun 21 10:29:42 2023 -0700 Merge tag 'regulator-fix-v6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One simple fix for v6.4, some incorrectly specified bitfield masks in the PCA9450 driver" * tag 'regulator-fix-v6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK commit e075d681a27eea6e3722749dda10cf3c4ddfc9fc Merge: 8ba90f5cc7170 c8e796895e231 Author: Linus Torvalds Date: Wed Jun 21 10:25:43 2023 -0700 Merge tag 'regmap-fix-v6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "One more fix for v6.4 The earlier fix to take account of the register data size when limiting raw register writes exposed the fact that the Intel AVMM bus was incorrectly specifying too low a limit on the maximum data transfer, it is only capable of transmitting one register so had set a transfer size limit that couldn't fit both the value and the the register address into a single message" * tag 'regmap-fix-v6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: spi-avmm: Fix regmap_bus max_raw_write commit 26fed83653d0154704cadb7afc418f315c7ac1f0 Author: Jens Axboe Date: Tue Jun 20 16:11:51 2023 -0600 io_uring/net: use the correct msghdr union member in io_sendmsg_copy_hdr Rather than assign the user pointer to msghdr->msg_control, assign it to msghdr->msg_control_user to make sparse happy. They are in a union so the end result is the same, but let's avoid new sparse warnings and squash this one. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306210654.mDMcyMuB-lkp@intel.com/ Fixes: cac9e4418f4c ("io_uring/net: save msghdr->msg_control for retries") Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 78d0d2063bab954d19a1696feae4c7706a626d48 Author: Jens Axboe Date: Mon Jun 19 09:41:05 2023 -0600 io_uring/net: disable partial retries for recvmsg with cmsg We cannot sanely handle partial retries for recvmsg if we have cmsg attached. If we don't, then we'd just be overwriting the initial cmsg header on retries. Alternatively we could increment and handle this appropriately, but it doesn't seem worth the complication. Move the MSG_WAITALL check into the non-multishot case while at it, since MSG_WAITALL is explicitly disabled for multishot anyway. Link: https://lore.kernel.org/io-uring/0b0d4411-c8fd-4272-770b-e030af6919a0@kernel.dk/ Cc: stable@vger.kernel.org # 5.10+ Reported-by: Stefan Metzmacher Reviewed-by: Stefan Metzmacher Signed-off-by: Jens Axboe commit b1dc492087db0f2e5a45f1072a743d04618dd6be Author: Jens Axboe Date: Mon Jun 19 09:35:34 2023 -0600 io_uring/net: clear msg_controllen on partial sendmsg retry If we have cmsg attached AND we transferred partial data at least, clear msg_controllen on retry so we don't attempt to send that again. Cc: stable@vger.kernel.org # 5.10+ Fixes: cac9e4418f4c ("io_uring/net: save msghdr->msg_control for retries") Reported-by: Stefan Metzmacher Reviewed-by: Stefan Metzmacher Signed-off-by: Jens Axboe commit 6f9441f4e3ebf86b8a0427f14ee1753f2183a3cf Merge: 82edd1bd7f985 1f1ef7e5bbe2d Author: Takashi Iwai Date: Wed Jun 21 15:23:23 2023 +0200 Merge tag 'asoc-fix-v6.4-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fix for v6.4 A fix for a typoed iterator in the Intel Soundwire driver, fairly simple on inspection though not reviewed by Intel. commit 82edd1bd7f98567928871e2a2a317724d35f0085 Author: Luke D. Jones Date: Wed Jun 21 20:57:15 2023 +1200 ALSA: hda/realtek: Add quirk for ASUS ROG GV601V Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG GV601V series. While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet). Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20230621085715.5382-1-luke@ljones.dev Signed-off-by: Takashi Iwai commit db8eae6bc5c702d8e3ab2d0c6bb5976c131576eb Author: Jiri Olsa Date: Sun Jun 18 15:14:14 2023 +0200 bpf: Force kprobe multi expected_attach_type for kprobe_multi link We currently allow to create perf link for program with expected_attach_type == BPF_TRACE_KPROBE_MULTI. This will cause crash when we call helpers like get_attach_cookie or get_func_ip in such program, because it will call the kprobe_multi's version (current->bpf_ctx context setup) of those helpers while it expects perf_link's current->bpf_ctx context setup. Making sure that we use BPF_TRACE_KPROBE_MULTI expected_attach_type only for programs attaching through kprobe_multi link. Fixes: ca74823c6e16 ("bpf: Add cookie support to programs attached with kprobe multi link") Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230618131414.75649-1-jolsa@kernel.org commit 9724160b3942b0a967b91a59f81da5593f28b8ba Author: Florent Revest Date: Thu Jun 15 16:56:07 2023 +0200 bpf/btf: Accept function names that contain dots When building a kernel with LLVM=1, LLVM_IAS=0 and CONFIG_KASAN=y, LLVM leaves DWARF tags for the "asan.module_ctor" & co symbols. In turn, pahole creates BTF_KIND_FUNC entries for these and this makes the BTF metadata validation fail because they contain a dot. In a dramatic turn of event, this BTF verification failure can cause the netfilter_bpf initialization to fail, causing netfilter_core to free the netfilter_helper hashmap and netfilter_ftp to trigger a use-after-free. The risk of u-a-f in netfilter will be addressed separately but the existence of "asan.module_ctor" debug info under some build conditions sounds like a good enough reason to accept functions that contain dots in BTF. Although using only LLVM=1 is the recommended way to compile clang-based kernels, users can certainly do LLVM=1, LLVM_IAS=0 as well and we still try to support that combination according to Nick. To clarify: - > v5.10 kernel, LLVM=1 (LLVM_IAS=0 is not the default) is recommended, but user can still have LLVM=1, LLVM_IAS=0 to trigger the issue - <= 5.10 kernel, LLVM=1 (LLVM_IAS=0 is the default) is recommended in which case GNU as will be used Fixes: 1dc92851849c ("bpf: kernel side support for BTF Var and DataSec") Signed-off-by: Florent Revest Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Cc: Yonghong Song Cc: Nick Desaulniers Link: https://lore.kernel.org/bpf/20230615145607.3469985-1-revest@chromium.org commit afd384f0dbea2229fd11159efb86a5b41051c4a9 Author: Michael S. Tsirkin Date: Thu Jun 8 17:42:53 2023 -0400 Revert "virtio-blk: support completion batching for the IRQ path" This reverts commit 07b679f70d73483930e8d3c293942416d9cd5c13. This change appears to have broken things... We now see applications hanging during disk accesses. e.g. multi-port virtio-blk device running in h/w (FPGA) Host running a simple 'fio' test. [global] thread=1 direct=1 ioengine=libaio norandommap=1 group_reporting=1 bs=4K rw=read iodepth=128 runtime=1 numjobs=4 time_based [job0] filename=/dev/vda [job1] filename=/dev/vdb [job2] filename=/dev/vdc ... [job15] filename=/dev/vdp i.e. 16 disks; 4 queues per disk; simple burst of 4KB reads This is repeatedly run in a loop. After a few, normally <10 seconds, fio hangs. With 64 queues (16 disks), failure occurs within a few seconds; with 8 queues (2 disks) it may take ~hour before hanging. Last message: fio-3.19 Starting 8 threads Jobs: 1 (f=1): [_(7),R(1)][68.3%][eta 03h:11m:06s] I think this means at the end of the run 1 queue was left incomplete. 'diskstats' (run while fio is hung) shows no outstanding transactions. e.g. $ cat /proc/diskstats ... 252 0 vda 1843140071 0 14745120568 712568645 0 0 0 0 0 3117947 712568645 0 0 0 0 0 0 252 16 vdb 1816291511 0 14530332088 704905623 0 0 0 0 0 3117711 704905623 0 0 0 0 0 0 ... Other stats (in the h/w, and added to the virtio-blk driver ([a]virtio_queue_rq(), [b]virtblk_handle_req(), [c]virtblk_request_done()) all agree, and show every request had a completion, and that virtblk_request_done() never gets called. e.g. PF= 0 vq=0 1 2 3 [a]request_count - 839416590 813148916 105586179 84988123 [b]completion1_count - 839416590 813148916 105586179 84988123 [c]completion2_count - 0 0 0 0 PF= 1 vq=0 1 2 3 [a]request_count - 823335887 812516140 104582672 75856549 [b]completion1_count - 823335887 812516140 104582672 75856549 [c]completion2_count - 0 0 0 0 i.e. the issue is after the virtio-blk driver. This change was introduced in kernel 6.3.0. I am seeing this using 6.3.3. If I run with an earlier kernel (5.15), it does not occur. If I make a simple patch to the 6.3.3 virtio-blk driver, to skip the blk_mq_add_to_batch()call, it does not fail. e.g. kernel 5.15 - this is OK virtio_blk.c,virtblk_done() [irq handler] if (likely(!blk_should_fake_timeout(req->q))) { blk_mq_complete_request(req); } kernel 6.3.3 - this fails virtio_blk.c,virtblk_handle_req() [irq handler] if (likely(!blk_should_fake_timeout(req->q))) { if (!blk_mq_complete_request_remote(req)) { if (!blk_mq_add_to_batch(req, iob, virtblk_vbr_status(vbr), virtblk_complete_batch)) { virtblk_request_done(req); //this never gets called... so blk_mq_add_to_batch() must always succeed } } } If I do, kernel 6.3.3 - this is OK virtio_blk.c,virtblk_handle_req() [irq handler] if (likely(!blk_should_fake_timeout(req->q))) { if (!blk_mq_complete_request_remote(req)) { virtblk_request_done(req); //force this here... if (!blk_mq_add_to_batch(req, iob, virtblk_vbr_status(vbr), virtblk_complete_batch)) { virtblk_request_done(req); //this never gets called... so blk_mq_add_to_batch() must always succeed } } } Perhaps you might like to fix/test/revert this change... Martin Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306090826.C1fZmdMe-lkp@intel.com/ Cc: Suwan Kim Tested-by: edliaw@google.com Reported-by: "Roberts, Martin" Message-Id: <336455b4f630f329380a8f53ee8cad3868764d5c.1686295549.git.mst@redhat.com> Signed-off-by: Michael S. Tsirkin commit a129b41fe0a8b4da828c46b10f5244ca07a3fec3 Author: Francesco Dolcini Date: Mon Jun 19 17:44:35 2023 +0200 Revert "net: phy: dp83867: perform soft reset and retain established link" This reverts commit da9ef50f545f86ffe6ff786174d26500c4db737a. This fixes a regression in which the link would come up, but no communication was possible. The reverted commit was also removing a comment about DP83867_PHYCR_FORCE_LINK_GOOD, this is not added back in this commits since it seems that this is unrelated to the original code change. Closes: https://lore.kernel.org/all/ZGuDJos8D7N0J6Z2@francesco-nb.int.toradex.com/ Fixes: da9ef50f545f ("net: phy: dp83867: perform soft reset and retain established link") Signed-off-by: Francesco Dolcini Reviewed-by: Andrew Lunn Reviewed-by: Praneeth Bajjuri Link: https://lore.kernel.org/r/20230619154435.355485-1-francesco@dolcini.it Signed-off-by: Jakub Kicinski commit 408c090002c8ca5da3da1417d1d675583379fae6 Author: Jiawen Wu Date: Mon Jun 19 17:49:48 2023 +0800 net: mdio: fix the wrong parameters PHY address and device address are passed in the wrong order. Cc: stable@vger.kernel.org Fixes: 4e4aafcddbbf ("net: mdio: Add dedicated C45 API to MDIO bus drivers") Signed-off-by: Jiawen Wu Reviewed-by: Andrew Lunn Reviewed-by: Russell King (Oracle) Link: https://lore.kernel.org/r/20230619094948.84452-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 8ba90f5cc71701aa262f222effead02206b04227 Merge: e660abd551f11 0518dbe97fe62 Author: Linus Torvalds Date: Tue Jun 20 17:20:22 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-06-20-12-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "19 hotfixes. 8 of these are cc:stable. This includes a wholesale reversion of the post-6.4 series 'make slab shrink lockless'. After input from Dave Chinner it has been decided that we should go a different way [1]" Link: https://lkml.kernel.org/r/ZH6K0McWBeCjaf16@dread.disaster.area [1] * tag 'mm-hotfixes-stable-2023-06-20-12-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: selftests/mm: fix cross compilation with LLVM mailmap: add entries for Ben Dooks nilfs2: prevent general protection fault in nilfs_clear_dirty_page() Revert "mm: vmscan: make global slab shrink lockless" Revert "mm: vmscan: make memcg slab shrink lockless" Revert "mm: vmscan: add shrinker_srcu_generation" Revert "mm: shrinkers: make count and scan in shrinker debugfs lockless" Revert "mm: vmscan: hold write lock to reparent shrinker nr_deferred" Revert "mm: vmscan: remove shrinker_rwsem from synchronize_shrinkers()" Revert "mm: shrinkers: convert shrinker_rwsem to mutex" nilfs2: fix buffer corruption due to concurrent device reads scripts/gdb: fix SB_* constants parsing scripts: fix the gfp flags header path in gfp-translate udmabuf: revert 'Add support for mapping hugepages (v4)' mm/khugepaged: fix iteration in collapse_file memfd: check for non-NULL file_seals in memfd_create() syscall mm/vmalloc: do not output a spurious warning when huge vmalloc() fails mm/mprotect: fix do_mprotect_pkey() limit check writeback: fix dereferencing NULL mapping->host on writeback_page_template commit e660abd551f1172e428b4e4003de887176a8a1fd Merge: c74e2ac2383fd 22db06337f590 Author: Linus Torvalds Date: Tue Jun 20 15:45:34 2023 -0700 Merge tag 'acpi-6.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix a kernel crash during early resume from ACPI S3 that has been present since the 5.15 cycle when might_sleep() was added to down_timeout(), which in some configurations of the kernel caused an implicit preemption point to trigger at a wrong time" * tag 'acpi-6.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() commit c74e2ac2383fd687bf2f8dd3f29f674cbd0cdaea Merge: 2e30b9734398a 0bb619f9227aa Author: Linus Torvalds Date: Tue Jun 20 15:39:41 2023 -0700 Merge tag 'thermal-6.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Fix a regression introduced during the 6.3 cycle causing intel_soc_dts_iosf to report incorrect temperature values due to a coding mistake (Hans de Goede)" * tag 'thermal-6.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal/intel/intel_soc_dts_iosf: Fix reporting wrong temperatures commit 2e30b9734398ad8f29432da63a97728326050536 Merge: 4b0c7a1ba0938 0113d4615dbf0 Author: Linus Torvalds Date: Tue Jun 20 15:01:08 2023 -0700 Merge tag 'trace-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix MAINTAINERS file to point to proper mailing list for rtla and rv The mailing list pointed to linux-trace-devel instead of linux-trace-kernel. The former is for the tracing libraries and the latter is for anything in the Linux kernel tree. The wrong mailing list was used because linux-trace-kernel did not exist when rtla and rv were created. - User events: - Fix matching of dynamic events to their user events When user writes to dynamic_events file, a lookup of the registered dynamic events is made, but there were some cases that a match could be incorrectly made. - Add auto cleanup of user events Have the user events automatically get removed when the last reference (file descriptor) is closed. This was asked for to prevent leaks of user events hanging around needing admins to clean them up. - Add persistent logic (but not let user space use it yet) In some cases, having a persistent user event (one that does not get cleaned up automatically) is useful. But there's still debates about how to expose this to user space. The infrastructure is added, but the API is not. - Update the selftests Update the user event selftests to reflect the above changes" * tag 'trace-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/user_events: Document auto-cleanup and remove dyn_event refs selftests/user_events: Adapt dyn_test to non-persist events selftests/user_events: Ensure auto cleanup works as expected tracing/user_events: Add auto cleanup and future persist flag tracing/user_events: Track refcount consistently via put/get tracing/user_events: Store register flags on events tracing/user_events: Remove user_ns walk for groups selftests/user_events: Add perf self-test for empty arguments events selftests/user_events: Clear the events after perf self-test selftests/user_events: Add ftrace self-test for empty arguments events tracing/user_events: Fix the incorrect trace record for empty arguments events tracing: Modify print_fields() for fields output order tracing/user_events: Handle matching arguments that is null from dyn_events tracing/user_events: Prevent same name but different args event tracing/rv/rtla: Update MAINTAINERS file to point to proper mailing list commit 4b0c7a1ba09386e26cf9e55cd375af8e0f48662e Merge: 99ec1ed7c2ed3 a7299a18a179a Author: Linus Torvalds Date: Tue Jun 20 14:38:21 2023 -0700 Merge tag 'for-6.4-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "One more regression fix for an assertion failure that uncovered a nasty problem with stripe calculations. This is caused by a u32 overflow when there are enough devices. The fstests require 6 so this hasn't been caught, I was able to hit it with 8. The fix is minimal and only adds u64 casts, we'll clean that up later. I did various additional tests to be sure" * tag 'for-6.4-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix u32 overflows when left shifting stripe_nr commit 42e344f01688490cdac4bed8f5ba21817cad26ee Author: Phil Sutter Date: Fri Jun 16 17:56:11 2023 +0200 netfilter: nf_tables: Fix for deleting base chains with payload When deleting a base chain, iptables-nft simply submits the whole chain to the kernel, including the NFTA_CHAIN_HOOK attribute. The new code added by fixed commit then turned this into a chain update, destroying the hook but not the chain itself. Detect the situation by checking if the chain type is either netdev or inet/ingress. Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 62f9a68a36d4441a6c412b81faed102594bc6670 Author: Pablo Neira Ayuso Date: Thu Jun 15 10:14:25 2023 +0200 netfilter: nfnetlink_osf: fix module autoload Move the alias from xt_osf to nfnetlink_osf. Fixes: f9324952088f ("netfilter: nfnetlink_osf: extract nfnetlink_subsystem code from xt_osf.c") Signed-off-by: Pablo Neira Ayuso commit 043d2acf57227db1fdaaa620b2a420acfaa56d6e Author: Pablo Neira Ayuso Date: Wed Jun 14 23:20:18 2023 +0200 netfilter: nf_tables: drop module reference after updating chain Otherwise the module reference counter is leaked. Fixes b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") Signed-off-by: Pablo Neira Ayuso commit e26d3009efda338f19016df4175f354a9bd0a4ab Author: Pablo Neira Ayuso Date: Fri Jun 16 15:22:18 2023 +0200 netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters. Signed-off-by: Pablo Neira Ayuso commit b770283c98e0eee9133c47bc03b6cc625dc94723 Author: Pablo Neira Ayuso Date: Fri Jun 16 15:22:01 2023 +0200 netfilter: nf_tables: disallow updates of anonymous sets Disallow updates of set timeout and garbage collection parameters for anonymous sets. Fixes: 123b99619cca ("netfilter: nf_tables: honor set timeout and garbage collection updates") Signed-off-by: Pablo Neira Ayuso commit 62e1e94b246e685d89c3163aaef4b160e42ceb02 Author: Pablo Neira Ayuso Date: Fri Jun 16 15:21:39 2023 +0200 netfilter: nf_tables: reject unbound chain set before commit phase Use binding list to track set transaction and to check for unbound chains before entering the commit phase. Bail out if chain binding remain unused before entering the commit step. Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Signed-off-by: Pablo Neira Ayuso commit 938154b93be8cd611ddfd7bafc1849f3c4355201 Author: Pablo Neira Ayuso Date: Fri Jun 16 15:21:33 2023 +0200 netfilter: nf_tables: reject unbound anonymous set before commit phase Add a new list to track set transaction and to check for unbound anonymous sets before entering the commit phase. Bail out at the end of the transaction handling if an anonymous set remains unbound. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso commit c88c535b592d3baeee74009f3eceeeaf0fdd5e1b Author: Pablo Neira Ayuso Date: Fri Jun 16 15:20:16 2023 +0200 netfilter: nf_tables: disallow element updates of bound anonymous sets Anonymous sets come with NFT_SET_CONSTANT from userspace. Although API allows to create anonymous sets without NFT_SET_CONSTANT, it makes no sense to allow to add and to delete elements for bound anonymous sets. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso commit d6b478666ffa6d2c25386d78bf1c4640d4da305e Author: Pablo Neira Ayuso Date: Fri Jun 16 15:20:08 2023 +0200 netfilter: nf_tables: fix underflow in object reference counter Since ("netfilter: nf_tables: drop map element references from preparation phase"), integration with commit protocol is better, therefore drop the workaround that b91d90368837 ("netfilter: nf_tables: fix leaking object reference count") provides. Signed-off-by: Pablo Neira Ayuso commit 2b84e215f87443c74ac0aa7f76bb172d43a87033 Author: Pablo Neira Ayuso Date: Fri Jun 16 15:20:04 2023 +0200 netfilter: nft_set_pipapo: .walk does not deal with generations The .walk callback iterates over the current active set, but it might be useful to iterate over the next generation set. Use the generation mask to determine what set view (either current or next generation) is use for the walk iteration. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Pablo Neira Ayuso commit 628bd3e49cba1c066228e23d71a852c23e26da73 Author: Pablo Neira Ayuso Date: Fri Jun 16 14:51:49 2023 +0200 netfilter: nf_tables: drop map element references from preparation phase set .destroy callback releases the references to other objects in maps. This is very late and it results in spurious EBUSY errors. Drop refcount from the preparation phase instead, update set backend not to drop reference counter from set .destroy path. Exceptions: NFT_TRANS_PREPARE_ERROR does not require to drop the reference counter because the transaction abort path releases the map references for each element since the set is unbound. The abort path also deals with releasing reference counter for new elements added to unbound sets. Fixes: 591054469b3e ("netfilter: nf_tables: revisit chain/object refcounting from elements") Signed-off-by: Pablo Neira Ayuso commit 26b5a5712eb85e253724e56a54c17f8519bd8e4e Author: Pablo Neira Ayuso Date: Fri Jun 16 14:45:26 2023 +0200 netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain Add a new state to deal with rule expressions deactivation from the newrule error path, otherwise the anonymous set remains in the list in inactive state for the next generation. Mark the set/chain transaction as unbound so the abort path releases this object, set it as inactive in the next generation so it is not reachable anymore from this transaction and reference counter is dropped. Fixes: 1240eb93f061 ("netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE") Signed-off-by: Pablo Neira Ayuso commit 4bedf9eee016286c835e3d8fa981ddece5338795 Author: Pablo Neira Ayuso Date: Fri Jun 16 14:45:22 2023 +0200 netfilter: nf_tables: fix chain binding transaction logic Add bound flag to rule and chain transactions as in 6a0a8d10a366 ("netfilter: nf_tables: use-after-free in failing rule with bound set") to skip them in case that the chain is already bound from the abort path. This patch fixes an imbalance in the chain use refcnt that triggers a WARN_ON on the table and chain destroy path. This patch also disallows nested chain bindings, which is not supported from userspace. The logic to deal with chain binding in nft_data_hold() and nft_data_release() is not correct. The NFT_TRANS_PREPARE state needs a special handling in case a chain is bound but next expressions in the same rule fail to initialize as described by 1240eb93f061 ("netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE"). The chain is left bound if rule construction fails, so the objects stored in this chain (and the chain itself) are released by the transaction records from the abort path, follow up patch ("netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain") completes this error handling. When deleting an existing rule, chain bound flag is set off so the rule expression .destroy path releases the objects. Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Signed-off-by: Pablo Neira Ayuso commit c8e796895e2310b6130e7577248da1d771431a77 Author: Russ Weight Date: Tue Jun 20 13:28:24 2023 -0700 regmap: spi-avmm: Fix regmap_bus max_raw_write The max_raw_write member of the regmap_spi_avmm_bus structure is defined as: .max_raw_write = SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT SPI_AVMM_VAL_SIZE == 4 and MAX_WRITE_CNT == 1 so this results in a maximum write transfer size of 4 bytes which provides only enough space to transfer the address of the target register. It provides no space for the value to be transferred. This bug became an issue (divide-by-zero in _regmap_raw_write()) after the following was accepted into mainline: commit 3981514180c9 ("regmap: Account for register length when chunking") Change max_raw_write to include space (4 additional bytes) for both the register address and value: .max_raw_write = SPI_AVMM_REG_SIZE + SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT Fixes: 7f9fb67358a2 ("regmap: add Intel SPI Slave to AVMM Bus Bridge support") Reviewed-by: Matthew Gerlach Signed-off-by: Russ Weight Link: https://lore.kernel.org/r/20230620202824.380313-1-russell.h.weight@intel.com Signed-off-by: Mark Brown commit 54d217406afe250d7a768783baaa79a035f21d38 Author: Jeff Layton Date: Wed Apr 19 07:24:46 2023 -0400 drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2 I've been experiencing some intermittent crashes down in the display driver code. The symptoms are ususally a line like this in dmesg: amdgpu 0000:30:00.0: [drm] Failed to create MST payload for port 000000006d3a3885: -5 ...followed by an Oops due to a NULL pointer dereference. Switch to using mgr->dev instead of state->dev since "state" can be NULL in some cases. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2184855 Suggested-by: Jani Nikula Signed-off-by: Jeff Layton Reviewed-by: Jani Nikula Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230419112447.18471-1-jlayton@kernel.org commit 4e9f0ec38852c18faa9689322e758575af33e5d4 Author: Mukesh Sisodiya Date: Mon Jun 19 17:02:34 2023 +0200 wifi: iwlwifi: pcie: Handle SO-F device for PCI id 0x7AF0 Add support for AX1690i and AX1690s devices with PCIE id 0x7AF0. Cc: stable@vger.kernel.org # 6.1+ Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20230619150233.461290-2-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 7580e0a78eb29e7bb1a772eba4088250bbb70d41 Author: Ross Lagerwall Date: Fri Jun 16 17:45:49 2023 +0100 be2net: Extend xmit workaround to BE3 chip We have seen a bug where the NIC incorrectly changes the length in the IP header of a padded packet to include the padding bytes. The driver already has a workaround for this so do the workaround for this NIC too. This resolves the issue. The NIC in question identifies itself as follows: [ 8.828494] be2net 0000:02:00.0: FW version is 10.7.110.31 [ 8.834759] be2net 0000:02:00.0: Emulex OneConnect(be3): PF FLEX10 port 1 02:00.0 Ethernet controller: Emulex Corporation OneConnect 10Gb NIC (be3) (rev 01) Fixes: ca34fe38f06d ("be2net: fix wrong usage of adapter->generation") Signed-off-by: Ross Lagerwall Link: https://lore.kernel.org/r/20230616164549.2863037-1-ross.lagerwall@citrix.com Signed-off-by: Jakub Kicinski commit 99ec1ed7c2ed358280588ab1d013387e8c7a9333 Merge: 692b7dc87ca6d 5005bcb421915 Author: Linus Torvalds Date: Tue Jun 20 11:50:40 2023 -0700 Merge tag '6.4-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: "Four smb3 server fixes, all also for stable: - fix potential oops in parsing compounded requests - fix various paths (mkdir, create etc) where mnt_want_write was not checked first - fix slab out of bounds in check_message and write" * tag '6.4-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: validate session id and tree id in the compound request ksmbd: fix out-of-bound read in smb2_write ksmbd: add mnt_want_write to ksmbd vfs functions ksmbd: validate command payload size commit a7299a18a179a9713651fce9ad00972a633c14a9 Author: Qu Wenruo Date: Tue Jun 20 17:57:31 2023 +0800 btrfs: fix u32 overflows when left shifting stripe_nr [BUG] David reported an ASSERT() get triggered during fio load on 8 devices with data/raid6 and metadata/raid1c3: fio --rw=randrw --randrepeat=1 --size=3000m \ --bsrange=512b-64k --bs_unaligned \ --ioengine=libaio --fsync=1024 \ --name=job0 --name=job1 \ The ASSERT() is from rbio_add_bio() of raid56.c: ASSERT(orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN); Which is checking if the target rbio is crossing the full stripe boundary. [100.789] assertion failed: orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN, in fs/btrfs/raid56.c:1622 [100.795] ------------[ cut here ]------------ [100.796] kernel BUG at fs/btrfs/raid56.c:1622! [100.797] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [100.798] CPU: 1 PID: 100 Comm: kworker/u8:4 Not tainted 6.4.0-rc6-default+ #124 [100.799] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [100.802] Workqueue: writeback wb_workfn (flush-btrfs-1) [100.803] RIP: 0010:rbio_add_bio+0x204/0x210 [btrfs] [100.806] RSP: 0018:ffff888104a8f300 EFLAGS: 00010246 [100.808] RAX: 00000000000000a1 RBX: ffff8881075907e0 RCX: ffffed1020951e01 [100.809] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000001 [100.811] RBP: 0000000141d20000 R08: 0000000000000001 R09: ffff888104a8f04f [100.813] R10: ffffed1020951e09 R11: 0000000000000003 R12: ffff88810e87f400 [100.815] R13: 0000000041d20000 R14: 0000000144529000 R15: ffff888101524000 [100.817] FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 [100.821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [100.822] CR2: 000055d54e44c270 CR3: 000000010a9a1006 CR4: 00000000003706a0 [100.824] Call Trace: [100.825] [100.825] ? die+0x32/0x80 [100.826] ? do_trap+0x12d/0x160 [100.827] ? rbio_add_bio+0x204/0x210 [btrfs] [100.827] ? rbio_add_bio+0x204/0x210 [btrfs] [100.829] ? do_error_trap+0x90/0x130 [100.830] ? rbio_add_bio+0x204/0x210 [btrfs] [100.831] ? handle_invalid_op+0x2c/0x30 [100.833] ? rbio_add_bio+0x204/0x210 [btrfs] [100.835] ? exc_invalid_op+0x29/0x40 [100.836] ? asm_exc_invalid_op+0x16/0x20 [100.837] ? rbio_add_bio+0x204/0x210 [btrfs] [100.837] raid56_parity_write+0x64/0x270 [btrfs] [100.838] btrfs_submit_chunk+0x26e/0x800 [btrfs] [100.840] ? btrfs_bio_init+0x80/0x80 [btrfs] [100.841] ? release_pages+0x503/0x6d0 [100.842] ? folio_unlock+0x2f/0x60 [100.844] ? __folio_put+0x60/0x60 [100.845] ? btrfs_do_readpage+0xae0/0xae0 [btrfs] [100.847] btrfs_submit_bio+0x21/0x60 [btrfs] [100.847] submit_one_bio+0x6a/0xb0 [btrfs] [100.849] extent_write_cache_pages+0x395/0x680 [btrfs] [100.850] ? __extent_writepage+0x520/0x520 [btrfs] [100.851] ? mark_usage+0x190/0x190 [100.852] extent_writepages+0xdb/0x130 [btrfs] [100.853] ? extent_write_locked_range+0x480/0x480 [btrfs] [100.854] ? mark_usage+0x190/0x190 [100.854] ? attach_extent_buffer_page+0x220/0x220 [btrfs] [100.855] ? reacquire_held_locks+0x178/0x280 [100.856] ? writeback_sb_inodes+0x245/0x7f0 [100.857] do_writepages+0x102/0x2e0 [100.858] ? page_writeback_cpu_online+0x10/0x10 [100.859] ? __lock_release.isra.0+0x14a/0x4d0 [100.860] ? reacquire_held_locks+0x280/0x280 [100.861] ? __lock_acquired+0x1e9/0x3d0 [100.862] ? do_raw_spin_lock+0x1b0/0x1b0 [100.863] __writeback_single_inode+0x94/0x450 [100.864] writeback_sb_inodes+0x372/0x7f0 [100.864] ? lock_sync+0xd0/0xd0 [100.865] ? do_raw_spin_unlock+0x93/0xf0 [100.866] ? sync_inode_metadata+0xc0/0xc0 [100.867] ? rwsem_optimistic_spin+0x340/0x340 [100.868] __writeback_inodes_wb+0x70/0x130 [100.869] wb_writeback+0x2d1/0x530 [100.869] ? __writeback_inodes_wb+0x130/0x130 [100.870] ? lockdep_hardirqs_on_prepare.part.0+0xf1/0x1c0 [100.870] wb_do_writeback+0x3eb/0x480 [100.871] ? wb_writeback+0x530/0x530 [100.871] ? mark_lock_irq+0xcd0/0xcd0 [100.872] wb_workfn+0xe0/0x3f0< [CAUSE] Commit a97699d1d610 ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") changes how we calculate the map length, to reduce u64 division. Function btrfs_max_io_len() is to get the length to the stripe boundary. It calculates the full stripe start offset (inside the chunk) by the following code: *full_stripe_start = rounddown(*stripe_nr, nr_data_stripes(map)) << BTRFS_STRIPE_LEN_SHIFT; The calculation itself is fine, but the value returned by rounddown() is dependent on both @stripe_nr (which is u32) and nr_data_stripes() (which returned int). Thus the result is also u32, then we do the left shift, which can overflow u32. If such overflow happens, @full_stripe_start will be a value way smaller than @offset, causing later "full_stripe_len - (offset - *full_stripe_start)" to underflow, thus make later length calculation to have no stripe boundary limit, resulting a write bio to exceed stripe boundary. There are some other locations like this, with a u32 @stripe_nr got left shift, which can lead to a similar overflow. [FIX] Fix all @stripe_nr with left shift with a type cast to u64 before the left shift. Those involved @stripe_nr or similar variables are recording the stripe number inside the chunk, which is small enough to be contained by u32, but their offset inside the chunk can not fit into u32. Thus for those specific left shifts, a type cast to u64 is necessary so this patch does not touch them and the code will be cleaned up in the future to keep the fix minimal. Reported-by: David Sterba Fixes: a97699d1d610 ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") Tested-by: David Sterba Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 8d0d16a3ef44c60d66f937c21f32fa2cf8f2c9ed Author: Pranjal Ramajor Asha Kanojiya Date: Wed Jun 14 10:15:28 2023 -0600 accel/qaic: Call DRM helper function to destroy prime GEM smatch warning: drivers/accel/qaic/qaic_data.c:620 qaic_free_object() error: dereferencing freed memory 'obj->import_attach' obj->import_attach is detached and freed using dma_buf_detach(). But used after free to decrease the dmabuf ref count using dma_buf_put(). drm_prime_gem_destroy() handles this issue and performs the proper clean up instead of open coding it in the driver. Fixes: ff13be830333 ("accel/qaic: Add datapath") Reported-by: Sukrut Bellary Closes: https://lore.kernel.org/all/20230610021200.377452-1-sukrut.bellary@linux.com/ Suggested-by: Christian König Signed-off-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Carl Vanderlip Reviewed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20230614161528.11710-1-quic_jhugo@quicinc.com commit e438edaae26ce80c3fcc498fbba0c8f7e78497e5 Merge: 440d71e2edf28 f015b900bc328 Author: David S. Miller Date: Tue Jun 20 13:33:50 2023 +0100 Merge tag 'ipsec-2023-06-20' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec ipsec-2023-06-20 commit 440d71e2edf283465c7a9ed151efd589d71b6307 Merge: 9a43827e876c9 94d12d88b4a84 Author: David S. Miller Date: Tue Jun 20 09:40:26 2023 +0100 Merge branch 'dsa-mt7530-fixes' Arınç ÜNAL says: ==================== net: dsa: mt7530: fix multiple CPU ports, BPDU and LLDP handling This patch series fixes all non-theoretical issues regarding multiple CPU ports and the handling of LLDP frames and BPDUs. I am adding me as a maintainer, I've got some code improvements on the way. I will keep an eye on this driver and the patches submitted for it in the future. Arınç v6: - Change a small portion of the comment in the diff on "net: dsa: mt7530: set all CPU ports in MT7531_CPU_PMAP" with Russell's suggestion. - Change the patch log of "net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch" with Vladimir's suggestion. - Group the code for trapping frames into a common function and call that. - Add Vladimir and Russell's reviewed-by tags to where they're given. v5: - Change the comment in the diff on the first patch with Russell's words. - Change the patch log of the first patch to state that the patch is just preparatory work for change "net: dsa: introduce preferred_default_local_cpu_port and use on MT7530" and not a fix to an existing problem on the code base. - Remove the "net: dsa: mt7530: fix trapping frames with multiple CPU ports on MT7530" patch. It fixes a theoretical issue, therefore it is net-next material. - Remove unnecessary information from the patch logs. Remove the enum renaming change. - Strengthen the point of the "net: dsa: introduce preferred_default_local_cpu_port and use on MT7530" patch. v4: Make the patch logs and my comments in the code easier to understand. v3: Fix the from header on the patches. Write a cover letter. v2: Add patches to fix the handling of LLDP frames and BPDUs. ==================== Signed-off-by: David S. Miller commit 94d12d88b4a849765bf7185c876c6c672ad4714e Author: Arınç ÜNAL Date: Sat Jun 17 09:26:49 2023 +0300 MAINTAINERS: add me as maintainer of MEDIATEK SWITCH DRIVER Add me as a maintainer of the MediaTek MT7530 DSA subdriver. List maintainers in alphabetical order by first name. Signed-off-by: Arınç ÜNAL Reviewed-by: Vladimir Oltean Reviewed-by: Matthias Brugger Reviewed-by: Matthias Brugger Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit b79d7c14f48083abb3fb061370c0c64a569edf4c Author: Vladimir Oltean Date: Sat Jun 17 09:26:48 2023 +0300 net: dsa: introduce preferred_default_local_cpu_port and use on MT7530 Since the introduction of the OF bindings, DSA has always had a policy that in case multiple CPU ports are present in the device tree, the numerically smallest one is always chosen. The MT7530 switch family, except the switch on the MT7988 SoC, has 2 CPU ports, 5 and 6, where port 6 is preferable on the MT7531BE switch because it has higher bandwidth. The MT7530 driver developers had 3 options: - to modify DSA when the MT7531 switch support was introduced, such as to prefer the better port - to declare both CPU ports in device trees as CPU ports, and live with the sub-optimal performance resulting from not preferring the better port - to declare just port 6 in the device tree as a CPU port Of course they chose the path of least resistance (3rd option), kicking the can down the road. The hardware description in the device tree is supposed to be stable - developers are not supposed to adopt the strategy of piecemeal hardware description, where the device tree is updated in lockstep with the features that the kernel currently supports. Now, as a result of the fact that they did that, any attempts to modify the device tree and describe both CPU ports as CPU ports would make DSA change its default selection from port 6 to 5, effectively resulting in a performance degradation visible to users with the MT7531BE switch as can be seen below. Without preferring port 6: [ ID][Role] Interval Transfer Bitrate Retr [ 5][TX-C] 0.00-20.00 sec 374 MBytes 157 Mbits/sec 734 sender [ 5][TX-C] 0.00-20.00 sec 373 MBytes 156 Mbits/sec receiver [ 7][RX-C] 0.00-20.00 sec 1.81 GBytes 778 Mbits/sec 0 sender [ 7][RX-C] 0.00-20.00 sec 1.81 GBytes 777 Mbits/sec receiver With preferring port 6: [ ID][Role] Interval Transfer Bitrate Retr [ 5][TX-C] 0.00-20.00 sec 1.99 GBytes 856 Mbits/sec 273 sender [ 5][TX-C] 0.00-20.00 sec 1.99 GBytes 855 Mbits/sec receiver [ 7][RX-C] 0.00-20.00 sec 1.72 GBytes 737 Mbits/sec 15 sender [ 7][RX-C] 0.00-20.00 sec 1.71 GBytes 736 Mbits/sec receiver Using one port for WAN and the other ports for LAN is a very popular use case which is what this test emulates. As such, this change proposes that we retroactively modify stable kernels (which don't support the modification of the CPU port assignments, so as to let user space fix the problem and restore the throughput) to keep the mt7530 driver preferring port 6 even with device trees where the hardware is more fully described. Fixes: c288575f7810 ("net: dsa: mt7530: Add the support of MT7531 switch") Signed-off-by: Vladimir Oltean Signed-off-by: Arınç ÜNAL Reviewed-by: Russell King (Oracle) Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 8332cf6fd7c7087dbc2067115b33979c9851bbc4 Author: Arınç ÜNAL Date: Sat Jun 17 09:26:47 2023 +0300 net: dsa: mt7530: fix handling of LLDP frames LLDP frames are link-local frames, therefore they must be trapped to the CPU port. Currently, the MT753X switches treat LLDP frames as regular multicast frames, therefore flooding them to user ports. To fix this, set LLDP frames to be trapped to the CPU port(s). Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Signed-off-by: Arınç ÜNAL Reviewed-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit d7c66073559386b836bded7cdc8b66ee5c049129 Author: Arınç ÜNAL Date: Sat Jun 17 09:26:46 2023 +0300 net: dsa: mt7530: fix handling of BPDUs on MT7530 switch BPDUs are link-local frames, therefore they must be trapped to the CPU port. Currently, the MT7530 switch treats BPDUs as regular multicast frames, therefore flooding them to user ports. To fix this, set BPDUs to be trapped to the CPU port. Group this on mt7530_setup() and mt7531_setup_common() into mt753x_trap_frames() and call that. Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Signed-off-by: Arınç ÜNAL Reviewed-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 4ae90f90e4909e3014e2dc6a0627964617a7b824 Author: Arınç ÜNAL Date: Sat Jun 17 09:26:45 2023 +0300 net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch All MT7530 switch IP variants share the MT7530_MFC register, but the current driver only writes it for the switch variant that is integrated in the MT7621 SoC. Modify the code to include all MT7530 derivatives. Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Suggested-by: Vladimir Oltean Signed-off-by: Arınç ÜNAL Reviewed-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit ff221029a51fd54cacac66e193e0c75e4de940e7 Author: Arınç ÜNAL Date: Sat Jun 17 09:26:44 2023 +0300 net: dsa: mt7530: set all CPU ports in MT7531_CPU_PMAP MT7531_CPU_PMAP represents the destination port mask for trapped-to-CPU frames (further restricted by PCR_MATRIX). Currently the driver sets the first CPU port as the single port in this bit mask, which works fine regardless of whether the device tree defines port 5, 6 or 5+6 as CPU ports. This is because the logic coincides with DSA's logic of picking the first CPU port as the CPU port that all user ports are affine to, by default. An upcoming change would like to influence DSA's selection of the default CPU port to no longer be the first one, and in that case, this logic needs adaptation. Since there is no observed leakage or duplication of frames if all CPU ports are defined in this bit mask, simply include them all. Suggested-by: Russell King (Oracle) Suggested-by: Vladimir Oltean Signed-off-by: Arınç ÜNAL Reviewed-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 9a43827e876c9a071826cc81783aa2222b020f1d Author: Josua Mayer Date: Fri Jun 16 14:14:14 2023 +0300 net: dpaa2-mac: add 25gbase-r support Layerscape MACs support 25Gbps network speed with dpmac "CAUI" mode. Add the mappings between DPMAC_ETH_IF_* and HY_INTERFACE_MODE_*, as well as the 25000 mac capability. Tested on SolidRun LX2162a Clearfog, serdes 1 protocol 18. Signed-off-by: Josua Mayer Reviewed-by: Russell King (Oracle) Signed-off-by: David S. Miller commit 8340eef98d45c8822eb6e982b500460371171ee0 Merge: 0dbcac3a6dbb3 cd9125030689d Author: David S. Miller Date: Tue Jun 20 09:32:33 2023 +0100 Merge tag 'ieee802154-for-net-2023-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan Stefan Schmidt says: ==================== An update from ieee802154 for your *net* tree: Two small fixes and MAINTAINERS update this time. Azeem Shaikh ensured consistent use of strscpy through the tree and fixed the usage in our trace.h. Chen Aotian fixed a potential memory leak in the hwsim simulator for ieee802154. Miquel Raynal updated the MAINATINERS file with the new team git tree locations and patchwork URLs. ==================== Signed-off-by: David S. Miller commit 692b7dc87ca6d55ab254f8259e6f970171dc9d01 Merge: dbad9ce9397ef 067d6ec7ed5b4 Author: Linus Torvalds Date: Mon Jun 19 17:05:43 2023 -0700 Merge tag 'hyperv-fixes-signed-20230619' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Fix races in Hyper-V PCI controller (Dexuan Cui) - Fix handling of hyperv_pcpu_input_arg (Michael Kelley) - Fix vmbus_wait_for_unload to scan present CPUs (Michael Kelley) - Call hv_synic_free in the failure path of hv_synic_alloc (Dexuan Cui) - Add noop for real mode handlers for virtual trust level code (Saurabh Sengar) * tag 'hyperv-fixes-signed-20230619' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: PCI: hv: Add a per-bus mutex state_lock Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic PCI: hv: Fix a race condition bug in hv_pci_query_relations() arm64/hyperv: Use CPUHP_AP_HYPERV_ONLINE state to fix CPU online sequencing x86/hyperv: Fix hyperv_pcpu_input_arg handling when CPUs go online/offline Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails x86/hyperv/vtl: Add noop for realmode pointers commit 0518dbe97fe629fea255318841cf3ef1b4532d66 Author: Mark Brown Date: Wed Jun 14 22:18:58 2023 +0100 selftests/mm: fix cross compilation with LLVM Currently the MM selftests attempt to work out the target architecture by using CROSS_COMPILE or otherwise querying the host machine, storing the target architecture in a variable called MACHINE rather than the usual ARCH though as far as I can tell (including for x86_64) the value is the same as we would use for architecture. When cross compiling with LLVM we don't need a CROSS_COMPILE as LLVM can support many target architectures in a single build so this logic does not work, CROSS_COMPILE is not set and we end up selecting tests for the host rather than target architecture. Fix this by using the more standard ARCH to describe the architecture, taking it from the environment if specified. Link: https://lkml.kernel.org/r/20230614-kselftest-mm-llvm-v1-1-180523f277d3@kernel.org Signed-off-by: Mark Brown Cc: Nick Desaulniers Cc: Albert Ou Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Shuah Khan Cc: Tom Rix Signed-off-by: Andrew Morton commit 823b37e8a7104ca2bcf1945be77f33d4d5740f55 Author: Ben Dooks Date: Thu Jun 15 09:18:20 2023 +0100 mailmap: add entries for Ben Dooks I am going to be losing my sifive.com address soon and I also realised my old Simtec address (from >10 years ago) is also not been updates so update .mailmap for both. Link: https://lkml.kernel.org/r/20230615081820.79485-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks Signed-off-by: Ben Dooks Signed-off-by: Andrew Morton commit 782e53d0c14420858dbf0f8f797973c150d3b6d7 Author: Ryusuke Konishi Date: Mon Jun 12 11:14:56 2023 +0900 nilfs2: prevent general protection fault in nilfs_clear_dirty_page() In a syzbot stress test that deliberately causes file system errors on nilfs2 with a corrupted disk image, it has been reported that nilfs_clear_dirty_page() called from nilfs_clear_dirty_pages() can cause a general protection fault. In nilfs_clear_dirty_pages(), when looking up dirty pages from the page cache and calling nilfs_clear_dirty_page() for each dirty page/folio retrieved, the back reference from the argument page to "mapping" may have been changed to NULL (and possibly others). It is necessary to check this after locking the page/folio. So, fix this issue by not calling nilfs_clear_dirty_page() on a page/folio after locking it in nilfs_clear_dirty_pages() if the back reference "mapping" from the page/folio is different from the "mapping" that held the page/folio just before. Link: https://lkml.kernel.org/r/20230612021456.3682-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+53369d11851d8f26735c@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/000000000000da4f6b05eb9bf593@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 71c3ad65fabec9620d3f548b2da948c79c7ad9d5 Author: Qi Zheng Date: Fri Jun 9 08:15:18 2023 +0000 Revert "mm: vmscan: make global slab shrink lockless" This reverts commit f95bdb700bc6bb74e1199b1f5f90c613e152cfa7. Kernel test robot reports -88.8% regression in stress-ng.ramfs.ops_per_sec test case [1], which is caused by commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless"). The root cause is that SRCU has to be careful to not frequently check for SRCU read-side critical section exits. Therefore, even if no one is currently in the SRCU read-side critical section, synchronize_srcu() cannot return quickly. That's why unregister_shrinker() has become slower. After discussion, we will try to use the refcount+RCU method [2] proposed by Dave Chinner to continue to re-implement the lockless slab shrink. So revert the shrinker_srcu related changes first. [1]. https://lore.kernel.org/lkml/202305230837.db2c233f-yujie.liu@intel.com/ [2]. https://lore.kernel.org/lkml/ZIJhou1d55d4H1s0@dread.disaster.area/ Link: https://lkml.kernel.org/r/20230609081518.3039120-8-qi.zheng@linux.dev Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202305230837.db2c233f-yujie.liu@intel.com Signed-off-by: Qi Zheng Cc: Dave Chinner Cc: Kirill Tkhai Cc: Muchun Song Cc: Roman Gushchin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7cee3603192a198b23c034a7372b599081cbee88 Author: Qi Zheng Date: Fri Jun 9 08:15:17 2023 +0000 Revert "mm: vmscan: make memcg slab shrink lockless" This reverts commit caa05325c9126c77ebf114edce51536a0d0a9a08. Kernel test robot reports -88.8% regression in stress-ng.ramfs.ops_per_sec test case [1], which is caused by commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless"). The root cause is that SRCU has to be careful to not frequently check for SRCU read-side critical section exits. Therefore, even if no one is currently in the SRCU read-side critical section, synchronize_srcu() cannot return quickly. That's why unregister_shrinker() has become slower. After discussion, we will try to use the refcount+RCU method [2] proposed by Dave Chinner to continue to re-implement the lockless slab shrink. So revert the shrinker_srcu related changes first. [1]. https://lore.kernel.org/lkml/202305230837.db2c233f-yujie.liu@intel.com/ [2]. https://lore.kernel.org/lkml/ZIJhou1d55d4H1s0@dread.disaster.area/ Link: https://lkml.kernel.org/r/20230609081518.3039120-7-qi.zheng@linux.dev Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202305230837.db2c233f-yujie.liu@intel.com Signed-off-by: Qi Zheng Cc: Dave Chinner Cc: Kirill Tkhai Cc: Muchun Song Cc: Roman Gushchin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d6ecbcd70fffcffe79d45f3be7b8fcf5d8e04a3d Author: Qi Zheng Date: Fri Jun 9 08:15:16 2023 +0000 Revert "mm: vmscan: add shrinker_srcu_generation" This reverts commit 475733dda5aedba9e086379aafe6b5ffd53e8f5e. Kernel test robot reports -88.8% regression in stress-ng.ramfs.ops_per_sec test case [1], which is caused by commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless"). The root cause is that SRCU has to be careful to not frequently check for SRCU read-side critical section exits. Therefore, even if no one is currently in the SRCU read-side critical section, synchronize_srcu() cannot return quickly. That's why unregister_shrinker() has become slower. We will try to use the refcount+RCU method [2] proposed by Dave Chinner to continue to re-implement the lockless slab shrink. So revert the shrinker_srcu related changes first. [1]. https://lore.kernel.org/lkml/202305230837.db2c233f-yujie.liu@intel.com/ [2]. https://lore.kernel.org/lkml/ZIJhou1d55d4H1s0@dread.disaster.area/ Link: https://lkml.kernel.org/r/20230609081518.3039120-6-qi.zheng@linux.dev Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202305230837.db2c233f-yujie.liu@intel.com Signed-off-by: Qi Zheng Cc: Dave Chinner Cc: Kirill Tkhai Cc: Muchun Song Cc: Roman Gushchin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 1a554ecc971406e291cea867112f7f2e377e810e Author: Qi Zheng Date: Fri Jun 9 08:15:15 2023 +0000 Revert "mm: shrinkers: make count and scan in shrinker debugfs lockless" This reverts commit 20cd1892fcc3efc10a7ac327cc3790494bec46b5. Kernel test robot reports -88.8% regression in stress-ng.ramfs.ops_per_sec test case [1], which is caused by commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless"). The root cause is that SRCU has to be careful to not frequently check for SRCU read-side critical section exits. Therefore, even if no one is currently in the SRCU read-side critical section, synchronize_srcu() cannot return quickly. That's why unregister_shrinker() has become slower. We will try to use the refcount+RCU method [2] proposed by Dave Chinner to continue to re-implement the lockless slab shrink. So revert the shrinker_srcu related changes first. [1]. https://lore.kernel.org/lkml/202305230837.db2c233f-yujie.liu@intel.com/ [2]. https://lore.kernel.org/lkml/ZIJhou1d55d4H1s0@dread.disaster.area/ Link: https://lkml.kernel.org/r/20230609081518.3039120-5-qi.zheng@linux.dev Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202305230837.db2c233f-yujie.liu@intel.com Signed-off-by: Qi Zheng Cc: Dave Chinner Cc: Kirill Tkhai Cc: Muchun Song Cc: Roman Gushchin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit c534f7cca6b9b1c0dc97d6e9c5587858d4330cd9 Author: Qi Zheng Date: Fri Jun 9 08:15:14 2023 +0000 Revert "mm: vmscan: hold write lock to reparent shrinker nr_deferred" This reverts commit b3cabea3c9153fd42fe5cb851ac58b51ea2b32b8. Kernel test robot reports -88.8% regression in stress-ng.ramfs.ops_per_sec test case [1], which is caused by commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless"). The root cause is that SRCU has to be careful to not frequently check for SRCU read-side critical section exits. Therefore, even if no one is currently in the SRCU read-side critical section, synchronize_srcu() cannot return quickly. That's why unregister_shrinker() has become slower. We will try to use the refcount+RCU method [2] proposed by Dave Chinner to continue to re-implement the lockless slab shrink. Because there will be other readers after reverting the shrinker_srcu related changes, so it is better to restore to hold read lock to reparent shrinker nr_deferred. [1]. https://lore.kernel.org/lkml/202305230837.db2c233f-yujie.liu@intel.com/ [2]. https://lore.kernel.org/lkml/ZIJhou1d55d4H1s0@dread.disaster.area/ Link: https://lkml.kernel.org/r/20230609081518.3039120-4-qi.zheng@linux.dev Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202305230837.db2c233f-yujie.liu@intel.com Signed-off-by: Qi Zheng Cc: Dave Chinner Cc: Kirill Tkhai Cc: Muchun Song Cc: Roman Gushchin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 07252b0f97150b03050f74f42250f275566d70b9 Author: Qi Zheng Date: Fri Jun 9 08:15:13 2023 +0000 Revert "mm: vmscan: remove shrinker_rwsem from synchronize_shrinkers()" This reverts commit 1643db98d9b314e0a592d152603094fbf7ab906e. Kernel test robot reports -88.8% regression in stress-ng.ramfs.ops_per_sec test case [1], which is caused by commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless"). The root cause is that SRCU has to be careful to not frequently check for SRCU read-side critical section exits. Therefore, even if no one is currently in the SRCU read-side critical section, synchronize_srcu() cannot return quickly. That's why unregister_shrinker() has become slower. We will try to use the refcount+RCU method [2] proposed by Dave Chinner to continue to re-implement the lockless slab shrink. So we still need shrinker_rwsem in synchronize_shrinkers() after reverting the shrinker_srcu related changes. [1]. https://lore.kernel.org/lkml/202305230837.db2c233f-yujie.liu@intel.com/ [2]. https://lore.kernel.org/lkml/ZIJhou1d55d4H1s0@dread.disaster.area/ Link: https://lkml.kernel.org/r/20230609081518.3039120-3-qi.zheng@linux.dev Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202305230837.db2c233f-yujie.liu@intel.com Signed-off-by: Qi Zheng Cc: Dave Chinner Cc: Kirill Tkhai Cc: Muchun Song Cc: Roman Gushchin Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 47a7c01c3efc6581f5dcca40928baeb38e1e40c2 Author: Qi Zheng Date: Fri Jun 9 08:15:12 2023 +0000 Revert "mm: shrinkers: convert shrinker_rwsem to mutex" Patch series "revert shrinker_srcu related changes". This patch (of 7): This reverts commit cf2e309ebca7bb0916771839f9b580b06c778530. Kernel test robot reports -88.8% regression in stress-ng.ramfs.ops_per_sec test case [1], which is caused by commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless"). The root cause is that SRCU has to be careful to not frequently check for SRCU read-side critical section exits. Therefore, even if no one is currently in the SRCU read-side critical section, synchronize_srcu() cannot return quickly. That's why unregister_shrinker() has become slower. After discussion, we will try to use the refcount+RCU method [2] proposed by Dave Chinner to continue to re-implement the lockless slab shrink. So revert the shrinker_mutex back to shrinker_rwsem first. [1]. https://lore.kernel.org/lkml/202305230837.db2c233f-yujie.liu@intel.com/ [2]. https://lore.kernel.org/lkml/ZIJhou1d55d4H1s0@dread.disaster.area/ Link: https://lkml.kernel.org/r/20230609081518.3039120-1-qi.zheng@linux.dev Link: https://lkml.kernel.org/r/20230609081518.3039120-2-qi.zheng@linux.dev Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202305230837.db2c233f-yujie.liu@intel.com Signed-off-by: Qi Zheng Cc: Dave Chinner Cc: Kirill Tkhai Cc: Muchun Song Cc: Roman Gushchin Cc: Vlastimil Babka Cc: Yujie Liu Signed-off-by: Andrew Morton commit 679bd7ebdd315bf457a4740b306ae99f1d0a403d Author: Ryusuke Konishi Date: Fri Jun 9 12:57:32 2023 +0900 nilfs2: fix buffer corruption due to concurrent device reads As a result of analysis of a syzbot report, it turned out that in three cases where nilfs2 allocates block device buffers directly via sb_getblk, concurrent reads to the device can corrupt the allocated buffers. Nilfs2 uses sb_getblk for segment summary blocks, that make up a log header, and the super root block, that is the trailer, and when moving and writing the second super block after fs resize. In any of these, since the uptodate flag is not set when storing metadata to be written in the allocated buffers, the stored metadata will be overwritten if a device read of the same block occurs concurrently before the write. This causes metadata corruption and misbehavior in the log write itself, causing warnings in nilfs_btree_assign() as reported. Fix these issues by setting an uptodate flag on the buffer head on the first or before modifying each buffer obtained with sb_getblk, and clearing the flag on failure. When setting the uptodate flag, the lock_buffer/unlock_buffer pair is used to perform necessary exclusive control, and the buffer is filled to ensure that uninitialized bytes are not mixed into the data read from others. As for buffers for segment summary blocks, they are filled incrementally, so if the uptodate flag was unset on their allocation, set the flag and zero fill the buffer once at that point. Also, regarding the superblock move routine, the starting point of the memset call to zerofill the block is incorrectly specified, which can cause a buffer overflow on file systems with block sizes greater than 4KiB. In addition, if the superblock is moved within a large block, it is necessary to assume the possibility that the data in the superblock will be destroyed by zero-filling before copying. So fix these potential issues as well. Link: https://lkml.kernel.org/r/20230609035732.20426-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+31837fe952932efc8fb9@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/00000000000030000a05e981f475@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 6a59cb5158bff13b80f116305155fbe4967a5010 Author: Florian Fainelli Date: Wed Jun 7 15:13:35 2023 -0700 scripts/gdb: fix SB_* constants parsing --0000000000009a0c9905fd9173ad Content-Transfer-Encoding: 8bit After f15afbd34d8f ("fs: fix undefined behavior in bit shift for SB_NOUSER") the constants were changed from plain integers which LX_VALUE() can parse to constants using the BIT() macro which causes the following: Reading symbols from build/linux-custom/vmlinux...done. Traceback (most recent call last): File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/vmlinux-gdb.py", line 25, in import linux.constants File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/scripts/gdb/linux/constants.py", line 5 LX_SB_RDONLY = ((((1UL))) << (0)) Use LX_GDBPARSED() which does not suffer from that issue. f15afbd34d8f ("fs: fix undefined behavior in bit shift for SB_NOUSER") Link: https://lkml.kernel.org/r/20230607221337.2781730-1-florian.fainelli@broadcom.com Signed-off-by: Florian Fainelli Acked-by: Christian Brauner Cc: Hao Ge Cc: Jan Kiszka Cc: Kieran Bingham Cc: Luis Chamberlain Cc: Pankaj Raghav Signed-off-by: Andrew Morton commit 2049a7d0cbc6ac8e370e836ed68597be04a7dc49 Author: Prathu Baronia Date: Thu Jun 8 21:14:49 2023 +0530 scripts: fix the gfp flags header path in gfp-translate Since gfp flags have been shifted to gfp_types.h so update the path in the gfp-translate script. Link: https://lkml.kernel.org/r/20230608154450.21758-1-prathubaronia2011@gmail.com Fixes: cb5a065b4ea9c ("headers/deps: mm: Split out of ") Signed-off-by: Prathu Baronia Reviewed-by: David Hildenbrand Cc: Masahiro Yamada Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Ingo Molnar Cc: Yury Norov Cc: Signed-off-by: Andrew Morton commit b7cb3821905b79b6ed474fd5ba34d1e187649139 Author: Mike Kravetz Date: Thu Jun 8 13:49:27 2023 -0700 udmabuf: revert 'Add support for mapping hugepages (v4)' This effectively reverts commit 16c243e99d33 ("udmabuf: Add support for mapping hugepages (v4)"). Recently, Junxiao Chang found a BUG with page map counting as described here [1]. This issue pointed out that the udmabuf driver was making direct use of subpages of hugetlb pages. This is not a good idea, and no other mm code attempts such use. In addition to the mapcount issue, this also causes issues with hugetlb vmemmap optimization and page poisoning. For now, remove hugetlb support. If udmabuf wants to be used on hugetlb mappings, it should be changed to only use complete hugetlb pages. This will require different alignment and size requirements on the UDMABUF_CREATE API. [1] https://lore.kernel.org/linux-mm/20230512072036.1027784-1-junxiao.chang@intel.com/ Link: https://lkml.kernel.org/r/20230608204927.88711-1-mike.kravetz@oracle.com Fixes: 16c243e99d33 ("udmabuf: Add support for mapping hugepages (v4)") Signed-off-by: Mike Kravetz Acked-by: Greg Kroah-Hartman Acked-by: Vivek Kasireddy Acked-by: Gerd Hoffmann Cc: David Hildenbrand Cc: Dongwon Kim Cc: James Houghton Cc: Jerome Marchand Cc: Junxiao Chang Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Muchun Song Cc: Signed-off-by: Andrew Morton commit c8a8f3b4a95ace7683b615ad9c9aa0eac59013ae Author: David Stevens Date: Wed Jun 7 14:31:35 2023 +0900 mm/khugepaged: fix iteration in collapse_file Remove an unnecessary call to xas_set(index) when iterating over the target range in collapse_file. The extra call to xas_set reset the xas cursor to the top of the tree, causing the xas_next call on the next iteration to walk the tree to index instead of advancing to index+1. This returned the same page again, which would cause collapse_file to fail because the page is already locked. This bug was hidden when CONFIG_DEBUG_VM was set. When that config was used, the xas_load in a subsequent VM_BUG_ON assert would walk xas from the top of the tree to index, causing the xas_next call on the next loop iteration to advance the cursor as expected. Link: https://lkml.kernel.org/r/20230607053135.2087354-1-stevensd@google.com Fixes: a2e17cc2efc7 ("mm/khugepaged: maintain page cache uptodate flag") Signed-off-by: David Stevens Reviewed-by: Peter Xu Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jiaqi Yan Cc: Kirill A . Shutemov Cc: Matthew Wilcox Cc: Yang Shi Cc: Mike Kravetz Signed-off-by: Andrew Morton commit 935d44acf621aa0688fef8312dec3e5940f38f4e Author: Roberto Sassu Date: Wed Jun 7 15:24:27 2023 +0200 memfd: check for non-NULL file_seals in memfd_create() syscall Ensure that file_seals is non-NULL before using it in the memfd_create() syscall. One situation in which memfd_file_seals_ptr() could return a NULL pointer when CONFIG_SHMEM=n, oopsing the kernel. Link: https://lkml.kernel.org/r/20230607132427.2867435-1-roberto.sassu@huaweicloud.com Fixes: 47b9012ecdc7 ("shmem: add sealing support to hugetlb-backed memfd") Signed-off-by: Roberto Sassu Cc: Marc-Andr Lureau Cc: Mike Kravetz Cc: Signed-off-by: Andrew Morton commit 95a301eefa82057571207edd06ea36218985a75e Author: Lorenzo Stoakes Date: Mon Jun 5 21:11:07 2023 +0100 mm/vmalloc: do not output a spurious warning when huge vmalloc() fails In __vmalloc_area_node() we always warn_alloc() when an allocation performed by vm_area_alloc_pages() fails unless it was due to a pending fatal signal. However, huge page allocations instigated either by vmalloc_huge() or __vmalloc_node_range() (or a caller that invokes this like kvmalloc() or kvmalloc_node()) always falls back to order-0 allocations if the huge page allocation fails. This renders the warning useless and noisy, especially as all callers appear to be aware that this may fallback. This has already resulted in at least one bug report from a user who was confused by this (see link). Therefore, simply update the code to only output this warning for order-0 pages when no fatal signal is pending. Link: https://bugzilla.suse.com/show_bug.cgi?id=1211410 Link: https://lkml.kernel.org/r/20230605201107.83298-1-lstoakes@gmail.com Fixes: 80b1d8fdfad1 ("mm: vmalloc: correct use of __GFP_NOWARN mask in __vmalloc_area_node()") Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Reviewed-by: Baoquan He Acked-by: Michal Hocko Reviewed-by: Uladzislau Rezki (Sony) Reviewed-by: David Hildenbrand Cc: Christoph Hellwig Cc: Signed-off-by: Andrew Morton commit 77795f900e2a07c1cbedc375789aefb43843b6c2 Author: Liam R. Howlett Date: Tue Jun 6 14:29:12 2023 -0400 mm/mprotect: fix do_mprotect_pkey() limit check The return of do_mprotect_pkey() can still be incorrectly returned as success if there is a gap that spans to or beyond the end address passed in. Update the check to ensure that the end address has indeed been seen. Link: https://lore.kernel.org/all/CABi2SkXjN+5iFoBhxk71t3cmunTk-s=rB4T7qo0UQRh17s49PQ@mail.gmail.com/ Link: https://lkml.kernel.org/r/20230606182912.586576-1-Liam.Howlett@oracle.com Fixes: 82f951340f25 ("mm/mprotect: fix do_mprotect_pkey() return on error") Signed-off-by: Liam R. Howlett Reported-by: Jeff Xu Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 54abe19e00cfcc5a72773d15cd00ed19ab763439 Author: Rafael Aquini Date: Tue Jun 6 19:36:13 2023 -0400 writeback: fix dereferencing NULL mapping->host on writeback_page_template When commit 19343b5bdd16 ("mm/page-writeback: introduce tracepoint for wait_on_page_writeback()") repurposed the writeback_dirty_page trace event as a template to create its new wait_on_page_writeback trace event, it ended up opening a window to NULL pointer dereference crashes due to the (infrequent) occurrence of a race where an access to a page in the swap-cache happens concurrently with the moment this page is being written to disk and the tracepoint is enabled: BUG: kernel NULL pointer dereference, address: 0000000000000040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000010ec0a067 P4D 800000010ec0a067 PUD 102353067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1320 Comm: shmem-worker Kdump: loaded Not tainted 6.4.0-rc5+ #13 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230301gitf80f052277c8-1.fc37 03/01/2023 RIP: 0010:trace_event_raw_event_writeback_folio_template+0x76/0xf0 Code: 4d 85 e4 74 5c 49 8b 3c 24 e8 06 98 ee ff 48 89 c7 e8 9e 8b ee ff ba 20 00 00 00 48 89 ef 48 89 c6 e8 fe d4 1a 00 49 8b 04 24 <48> 8b 40 40 48 89 43 28 49 8b 45 20 48 89 e7 48 89 43 30 e8 a2 4d RSP: 0000:ffffaad580b6fb60 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff90e38035c01c RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff90e38035c044 RBP: ffff90e38035c024 R08: 0000000000000002 R09: 0000000000000006 R10: ffff90e38035c02e R11: 0000000000000020 R12: ffff90e380bac000 R13: ffffe3a7456d9200 R14: 0000000000001b81 R15: ffffe3a7456d9200 FS: 00007f2e4e8a15c0(0000) GS:ffff90e3fbc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000040 CR3: 00000001150c6003 CR4: 0000000000170ee0 Call Trace: ? __die+0x20/0x70 ? page_fault_oops+0x76/0x170 ? kernelmode_fixup_or_oops+0x84/0x110 ? exc_page_fault+0x65/0x150 ? asm_exc_page_fault+0x22/0x30 ? trace_event_raw_event_writeback_folio_template+0x76/0xf0 folio_wait_writeback+0x6b/0x80 shmem_swapin_folio+0x24a/0x500 ? filemap_get_entry+0xe3/0x140 shmem_get_folio_gfp+0x36e/0x7c0 ? find_busiest_group+0x43/0x1a0 shmem_fault+0x76/0x2a0 ? __update_load_avg_cfs_rq+0x281/0x2f0 __do_fault+0x33/0x130 do_read_fault+0x118/0x160 do_pte_missing+0x1ed/0x2a0 __handle_mm_fault+0x566/0x630 handle_mm_fault+0x91/0x210 do_user_addr_fault+0x22c/0x740 exc_page_fault+0x65/0x150 asm_exc_page_fault+0x22/0x30 This problem arises from the fact that the repurposed writeback_dirty_page trace event code was written assuming that every pointer to mapping (struct address_space) would come from a file-mapped page-cache object, thus mapping->host would always be populated, and that was a valid case before commit 19343b5bdd16. The swap-cache address space (swapper_spaces), however, doesn't populate its ->host (struct inode) pointer, thus leading to the crashes in the corner-case aforementioned. commit 19343b5bdd16 ended up breaking the assignment of __entry->name and __entry->ino for the wait_on_page_writeback tracepoint -- both dependent on mapping->host carrying a pointer to a valid inode. The assignment of __entry->name was fixed by commit 68f23b89067f ("memcg: fix a crash in wb_workfn when a device disappears"), and this commit fixes the remaining case, for __entry->ino. Link: https://lkml.kernel.org/r/20230606233613.1290819-1-aquini@redhat.com Fixes: 19343b5bdd16 ("mm/page-writeback: introduce tracepoint for wait_on_page_writeback()") Signed-off-by: Rafael Aquini Reviewed-by: Yafang Shao Cc: Aristeu Rozanski Cc: Signed-off-by: Andrew Morton commit 85d38d5810e285d5aec7fb5283107d1da70c12a9 Author: Dheeraj Kumar Srivastava Date: Sat Jun 17 02:52:36 2023 +0530 x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys When booting with "intremap=off" and "x2apic_phys" on the kernel command line, the physical x2APIC driver ends up being used even when x2APIC mode is disabled ("intremap=off" disables x2APIC mode). This happens because the first compound condition check in x2apic_phys_probe() is false due to x2apic_mode == 0 and so the following one returns true after default_acpi_madt_oem_check() having already selected the physical x2APIC driver. This results in the following panic: kernel BUG at arch/x86/kernel/apic/io_apic.c:2409! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc2-ver4.1rc2 #2 Hardware name: Dell Inc. PowerEdge R6515/07PXPY, BIOS 2.3.6 07/06/2021 RIP: 0010:setup_IO_APIC+0x9c/0xaf0 Call Trace: ? native_read_msr apic_intr_mode_init x86_late_time_init start_kernel x86_64_start_reservations x86_64_start_kernel secondary_startup_64_no_verify which is: setup_IO_APIC: apic_printk(APIC_VERBOSE, "ENABLING IO-APIC IRQs\n"); for_each_ioapic(ioapic) BUG_ON(mp_irqdomain_create(ioapic)); Return 0 to denote that x2APIC has not been enabled when probing the physical x2APIC driver. [ bp: Massage commit message heavily. ] Fixes: 9ebd680bd029 ("x86, apic: Use probe routines to simplify apic selection") Signed-off-by: Dheeraj Kumar Srivastava Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Kishon Vijay Abraham I Reviewed-by: Vasant Hegde Reviewed-by: Cyrill Gorcunov Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230616212236.1389-1-dheerajkumar.srivastava@amd.com commit dbad9ce9397ef7f891b4ff44bad694add673c1a1 Merge: 45a3e24f65e90 819da022dd007 Author: Linus Torvalds Date: Mon Jun 19 11:22:46 2023 -0700 Merge tag 'afs-fixes-20230719' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS writeback fixes from David Howells: - release the acquired batch before returning if we got >=5 skips - retry a page we had to wait for rather than skipping over it after the wait * tag 'afs-fixes-20230719' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Fix waiting for writeback then skipping folio afs: Fix dangling folio ref counts in writeback commit 7257d930aadcd62d1c7971ab14f3b1126356abdc Author: Teresa Remmet Date: Wed Jun 14 14:52:40 2023 +0200 regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK L3_OUT and L4_OUT Bit fields range from Bit 0:4 and thus the mask should be 0x1F instead of 0x0F. Fixes: 0935ff5f1f0a ("regulator: pca9450: add pca9450 pmic driver") Signed-off-by: Teresa Remmet Reviewed-by: Frieder Schrempf Link: https://lore.kernel.org/r/20230614125240.3946519-1-t.remmet@phytec.de Signed-off-by: Mark Brown commit d7fce52fdf96663ddc2eb21afecff3775588612a Author: Terin Stock Date: Fri Jun 9 22:58:42 2023 +0200 ipvs: align inner_mac_header for encapsulation When using encapsulation the original packet's headers are copied to the inner headers. This preserves the space for an inner mac header, which is not used by the inner payloads for the encapsulation types supported by IPVS. If a packet is using GUE or GRE encapsulation and needs to be segmented, flow can be passed to __skb_udp_tunnel_segment() which calculates a negative tunnel header length. A negative tunnel header length causes pskb_may_pull() to fail, dropping the packet. This can be observed by attaching probes to ip_vs_in_hook(), __dev_queue_xmit(), and __skb_udp_tunnel_segment(): perf probe --add '__dev_queue_xmit skb->inner_mac_header \ skb->inner_network_header skb->mac_header skb->network_header' perf probe --add '__skb_udp_tunnel_segment:7 tnl_hlen' perf probe -m ip_vs --add 'ip_vs_in_hook skb->inner_mac_header \ skb->inner_network_header skb->mac_header skb->network_header' These probes the headers and tunnel header length for packets which traverse the IPVS encapsulation path. A TCP packet can be forced into the segmentation path by being smaller than a calculated clamped MSS, but larger than the advertised MSS. probe:ip_vs_in_hook: inner_mac_header=0x0 inner_network_header=0x0 mac_header=0x44 network_header=0x52 probe:ip_vs_in_hook: inner_mac_header=0x44 inner_network_header=0x52 mac_header=0x44 network_header=0x32 probe:dev_queue_xmit: inner_mac_header=0x44 inner_network_header=0x52 mac_header=0x44 network_header=0x32 probe:__skb_udp_tunnel_segment_L7: tnl_hlen=-2 When using veth-based encapsulation, the interfaces are set to be mac-less, which does not preserve space for an inner mac header. This prevents this issue from occurring. In our real-world testing of sending a 32KB file we observed operation time increasing from ~75ms for veth-based encapsulation to over 1.5s using IPVS encapsulation due to retries from dropped packets. This changeset modifies the packet on the encapsulation path in ip_vs_tunnel_xmit() and ip_vs_tunnel_xmit_v6() to remove the inner mac header offset. This fixes UDP segmentation for both encapsulation types, and corrects the inner headers for any IPIP flows that may use it. Fixes: 84c0d5e96f3a ("ipvs: allow tunneling with gue encapsulation") Signed-off-by: Terin Stock Acked-by: Julian Anastasov Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit 819da022dd007398d0c42ebcd8dbb1b681acea53 Author: Vishal Moola (Oracle) Date: Wed Jun 7 13:41:20 2023 -0700 afs: Fix waiting for writeback then skipping folio Commit acc8d8588cb7 converted afs_writepages_region() to write back a folio batch. The function waits for writeback to a folio, but then proceeds to the rest of the batch without trying to write that folio again. This patch fixes has it attempt to write the folio again. [DH: Also remove an 'else' that adding a goto makes redundant] Fixes: acc8d8588cb7 ("afs: convert afs_writepages_region() to use filemap_get_folios_tag()") Signed-off-by: Vishal Moola (Oracle) Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/20230607204120.89416-2-vishal.moola@gmail.com/ commit a2b6f2ab3e144f8e23666aafeba0e4d9ea4b7975 Author: Vishal Moola (Oracle) Date: Wed Jun 7 13:41:19 2023 -0700 afs: Fix dangling folio ref counts in writeback Commit acc8d8588cb7 converted afs_writepages_region() to write back a folio batch. If writeback needs rescheduling, the function exits without dropping the references to the folios in fbatch. This patch fixes that. [DH: Moved the added line before the _leave()] Fixes: acc8d8588cb7 ("afs: convert afs_writepages_region() to use filemap_get_folios_tag()") Signed-off-by: Vishal Moola (Oracle) Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/20230607204120.89416-1-vishal.moola@gmail.com/ commit ff7a1790fbf92f1bdd0966d3f0da3ea808ede876 Author: Michael Walle Date: Mon Jun 19 10:56:07 2023 +0200 gpiolib: Fix irq_domain resource tracking for gpiochip_irqchip_add_domain() Up until commit 6a45b0e2589f ("gpiolib: Introduce gpiochip_irqchip_add_domain()") all irq_domains were allocated by gpiolib itself and thus gpiolib also takes care of freeing it. With gpiochip_irqchip_add_domain() a user of gpiolib can associate an irq_domain with the gpio_chip. This irq_domain is not managed by gpiolib and therefore must not be freed by gpiolib. Fixes: 6a45b0e2589f ("gpiolib: Introduce gpiochip_irqchip_add_domain()") Reported-by: Jiawen Wu Signed-off-by: Michael Walle Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 555434fd5c6b3589d9511ab6e88faf50346e19da Author: Luke D. Jones Date: Mon Jun 19 18:03:20 2023 +1200 ALSA: hda/realtek: Add quirk for ASUS ROG G634Z Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG G634Z series. While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet). Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20230619060320.1336455-1-luke@ljones.dev Signed-off-by: Takashi Iwai commit 1f1ef7e5bbe2de125da413e238915f6047ea4ba2 Author: Charles Keepax Date: Wed Jun 14 15:21:16 2023 +0100 ASoC: intel: sof_sdw: Fixup typo in device link checking The loop checking for multiple different devices on a single sdw link contains a typo accidentally using i twice instead of j. Correct to the correct index variable. Fixes: dc5a3e60a4b5 ("ASoC: Intel: sof_sdw: append codec type to dai link name") Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20230614142116.1059677-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 413db499730248431c1005b392e8ed82c4fa19bf Author: Sergey Shtylyov Date: Sat Jun 17 23:36:22 2023 +0300 mmc: usdhi60rol0: fix deferred probing The driver overrides the error codes returned by platform_get_irq_byname() to -ENODEV, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating error codes upstream. Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230617203622.6812-13-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit c2df53c5806cfd746dae08e07bc8c4ad247c3b70 Author: Sergey Shtylyov Date: Sat Jun 17 23:36:21 2023 +0300 mmc: sunxi: fix deferred probing The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it... Fixes: 2408a08583d2 ("mmc: sunxi-mmc: Handle return value of platform_get_irq") Cc: stable@vger.kernel.org # v5.19+ Signed-off-by: Sergey Shtylyov Reviewed-by: Jernej Skrabec Link: https://lore.kernel.org/r/20230617203622.6812-12-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit 5b067d7f855c61df7f8e2e8ccbcee133c282415e Author: Sergey Shtylyov Date: Sat Jun 17 23:36:20 2023 +0300 mmc: sh_mmcif: fix deferred probing The driver overrides the error codes returned by platform_get_irq() to -ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230617203622.6812-11-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit 8d0caeedcd05a721f3cc2537b0ea212ec4027307 Author: Sergey Shtylyov Date: Sat Jun 17 23:36:19 2023 +0300 mmc: sdhci-spear: fix deferred probing The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it... Fixes: 682798a596a6 ("mmc: sdhci-spear: Handle return value of platform_get_irq") Cc: stable@vger.kernel.org # v5.19+ Signed-off-by: Sergey Shtylyov Acked-by: Viresh Kumar Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20230617203622.6812-10-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit b465dea5e1540c7d7b5211adaf94926980d3014b Author: Sergey Shtylyov Date: Sat Jun 17 23:36:18 2023 +0300 mmc: sdhci-acpi: fix deferred probing The driver overrides the error codes returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Fixes: 1b7ba57ecc86 ("mmc: sdhci-acpi: Handle return value of platform_get_irq") Signed-off-by: Sergey Shtylyov Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20230617203622.6812-9-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit 3c482e1e830d79b9be8afb900a965135c01f7893 Author: Sergey Shtylyov Date: Sat Jun 17 23:36:17 2023 +0300 mmc: owl: fix deferred probing The driver overrides the error codes returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Fixes: ff65ffe46d28 ("mmc: Add Actions Semi Owl SoCs SD/MMC driver") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230617203622.6812-8-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit fb51b74a57859b707c3e8055ed0c25a7ca4f6a29 Author: Sergey Shtylyov Date: Sat Jun 17 23:36:16 2023 +0300 mmc: omap_hsmmc: fix deferred probing The driver overrides the error codes returned by platform_get_irq() to -ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230617203622.6812-7-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit aedf4ba1ad00aaa94c1b66c73ecaae95e2564b95 Author: Sergey Shtylyov Date: Sat Jun 17 23:36:15 2023 +0300 mmc: omap: fix deferred probing The driver overrides the error codes returned by platform_get_irq() to -ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230617203622.6812-6-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit 8d84064da0d4672e74f984e8710f27881137472c Author: Sergey Shtylyov Date: Sat Jun 17 23:36:14 2023 +0300 mmc: mvsdio: fix deferred probing The driver overrides the error codes returned by platform_get_irq() to -ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230617203622.6812-5-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit 0c4dc0f054891a2cbde0426b0c0fdf232d89f47f Author: Sergey Shtylyov Date: Sat Jun 17 23:36:13 2023 +0300 mmc: mtk-sd: fix deferred probing The driver overrides the error codes returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Fixes: 208489032bdd ("mmc: mediatek: Add Mediatek MMC driver") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230617203622.6812-4-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit b8ada54fa1b83f3b6480d4cced71354301750153 Author: Sergey Shtylyov Date: Sat Jun 17 23:36:12 2023 +0300 mmc: meson-gx: fix deferred probing The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it... Fixes: cbcaac6d7dd2 ("mmc: meson-gx-mmc: Fix platform_get_irq's error checking") Cc: stable@vger.kernel.org # v5.19+ Signed-off-by: Sergey Shtylyov Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20230617203622.6812-3-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit 71150ac12558bcd9d75e6e24cf7c872c2efd80f3 Author: Sergey Shtylyov Date: Sat Jun 17 23:36:11 2023 +0300 mmc: bcm2835: fix deferred probing The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it... Fixes: 660fc733bd74 ("mmc: bcm2835: Add new driver for the sdhost controller.") Cc: stable@vger.kernel.org # v5.19+ Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20230617203622.6812-2-s.shtylyov@omp.ru Signed-off-by: Ulf Hansson commit f334ad47683606b682b4166b800d8b372d315436 Author: Jisheng Zhang Date: Sat Jun 17 16:53:19 2023 +0800 mmc: litex_mmc: set PROBE_PREFER_ASYNCHRONOUS mmc host drivers should have enabled the asynchronous probe option, but it seems like we didn't set it for litex_mmc when introducing litex mmc support, so let's set it now. Tested with linux-on-litex-vexriscv on sipeed tang nano 20K fpga. Signed-off-by: Jisheng Zhang Acked-by: Gabriel Somlo Fixes: 92e099104729 ("mmc: Add driver for LiteX's LiteSDCard interface") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230617085319.2139-1-jszhang@kernel.org Signed-off-by: Ulf Hansson commit 0dbcac3a6dbb32c1de53ebebfd28452965e12950 Merge: 92717c2356cb6 a128f9d4c1227 Author: David S. Miller Date: Mon Jun 19 10:28:56 2023 +0100 Merge tag 'mlx5-fixes-2023-06-16' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-fixes-2023-06-16 This series provides bug fixes to mlx5 driver. Please pull and let me know if there is any problem. ==================== Signed-off-by: David S. Miller commit 92717c2356cb62c89e8a3dc37cbbab2502562524 Author: Stefan Wahren Date: Wed Jun 14 23:06:56 2023 +0200 net: qca_spi: Avoid high load if QCA7000 is not available In case the QCA7000 is not available via SPI (e.g. in reset), the driver will cause a high load. The reason for this is that the synchronization is never finished and schedule() is never called. Since the synchronization is not timing critical, it's safe to drop this from the scheduling condition. Signed-off-by: Stefan Wahren Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") Signed-off-by: David S. Miller commit 45a3e24f65e90a047bef86f927ebdc4c710edaa1 Author: Linus Torvalds Date: Sun Jun 18 14:06:27 2023 -0700 Linux 6.4-rc7 commit 8c1f0c38b31025f60437215dd27fffc293565fa4 Merge: ecbcffe3b7edc 9cefd6e7e0a77 Author: Linus Torvalds Date: Sun Jun 18 09:55:33 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four fixes, all in drivers: three fairly obvious small ones and a large one in aacraid to add block queue completion mapping and fix a CPU offline hang" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: lpfc: Fix incorrect big endian type assignment in bsg loopback path scsi: target: core: Fix error path in target_setup_session() scsi: storvsc: Always set no_report_opcodes scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity commit ecbcffe3b7edc9a42b4e29ed8dafd56855ee675c Merge: 1dbbfe254d236 6aa0365a3c851 Author: Linus Torvalds Date: Sun Jun 18 09:48:39 2023 -0700 Merge tag 'ata-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fix from Damien Le Moal: - Avoid deadlocks on resume from sleep by delaying scsi rescan until the scsi device is also fully resumed. * tag 'ata-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: libata-scsi: Avoid deadlock on rescan after device resume commit 1dbbfe254d2360993e79a10ca42aeec407e13b34 Merge: 606c812eb1d5b b5b2a02bcaac7 Author: Linus Torvalds Date: Sun Jun 18 09:41:39 2023 -0700 Merge tag 'parisc-for-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: - Drop redundant register definitions to fix build with latest binutils * tag 'parisc-for-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Delete redundant register definitions in commit c938ab4da0eb1620ae3243b0b24c572ddfc318fc Author: Andrew Lunn Date: Sat Jun 17 17:55:00 2023 +0200 net: phy: Manual remove LEDs to ensure correct ordering If the core is left to remove the LEDs via devm_, it is performed too late, after the PHY driver is removed from the PHY. This results in dereferencing a NULL pointer when the LED core tries to turn the LED off before destroying the LED. Manually unregister the LEDs at a safe point in phy_remove. Cc: stable@vger.kernel.org Reported-by: Florian Fainelli Suggested-by: Florian Fainelli Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 606c812eb1d5b5fb0dd9e330ca94b52d7c227830 Author: Liam R. Howlett Date: Sat Jun 17 20:47:08 2023 -0400 mm/mmap: Fix error path in do_vmi_align_munmap() The error unrolling was leaving the VMAs detached in many cases and leaving the locked_vm statistic altered, and skipping the unrolling entirely in the case of the vma tree write failing. Fix the error path by re-attaching the detached VMAs and adding the necessary goto for the failed vma tree write, and fix the locked_vm statistic by only updating after the vma tree write succeeds. Fixes: 763ecb035029 ("mm: remove the vma linked list") Reported-by: Vegard Nossum Signed-off-by: Liam R. Howlett Signed-off-by: Linus Torvalds commit eb09fc2d14163c0c217846cfabec3d0cce7c8f8c Author: Juerg Haefliger Date: Fri Jun 16 14:22:18 2023 +0200 nfc: fdp: Add MODULE_FIRMWARE macros The module loads firmware so add MODULE_FIRMWARE macros to provide that information via modinfo. Signed-off-by: Juerg Haefliger Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit f593a94b530aee4c7f2511c9e48eb495dff03991 Author: Juerg Haefliger Date: Fri Jun 16 14:18:07 2023 +0200 ieee802154/adf7242: Add MODULE_FIRMWARE macro The module loads firmware so add a MODULE_FIRMWARE macro to provide that information via modinfo. Signed-off-by: Juerg Haefliger Signed-off-by: David S. Miller commit 067d6ec7ed5b49380688e06c1e5f883a71bef4fe Author: Dexuan Cui Date: Wed Jun 14 21:44:51 2023 -0700 PCI: hv: Add a per-bus mutex state_lock In the case of fast device addition/removal, it's possible that hv_eject_device_work() can start to run before create_root_hv_pci_bus() starts to run; as a result, the pci_get_domain_bus_and_slot() in hv_eject_device_work() can return a 'pdev' of NULL, and hv_eject_device_work() can remove the 'hpdev', and immediately send a message PCI_EJECTION_COMPLETE to the host, and the host immediately unassigns the PCI device from the guest; meanwhile, create_root_hv_pci_bus() and the PCI device driver can be probing the dead PCI device and reporting timeout errors. Fix the issue by adding a per-bus mutex 'state_lock' and grabbing the mutex before powering on the PCI bus in hv_pci_enter_d0(): when hv_eject_device_work() starts to run, it's able to find the 'pdev' and call pci_stop_and_remove_bus_device(pdev): if the PCI device driver has loaded, the PCI device driver's probe() function is already called in create_root_hv_pci_bus() -> pci_bus_add_devices(), and now hv_eject_device_work() -> pci_stop_and_remove_bus_device() is able to call the PCI device driver's remove() function and remove the device reliably; if the PCI device driver hasn't loaded yet, the function call hv_eject_device_work() -> pci_stop_and_remove_bus_device() is able to remove the PCI device reliably and the PCI device driver's probe() function won't be called; if the PCI device driver's probe() is already running (e.g., systemd-udev is loading the PCI device driver), it must be holding the per-device lock, and after the probe() finishes and releases the lock, hv_eject_device_work() -> pci_stop_and_remove_bus_device() is able to proceed to remove the device reliably. Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs") Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Acked-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230615044451.5580-6-decui@microsoft.com Signed-off-by: Wei Liu commit a847234e24d03d01a9566d1d9dcce018cc018d67 Author: Dexuan Cui Date: Wed Jun 14 21:44:50 2023 -0700 Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" This reverts commit d6af2ed29c7c1c311b96dac989dcb991e90ee195. The statement "the hv_pci_bus_exit() call releases structures of all its child devices" in commit d6af2ed29c7c is not true: in the path hv_pci_probe() -> hv_pci_enter_d0() -> hv_pci_bus_exit(hdev, true): the parameter "keep_devs" is true, so hv_pci_bus_exit() does *not* release the child "struct hv_pci_dev *hpdev" that is created earlier in pci_devices_present_work() -> new_pcichild_device(). The commit d6af2ed29c7c was originally made in July 2020 for RHEL 7.7, where the old version of hv_pci_bus_exit() was used; when the commit was rebased and merged into the upstream, people didn't notice that it's not really necessary. The commit itself doesn't cause any issue, but it makes hv_pci_probe() more complicated. Revert it to facilitate some upcoming changes to hv_pci_probe(). Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Acked-by: Wei Hu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230615044451.5580-5-decui@microsoft.com Signed-off-by: Wei Liu commit add9195e69c94b32e96f78c2f9cea68f0e850b3f Author: Dexuan Cui Date: Wed Jun 14 21:44:49 2023 -0700 PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev The hpdev->state is never really useful. The only use in hv_pci_eject_device() and hv_eject_device_work() is not really necessary. Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Acked-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230615044451.5580-4-decui@microsoft.com Signed-off-by: Wei Liu commit 2738d5ab7929a845b654cd171a1e275c37eb428e Author: Dexuan Cui Date: Wed Jun 14 21:44:48 2023 -0700 PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic When the host tries to remove a PCI device, the host first sends a PCI_EJECT message to the guest, and the guest is supposed to gracefully remove the PCI device and send a PCI_EJECTION_COMPLETE message to the host; the host then sends a VMBus message CHANNELMSG_RESCIND_CHANNELOFFER to the guest (when the guest receives this message, the device is already unassigned from the guest) and the guest can do some final cleanup work; if the guest fails to respond to the PCI_EJECT message within one minute, the host sends the VMBus message CHANNELMSG_RESCIND_CHANNELOFFER and removes the PCI device forcibly. In the case of fast device addition/removal, it's possible that the PCI device driver is still configuring MSI-X interrupts when the guest receives the PCI_EJECT message; the channel callback calls hv_pci_eject_device(), which sets hpdev->state to hv_pcichild_ejecting, and schedules a work hv_eject_device_work(); if the PCI device driver is calling pci_alloc_irq_vectors() -> ... -> hv_compose_msi_msg(), we can break the while loop in hv_compose_msi_msg() due to the updated hpdev->state, and leave data->chip_data with its default value of NULL; later, when the PCI device driver calls request_irq() -> ... -> hv_irq_unmask(), the guest crashes in hv_arch_irq_unmask() due to data->chip_data being NULL. Fix the issue by not testing hpdev->state in the while loop: when the guest receives PCI_EJECT, the device is still assigned to the guest, and the guest has one minute to finish the device removal gracefully. We don't really need to (and we should not) test hpdev->state in the loop. Fixes: de0aa7b2f97d ("PCI: hv: Fix 2 hang issues in hv_compose_msi_msg()") Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230615044451.5580-3-decui@microsoft.com Signed-off-by: Wei Liu commit 440b5e3663271b0ffbd4908115044a6a51fb938b Author: Dexuan Cui Date: Wed Jun 14 21:44:47 2023 -0700 PCI: hv: Fix a race condition bug in hv_pci_query_relations() Since day 1 of the driver, there has been a race between hv_pci_query_relations() and survey_child_resources(): during fast device hotplug, hv_pci_query_relations() may error out due to device-remove and the stack variable 'comp' is no longer valid; however, pci_devices_present_work() -> survey_child_resources() -> complete() may be running on another CPU and accessing the no-longer-valid 'comp'. Fix the race by flushing the workqueue before we exit from hv_pci_query_relations(). Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs") Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Acked-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230615044451.5580-2-decui@microsoft.com Signed-off-by: Wei Liu commit 6aa0365a3c8512587fffd42fe438768709ddef8e Author: Damien Le Moal Date: Thu Jun 15 17:18:53 2023 +0900 ata: libata-scsi: Avoid deadlock on rescan after device resume When an ATA port is resumed from sleep, the port is reset and a power management request issued to libata EH to reset the port and rescanning the device(s) attached to the port. Device rescanning is done by scheduling an ata_scsi_dev_rescan() work, which will execute scsi_rescan_device(). However, scsi_rescan_device() takes the generic device lock, which is also taken by dpm_resume() when the SCSI device is resumed as well. If a device rescan execution starts before the completion of the SCSI device resume, the rcu locking used to refresh the cached VPD pages of the device, combined with the generic device locking from scsi_rescan_device() and from dpm_resume() can cause a deadlock. Avoid this situation by changing struct ata_port scsi_rescan_task to be a delayed work instead of a simple work_struct. ata_scsi_dev_rescan() is modified to check if the SCSI device associated with the ATA device that must be rescanned is not suspended. If the SCSI device is still suspended, ata_scsi_dev_rescan() returns early and reschedule itself for execution after an arbitrary delay of 5ms. Reported-by: Kai-Heng Feng Reported-by: Joe Breuer Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217530 Fixes: a19a93e4c6a9 ("scsi: core: pm: Rely on the device driver core for async power management") Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Tested-by: Kai-Heng Feng Tested-by: Joe Breuer commit ef7dfac51d8ed961b742218f526bd589f3900a59 Author: Jens Axboe Date: Sat Jun 17 19:50:24 2023 -0600 io_uring/poll: serialize poll linked timer start with poll removal We selectively grab the ctx->uring_lock for poll update/removal, but we really should grab it from the start to fully synchronize with linked timeouts. Normally this is indeed the case, but if requests are forced async by the application, we don't fully cover removal and timer disarm within the uring_lock. Make this simpler by having consistent locking state for poll removal. Cc: stable@vger.kernel.org # 6.1+ Reported-by: Querijn Voet Signed-off-by: Jens Axboe commit 52ae076c3a9b366b6fa9f7c7e67aed8b28716ed9 Author: Michael Kelley Date: Tue May 23 10:14:22 2023 -0700 arm64/hyperv: Use CPUHP_AP_HYPERV_ONLINE state to fix CPU online sequencing State CPUHP_AP_HYPERV_ONLINE has been introduced to correctly sequence the initialization of hyperv_pcpu_input_arg. Use this new state for Hyper-V initialization so that hyperv_pcpu_input_arg is allocated early enough. Signed-off-by: Michael Kelley Reviewed-by: Dexuan Cui Link: https://lore.kernel.org/r/1684862062-51576-2-git-send-email-mikelley@microsoft.com Signed-off-by: Wei Liu commit 9636be85cc5bdd8b7a7f6a53405cbcc52161c93c Author: Michael Kelley Date: Tue May 23 10:14:21 2023 -0700 x86/hyperv: Fix hyperv_pcpu_input_arg handling when CPUs go online/offline These commits a494aef23dfc ("PCI: hv: Replace retarget_msi_interrupt_params with hyperv_pcpu_input_arg") 2c6ba4216844 ("PCI: hv: Enable PCI pass-thru devices in Confidential VMs") update the Hyper-V virtual PCI driver to use the hyperv_pcpu_input_arg because that memory will be correctly marked as decrypted or encrypted for all VM types (CoCo or normal). But problems ensue when CPUs in the VM go online or offline after virtual PCI devices have been configured. When a CPU is brought online, the hyperv_pcpu_input_arg for that CPU is initialized by hv_cpu_init() running under state CPUHP_AP_ONLINE_DYN. But this state occurs after state CPUHP_AP_IRQ_AFFINITY_ONLINE, which may call the virtual PCI driver and fault trying to use the as yet uninitialized hyperv_pcpu_input_arg. A similar problem occurs in a CoCo VM if the MMIO read and write hypercalls are used from state CPUHP_AP_IRQ_AFFINITY_ONLINE. When a CPU is taken offline, IRQs may be reassigned in state CPUHP_TEARDOWN_CPU. Again, the virtual PCI driver may fault trying to use the hyperv_pcpu_input_arg that has already been freed by a higher state. Fix the onlining problem by adding state CPUHP_AP_HYPERV_ONLINE immediately after CPUHP_AP_ONLINE_IDLE (similar to CPUHP_AP_KVM_ONLINE) and before CPUHP_AP_IRQ_AFFINITY_ONLINE. Use this new state for Hyper-V initialization so that hyperv_pcpu_input_arg is allocated early enough. Fix the offlining problem by not freeing hyperv_pcpu_input_arg when a CPU goes offline. Retain the allocated memory, and reuse it if the CPU comes back online later. Signed-off-by: Michael Kelley Reviewed-by: Vitaly Kuznetsov Acked-by: Borislav Petkov (AMD) Reviewed-by: Dexuan Cui Link: https://lore.kernel.org/r/1684862062-51576-1-git-send-email-mikelley@microsoft.com Signed-off-by: Wei Liu commit 1b29d271614abd97cc39782daa9d6dd70e98609f Merge: 670062e7e4199 b3dad076a0589 Author: Linus Torvalds Date: Sat Jun 17 11:04:10 2023 -0700 Merge tag 'staging-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fix from Greg KH: "Here is a single staging driver "fix" for 6.4-rc7. I've been sitting on it in my tree for many weeks as it is just a simple documentation update, with the hope that maybe some other staging driver fixes would need to be merged for 6.4-final, but that does not seem to be the case. So please, pull in this one documentation update so that Aaro doesn't get emails going forward that he can't do anything about" * tag 'staging-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: octeon: delete my name from TODO contact commit 670062e7e4199b13980cd1d46796beb05c4a8699 Merge: 3c0eb44233122 286d9975a838d Author: Linus Torvalds Date: Sat Jun 17 10:57:34 2023 -0700 Merge tag 'usb-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some small USB and Thunderbolt driver fixes and new device ids for 6.4-rc7 to resolve some reported problems. Included in here are: - new USB serial device ids - USB gadget core fixes for long-dissussed problems - dwc3 bugfixes for reported issues. - typec driver fixes - thunderbolt driver fixes All of these have been in linux-next this week with no reported issues" * tag 'usb-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: gadget: udc: core: Prevent soft_connect_store() race usb: gadget: udc: core: Offload usb_udc_vbus_handler processing usb: typec: Fix fast_role_swap_current show function usb: typec: ucsi: Fix command cancellation USB: dwc3: fix use-after-free on core driver unbind USB: dwc3: qcom: fix NULL-deref on suspend usb: dwc3: gadget: Reset num TRBs before giving back the request usb: gadget: udc: renesas_usb3: Fix RZ/V2M {modprobe,bind} error USB: serial: option: add Quectel EM061KGL series thunderbolt: Mask ring interrupt on Intel hardware as well thunderbolt: Do not touch CL state configuration during discovery thunderbolt: Increase DisplayPort Connection Manager handshake timeout thunderbolt: dma_test: Use correct value for absent rings when creating paths commit 3c0eb44233122d076ca5c1ddf57807c82ecfb991 Merge: c6cf6be9dfb80 a82c3df955f8c Author: Linus Torvalds Date: Sat Jun 17 10:51:35 2023 -0700 Merge tag 'tty-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are two small serial driver fixes for 6.4-rc7 that resolve some reported problems: - lantiq serial driver irq fix - fsl_lpuart serial driver watermark fix Both of these have been in linux-next this week with no reported issues" * tag 'tty-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A serial: lantiq: add missing interrupt ack commit 4aaf2c52834b7f95acdf9fb0211a1b60adbf421b Author: Íñigo Huguet Date: Thu Jun 15 10:49:29 2023 +0200 sfc: use budget for TX completions When running workloads heavy unbalanced towards TX (high TX, low RX traffic), sfc driver can retain the CPU during too long times. Although in many cases this is not enough to be visible, it can affect performance and system responsiveness. A way to reproduce it is to use a debug kernel and run some parallel netperf TX tests. In some systems, this will lead to this message being logged: kernel:watchdog: BUG: soft lockup - CPU#12 stuck for 22s! The reason is that sfc driver doesn't account any NAPI budget for the TX completion events work. With high-TX/low-RX traffic, this makes that the CPU is held for long time for NAPI poll. Documentations says "drivers can process completions for any number of Tx packets but should only process up to budget number of Rx packets". However, many drivers do limit the amount of TX completions that they process in a single NAPI poll. In the same way, this patch adds a limit for the TX work in sfc. With the patch applied, the watchdog warning never appears. Tested with netperf in different combinations: single process / parallel processes, TCP / UDP and different sizes of UDP messages. Repeated the tests before and after the patch, without any noticeable difference in network or CPU performance. Test hardware: Intel(R) Xeon(R) CPU E5-1620 v4 @ 3.50GHz (4 cores, 2 threads/core) Solarflare Communications XtremeScale X2522-25G Network Adapter Fixes: 5227ecccea2d ("sfc: remove tx and MCDI handling from NAPI budget consideration") Fixes: d19a53721863 ("sfc_ef100: TX path for EF100 NICs") Reported-by: Fei Liu Signed-off-by: Íñigo Huguet Acked-by: Martin Habets Link: https://lore.kernel.org/r/20230615084929.10506-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit b5b2a02bcaac7c287694aa0db4837a07bf178626 Author: Ben Hutchings Date: Thu Jun 15 00:00:02 2023 +0200 parisc: Delete redundant register definitions in We define sp and ipsw in using ".reg", and when using current binutils (snapshot 2.40.50.20230611) the definitions in using "=" conflict with those: arch/parisc/include/asm/assembly.h: Assembler messages: arch/parisc/include/asm/assembly.h:93: Error: symbol `sp' is already defined arch/parisc/include/asm/assembly.h:95: Error: symbol `ipsw' is already defined Delete the duplicate definitions in . Also delete the definition of gp, which isn't used anywhere. Signed-off-by: Ben Hutchings Cc: stable@vger.kernel.org # v6.0+ Signed-off-by: Helge Deller commit c6cf6be9dfb8098f2c2d26ebe53ad80843cdd2bc Merge: 1639fae5132bc 23200a4c8ac28 Author: Linus Torvalds Date: Fri Jun 16 21:38:50 2023 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A handful of clk driver fixes: - Fix an OOB issue in the Mediatek mt8365 driver where arrays of clks are mismatched in size - Use the proper clk_ops for a few clks in the Mediatek mt8365 driver - Stop using abs() in clk_composite_determine_rate() because 64-bit math goes wrong on large unsigned long numbers that are subtracted and passed into abs() - Zero initialize a struct clk_init_data in clk-loongson2 to avoid stack junk confusing clk_hw_register() - Actually use a pointer to __iomem for writel() in pxa3xx_clk_update_accr() so we don't oops" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: pxa: fix NULL pointer dereference in pxa3xx_clk_update_accr clk: clk-loongson2: Zero init clk_init_data clk: mediatek: mt8365: Fix inverted topclk operations clk: composite: Fix handling of high clock rates clk: mediatek: mt8365: Fix index issue commit 5005bcb4219156f1bf7587b185080ec1da08518e Author: Namjae Jeon Date: Thu Jun 15 22:05:29 2023 +0900 ksmbd: validate session id and tree id in the compound request This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21165 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 5fe7f7b78290638806211046a99f031ff26164e1 Author: Namjae Jeon Date: Thu Jun 15 22:04:40 2023 +0900 ksmbd: fix out-of-bound read in smb2_write ksmbd_smb2_check_message doesn't validate hdr->NextCommand. If ->NextCommand is bigger than Offset + Length of smb2 write, It will allow oversized smb2 write length. It will cause OOB read in smb2_write. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21164 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 40b268d384a22276dca1450549f53eed60e21deb Author: Namjae Jeon Date: Thu Jun 15 15:56:32 2023 +0900 ksmbd: add mnt_want_write to ksmbd vfs functions ksmbd is doing write access using vfs helpers. There are the cases that mnt_want_write() is not called in vfs helper. This patch add missing mnt_want_write() to ksmbd vfs functions. Cc: stable@vger.kernel.org Cc: Amir Goldstein Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 2b9b8f3b68edb3d67d79962f02e26dbb5ae3808d Author: Namjae Jeon Date: Mon Jun 5 01:57:34 2023 +0900 ksmbd: validate command payload size ->StructureSize2 indicates command payload size. ksmbd should validate this size with rfc1002 length before accessing it. This patch remove unneeded check and add the validation for this. [ 8.912583] BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message+0x12a/0xc50 [ 8.913051] Read of size 2 at addr ffff88800ac7d92c by task kworker/0:0/7 ... [ 8.914967] Call Trace: [ 8.915126] [ 8.915267] dump_stack_lvl+0x33/0x50 [ 8.915506] print_report+0xcc/0x620 [ 8.916558] kasan_report+0xae/0xe0 [ 8.917080] kasan_check_range+0x35/0x1b0 [ 8.917334] ksmbd_smb2_check_message+0x12a/0xc50 [ 8.917935] ksmbd_verify_smb_message+0xae/0xd0 [ 8.918223] handle_ksmbd_work+0x192/0x820 [ 8.918478] process_one_work+0x419/0x760 [ 8.918727] worker_thread+0x2a2/0x6f0 [ 8.919222] kthread+0x187/0x1d0 [ 8.919723] ret_from_fork+0x1f/0x30 [ 8.919954] Cc: stable@vger.kernel.org Reported-by: Chih-Yen Chang Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 1639fae5132bc8a904af28d97cea0bedb3af802e Merge: ba00b19067080 9930f518b6a82 Author: Linus Torvalds Date: Fri Jun 16 14:57:48 2023 -0700 Merge tag 'drm-fixes-2023-06-17' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "A bunch of misc fixes across the board. amdgpu is the usual bulk with a revert and other fixes, nouveau has a race fix that was causing a UAF that was hard hanging systems, otherwise some qaic, bridge and radeon. amdgpu: - GFX9 preemption fixes - Add missing radeon secondary PCI ID - vblflash fixes - SMU 13 fix - VCN 4.0 fix - Re-enable TOPDOWN flag for large BAR systems to fix regression - eDP fix - PSR hang fix - DPIA fix radeon: - fbdev client warning fix qaic: - leak fix - null ptr deref fix nouveau: - use-after-free caused by fence race fix - runtime pm fix - NULL ptr checks bridge: - ti-sn65dsi86: Avoid possible buffer overflow" * tag 'drm-fixes-2023-06-17' of git://anongit.freedesktop.org/drm/drm: (21 commits) nouveau: fix client work fence deletion race drm/amd/display: limit DPIA link rate to HBR3 drm/amd/display: fix the system hang while disable PSR drm/amd/display: edp do not add non-edid timings Revert "drm/amdgpu: remove TOPDOWN flags when allocating VRAM in large bar system" drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1 drm/radeon: Disable outputs when releasing fbdev client drm/amd/pm: workaround for compute workload type on some skus drm/amd: Tighten permissions on VBIOS flashing attributes drm/amd: Make sure image is written to trigger VBIOS image update flow drm/amdgpu: add missing radeon secondary PCI ID drm/amdgpu: Implement gfx9 patch functions for resubmission drm/amdgpu: Modify indirect buffer packages for resubmission drm/amdgpu: Program gds backup address as zero if no gds allocated drm/nouveau: add nv_encoder pointer check for NULL drm/amdgpu: Reset CP_VMID_PREEMPT after trailing fence signaled drm/nouveau/dp: check for NULL nv_connector->native_mode drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow drm/nouveau: don't detect DSM for non-NVIDIA device accel/qaic: Fix NULL pointer deref in qaic_destroy_drm_device() ... commit ba00b190670809c1a89326d80de96d714f6004f2 Author: David Howells Date: Fri Jun 16 22:39:39 2023 +0100 afs: Fix vlserver probe RTT handling In the same spirit as commit ca57f02295f1 ("afs: Fix fileserver probe RTT handling"), don't rule out using a vlserver just because there haven't been enough packets yet to calculate a real rtt. Always set the server's probe rtt from the estimate provided by rxrpc_kernel_get_srtt, which is capped at 1 second. This could lead to EDESTADDRREQ errors when accessing a cell for the first time, even though the vl servers are known and have responded to a probe. Fixes: 1d4adfaf6574 ("rxrpc: Make rxrpc_kernel_get_srtt() indicate validity") Signed-off-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2023-June/006746.html Signed-off-by: Linus Torvalds commit 5b017b5ed2bccfdb9a26c8ddb89f093fb8f8a94c Merge: 858fd168a95c5 568a67e742dfa Author: Arnd Bergmann Date: Fri Jun 16 23:11:18 2023 +0200 Merge tag 'v6.4-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Fixes for the reset pin on nanopi r5c, a reset line on SOQuartz, a duplicate usb regulator on rock64 and PCIe register mappings on rk356x. Also some missing cache properties. * tag 'v6.4-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Fix rk356x PCIe register and range mappings arm64: dts: rockchip: fix button reset pin for nanopi r5c arm64: dts: rockchip: fix nEXTRST on SOQuartz arm64: dts: rockchip: add missing cache properties arm64: dts: rockchip: fix USB regulator on ROCK64 Link: https://lore.kernel.org/r/2885657.e9J7NaK4W3@phil Signed-off-by: Arnd Bergmann commit cd9125030689dda69f73f6c2843d63135cb383f0 Author: Azeem Shaikh Date: Tue Jun 13 00:33:25 2023 +0000 ieee802154: Replace strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since the return values from the helper macros are ignored by the callers. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Reviewed-by: Kees Cook Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230613003326.3538391-1-azeemshaikh38@gmail.com Signed-off-by: Stefan Schmidt commit 9930f518b6a82ff10a3d13e0cbde05cce04f5930 Merge: c8a5d5ea3ba6a 55b94bb8c4246 Author: Dave Airlie Date: Sat Jun 17 06:11:59 2023 +1000 Merge tag 'drm-misc-fixes-2023-06-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes maybe in time for v6.4-rc7: - qaic leak and null deref fix. - Fix runtime pm in nouveau. - Fix array overflow in ti-sn65dsi86 pwm chip handling. - Assorted null check fixes in nouveau. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/641eb8a8-fbd7-90ad-0805-310b7fec9344@lankhorst.se commit a128f9d4c1227dfcf7f2328070760cb7ed1ec08d Author: Leon Romanovsky Date: Mon Jun 5 11:09:52 2023 +0300 net/mlx5e: Fix scheduling of IPsec ASO query while in atomic ASO query can be scheduled in atomic context as such it can't use usleep. Use udelay as recommended in Documentation/timers/timers-howto.rst. Fixes: 76e463f6508b ("net/mlx5e: Overcome slow response for first IPsec ASO WQE") Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed commit c75b94255aaa45d9e531df2763baa67020bb6fa9 Author: Leon Romanovsky Date: Mon Jun 5 11:09:51 2023 +0300 net/mlx5e: Drop XFRM state lock when modifying flow steering XFRM state which is changed to be XFRM_STATE_EXPIRED doesn't really need to hold lock while modifying flow steering rules to drop traffic. That state can be deleted only and as such mlx5e_ipsec_handle_tx_limit() work will be canceled anyway and won't run in parallel. Fixes: b2f7b01d36a9 ("net/mlx5e: Simulate missing IPsec TX limits hardware functionality") Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed commit fef06678931ff67b158d337b581e5cf5ca40a3a3 Author: Patrisious Haddad Date: Mon Jun 5 11:09:50 2023 +0300 net/mlx5e: Fix ESN update kernel panic Previously during mlx5e_ipsec_handle_event the driver tried to execute an operation that could sleep, while holding a spinlock, which caused the kernel panic mentioned below. Move the function call that can sleep outside of the spinlock context. Call Trace: dump_stack_lvl+0x49/0x6c __schedule_bug.cold+0x42/0x4e schedule_debug.constprop.0+0xe0/0x118 __schedule+0x59/0x58a ? __mod_timer+0x2a1/0x3ef schedule+0x5e/0xd4 schedule_timeout+0x99/0x164 ? __pfx_process_timeout+0x10/0x10 __wait_for_common+0x90/0x1da ? __pfx_schedule_timeout+0x10/0x10 wait_func+0x34/0x142 [mlx5_core] mlx5_cmd_invoke+0x1f3/0x313 [mlx5_core] cmd_exec+0x1fe/0x325 [mlx5_core] mlx5_cmd_do+0x22/0x50 [mlx5_core] mlx5_cmd_exec+0x1c/0x40 [mlx5_core] mlx5_modify_ipsec_obj+0xb2/0x17f [mlx5_core] mlx5e_ipsec_update_esn_state+0x69/0xf0 [mlx5_core] ? wake_affine+0x62/0x1f8 mlx5e_ipsec_handle_event+0xb1/0xc0 [mlx5_core] process_one_work+0x1e2/0x3e6 ? __pfx_worker_thread+0x10/0x10 worker_thread+0x54/0x3ad ? __pfx_worker_thread+0x10/0x10 kthread+0xda/0x101 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x37 BUG: workqueue leaked lock or atomic: kworker/u256:4/0x7fffffff/189754#012 last function: mlx5e_ipsec_handle_event [mlx5_core] CPU: 66 PID: 189754 Comm: kworker/u256:4 Kdump: loaded Tainted: G W 6.2.0-2596.20230309201517_5.el8uek.rc1.x86_64 #2 Hardware name: Oracle Corporation ORACLE SERVER X9-2/ASMMBX9-2, BIOS 61070300 08/17/2022 Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_event [mlx5_core] Call Trace: dump_stack_lvl+0x49/0x6c process_one_work.cold+0x2b/0x3c ? __pfx_worker_thread+0x10/0x10 worker_thread+0x54/0x3ad ? __pfx_worker_thread+0x10/0x10 kthread+0xda/0x101 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x37 BUG: scheduling while atomic: kworker/u256:4/189754/0x00000000 Fixes: cee137a63431 ("net/mlx5e: Handle ESN update events") Signed-off-by: Patrisious Haddad Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed commit cf5bb02320d4c4cf4e827efc0314b6ca4082799c Author: Leon Romanovsky Date: Mon Jun 5 11:09:49 2023 +0300 net/mlx5e: Don't delay release of hardware objects XFRM core provides two callbacks to release resources, one is .xdo_dev_policy_delete() and another is .xdo_dev_policy_free(). This separation allows delayed release so "ip xfrm policy free" commands won't starve. Unfortunately, mlx5 command interface can't run in .xdo_dev_policy_free() callbacks as the latter runs in ATOMIC context. BUG: scheduling while atomic: swapper/7/0/0x00000100 Modules linked in: act_mirred act_tunnel_key cls_flower sch_ingress vxlan mlx5_vdpa vringh vhost_iotlb vdpa rpcrdma rdma_ucm ib_iser libiscsi ib_umad scsi_transport_iscsi rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_core zram zsmalloc fuse CPU: 7 PID: 0 Comm: swapper/7 Not tainted 6.3.0+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x33/0x50 __schedule_bug+0x4e/0x60 __schedule+0x5d5/0x780 ? __mod_timer+0x286/0x3d0 schedule+0x50/0x90 schedule_timeout+0x7c/0xf0 ? __bpf_trace_tick_stop+0x10/0x10 __wait_for_common+0x88/0x190 ? usleep_range_state+0x90/0x90 cmd_exec+0x42e/0xb40 [mlx5_core] mlx5_cmd_do+0x1e/0x40 [mlx5_core] mlx5_cmd_exec+0x18/0x30 [mlx5_core] mlx5_cmd_delete_fte+0xa8/0xd0 [mlx5_core] del_hw_fte+0x60/0x120 [mlx5_core] mlx5_del_flow_rules+0xec/0x270 [mlx5_core] ? default_send_IPI_single_phys+0x26/0x30 mlx5e_accel_ipsec_fs_del_pol+0x1a/0x60 [mlx5_core] mlx5e_xfrm_free_policy+0x15/0x20 [mlx5_core] xfrm_policy_destroy+0x5a/0xb0 xfrm4_dst_destroy+0x7b/0x100 dst_destroy+0x37/0x120 rcu_core+0x2d6/0x540 __do_softirq+0xcd/0x273 irq_exit_rcu+0x82/0xb0 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 RIP: 0010:default_idle+0x13/0x20 Code: c0 08 00 00 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 72 ff ff ff cc cc cc cc 8b 05 7a 4d ee 00 85 c0 7e 07 0f 00 2d 2f 98 2e 00 fb f4 c3 66 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 04 25 40 b4 02 00 RSP: 0018:ffff888100843ee0 EFLAGS: 00000242 RAX: 0000000000000001 RBX: ffff888100812b00 RCX: 4000000000000000 RDX: 0000000000000001 RSI: 0000000000000083 RDI: 000000000002d2ec RBP: 0000000000000007 R08: 00000021daeded59 R09: 0000000000000001 R10: 0000000000000000 R11: 000000000000000f R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 default_idle_call+0x30/0xb0 do_idle+0x1c1/0x1d0 cpu_startup_entry+0x19/0x20 start_secondary+0xfe/0x120 secondary_startup_64_no_verify+0xf3/0xfb bad: scheduling from the idle thread! Fixes: a5b8ca9471d3 ("net/mlx5e: Add XFRM policy offload logic") Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed commit 314ded538e5f22e7610b1bf621402024a180ec80 Author: Saeed Mahameed Date: Thu Jun 8 12:00:54 2023 -0700 net/mlx5: Free IRQ rmap and notifier on kernel shutdown The kernel IRQ system needs the irq affinity notifier to be clear before attempting to free the irq, see WARN_ON log below. On a normal driver unload we don't have this issue since we do the complete cleanup of the irq resources. To fix this, put the important resources cleanup in a helper function and use it in both normal driver unload and shutdown flows. [ 4497.498434] ------------[ cut here ]------------ [ 4497.498726] WARNING: CPU: 0 PID: 9 at kernel/irq/manage.c:2034 free_irq+0x295/0x340 [ 4497.499193] Modules linked in: [ 4497.499386] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.4.0-rc4+ #10 [ 4497.499876] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 [ 4497.500518] Workqueue: events do_poweroff [ 4497.500849] RIP: 0010:free_irq+0x295/0x340 [ 4497.501132] Code: 85 c0 0f 84 1d ff ff ff 48 89 ef ff d0 0f 1f 00 e9 10 ff ff ff 0f 0b e9 72 ff ff ff 49 8d 7f 28 ff d0 0f 1f 00 e9 df fd ff ff <0f> 0b 48 c7 80 c0 008 [ 4497.502269] RSP: 0018:ffffc90000053da0 EFLAGS: 00010282 [ 4497.502589] RAX: ffff888100949600 RBX: ffff88810330b948 RCX: 0000000000000000 [ 4497.503035] RDX: ffff888100949600 RSI: ffff888100400490 RDI: 0000000000000023 [ 4497.503472] RBP: ffff88810330c7e0 R08: ffff8881004005d0 R09: ffffffff8273a260 [ 4497.503923] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881009ae000 [ 4497.504359] R13: ffff8881009ae148 R14: 0000000000000000 R15: ffff888100949600 [ 4497.504804] FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 [ 4497.505302] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4497.505671] CR2: 00007fce98806298 CR3: 000000000262e005 CR4: 0000000000370ef0 [ 4497.506104] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4497.506540] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4497.507002] Call Trace: [ 4497.507158] [ 4497.507299] ? free_irq+0x295/0x340 [ 4497.507522] ? __warn+0x7c/0x130 [ 4497.507740] ? free_irq+0x295/0x340 [ 4497.507963] ? report_bug+0x171/0x1a0 [ 4497.508197] ? handle_bug+0x3c/0x70 [ 4497.508417] ? exc_invalid_op+0x17/0x70 [ 4497.508662] ? asm_exc_invalid_op+0x1a/0x20 [ 4497.508926] ? free_irq+0x295/0x340 [ 4497.509146] mlx5_irq_pool_free_irqs+0x48/0x90 [ 4497.509421] mlx5_irq_table_free_irqs+0x38/0x50 [ 4497.509714] mlx5_core_eq_free_irqs+0x27/0x40 [ 4497.509984] shutdown+0x7b/0x100 [ 4497.510184] pci_device_shutdown+0x30/0x60 [ 4497.510440] device_shutdown+0x14d/0x240 [ 4497.510698] kernel_power_off+0x30/0x70 [ 4497.510938] process_one_work+0x1e6/0x3e0 [ 4497.511183] worker_thread+0x49/0x3b0 [ 4497.511407] ? __pfx_worker_thread+0x10/0x10 [ 4497.511679] kthread+0xe0/0x110 [ 4497.511879] ? __pfx_kthread+0x10/0x10 [ 4497.512114] ret_from_fork+0x29/0x50 [ 4497.512342] Fixes: 9c2d08010963 ("net/mlx5: Free irqs only on shutdown callback") Signed-off-by: Saeed Mahameed Reviewed-by: Shay Drory commit ef4c5afc783dc3d47640270a9b94713229c697e8 Author: Yevgeny Kliteynik Date: Sun Jun 4 21:07:04 2023 +0300 net/mlx5: DR, Fix wrong action data allocation in decap action When TUNNEL_L3_TO_L2 decap action was created, a pointer to a local variable was passed as its HW action data, resulting in attempt to free invalid address: BUG: KASAN: invalid-free in mlx5dr_action_destroy+0x318/0x410 [mlx5_core] Fixes: 4781df92f4da ("net/mlx5: DR, Move STEv0 modify header logic") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 87cd0649176c0588daf2cad53058143f808b0905 Author: Yevgeny Kliteynik Date: Mon Jun 12 01:05:48 2023 +0300 net/mlx5: DR, Support SW created encap actions for FW table In some cases, steering might need to use SW-created action in FW table, which results in wrong packet reformat being used: mlx5_core 0000:81:00.1: mlx5_cmd_check:756:(pid 1154): SET_FLOW_TABLE_ENTRY(0×936) op_mod(0×0) failed, status bad resource(0×5), syndrome (0xf2ff71) This patch adds support for usage of SW-created packet reformat (encap) actions in FW tables, and adds clear error flow for attempt to use SW-created modify header on FW tables. Fixes: 6a48faeeca10 ("net/mlx5: Add direct rule fs_cmd implementation") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Erez Shitrit Signed-off-by: Saeed Mahameed commit fb7be476ab7e797b18c6f0047041635c41b3b5a4 Author: Chris Mi Date: Thu Apr 6 09:38:09 2023 +0300 net/mlx5e: TC, Cleanup ct resources for nic flow The cited commit removes special handling of CT action. But it removes too much. Pre ct/ct_nat tables and some other resources are not destroyed due to the cited commit. Fix it by adding it back. Fixes: 08fe94ec5f77 ("net/mlx5e: TC, Remove special handling of CT action") Signed-off-by: Chris Mi Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit b100573ab76ee5b0cb8f9129b568d9e7da795f76 Author: Chris Mi Date: Tue Apr 11 11:17:35 2023 +0300 net/mlx5e: TC, Add null pointer check for hardware miss support The cited commits add hardware miss support to tc action. But if the rules can't be offloaded, the pointers are null and system will panic when accessing them. Fix it by checking null pointer. Fixes: 08fe94ec5f77 ("net/mlx5e: TC, Remove special handling of CT action") Fixes: 6702782845a5 ("net/mlx5e: TC, Set CT miss to the specific ct action instance") Signed-off-by: Chris Mi Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 0ab999d4a1bfe8251538be1e7e495c50433475a8 Author: Eli Cohen Date: Wed May 3 15:10:05 2023 +0300 net/mlx5: Fix driver load with single msix vector When a PCI device has just one msix vector available, we want to share this vector between async and completion events. Current code fails to do that assuming it will always have at least one dedicated vector for completion events. Fix this by detecting when the pool contains just a single vector. Fixes: 3354822cde5a ("net/mlx5: Use dynamic msix vectors allocation") Signed-off-by: Eli Cohen Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 62a522d3354d81a86dd56feeb40e5ced36d72737 Author: Maxim Mikityanskiy Date: Wed Jun 14 12:00:06 2023 +0300 net/mlx5e: xsk: Set napi_id to support busy polling on XSK RQ The cited commit missed setting napi_id on XSK RQs, it only affected regular RQs. Add the missing part to support socket busy polling on XSK RQs. Fixes: a2740f529da2 ("net/mlx5e: xsk: Set napi_id to support busy polling") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 4e7401fc8c8d048a813e0221a706be84182a76c1 Author: Maxim Mikityanskiy Date: Wed Jun 14 12:00:05 2023 +0300 net/mlx5e: XDP, Allow growing tail for XDP multi buffer The cited commits missed passing frag_size to __xdp_rxq_info_reg, which is required by bpf_xdp_adjust_tail to support growing the tail pointer in fragmented packets. Pass the missing parameter when the current RQ mode allows XDP multi buffer. Fixes: ea5d49bdae8b ("net/mlx5e: Add XDP multi buffer support to the non-linear legacy RQ") Fixes: 9cb9482ef10e ("net/mlx5e: Use fragments of the same size in non-linear legacy RQ with XDP") Signed-off-by: Maxim Mikityanskiy Cc: Tariq Toukan Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 4973ca29552864a7a047ab8a15611a585827412f Merge: b9c1133a44a9b b50f2d048ecf1 Author: Linus Torvalds Date: Fri Jun 16 12:41:56 2023 -0700 Merge tag 'for-6.4-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Two fixes for NOCOW files, a regression fix in scrub and an assertion fix: - NOCOW fixes: - keep length of iomap direct io request in case of a failure - properly pass mode of extent reference checking, this can break some cases for swapfile - fix error value confusion when scrubbing a stripe - convert assertion to a proper error handling when loading global roots, reported by syzbot" * tag 'for-6.4-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: scrub: fix a return value overwrite in scrub_stripe() btrfs: do not ASSERT() on duplicated global roots btrfs: can_nocow_file_extent should pass down args->strict from callers btrfs: fix iomap_begin length for nocow writes commit b9c1133a44a9b1dc485c79c64c8dee51e8869229 Merge: 3a12faba95f99 20cb1c2fb7568 Author: Linus Torvalds Date: Fri Jun 16 12:32:32 2023 -0700 Merge tag 'block-6.4-2023-06-15' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "Just a single fix for blk-cg stats flushing" * tag 'block-6.4-2023-06-15' of git://git.kernel.dk/linux: blk-cgroup: Flush stats before releasing blkcg_gq commit 3a12faba95f99d166a18588fa9b2b2df99eb1146 Merge: b4af682124c5b adeaa3f290ecf Author: Linus Torvalds Date: Fri Jun 16 12:27:20 2023 -0700 Merge tag 'io_uring-6.4-2023-06-15' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "A fix for sendmsg with CMSG, and the followup fix discussed for avoiding touching task->worker_private after the worker has started exiting" * tag 'io_uring-6.4-2023-06-15' of git://git.kernel.dk/linux: io_uring/io-wq: clear current->worker_private on exit io_uring/net: save msghdr->msg_control for retries commit b4af682124c5b892f554d7fa4d21216530d8da4b Merge: b73056e9f82eb 227d2c3154a93 Author: Linus Torvalds Date: Fri Jun 16 12:18:35 2023 -0700 Merge tag 'sound-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just a few small fixes. The only change to the core code is for a minor race in ALSA OSS sequencer, and the rest are all device-specific fixes (regression fixes and a usual quirk)" * tag 'sound-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD playback ALSA: usb-audio: Fix broken resume due to UAC3 power state ALSA: seq: oss: Fix racy open/close of MIDI devices ASoC: tegra: Fix Master Volume Control ALSA: hda/realtek: Add a quirk for Compaq N14JP6 firmware: cs_dsp: Log correct region name in bin error messages commit d082d48737c75d2b3cc1f972b8c8674c25131534 Author: Lee Jones Date: Wed Jun 14 17:38:54 2023 +0100 x86/mm: Avoid using set_pgd() outside of real PGD pages KPTI keeps around two PGDs: one for userspace and another for the kernel. Among other things, set_pgd() contains infrastructure to ensure that updates to the kernel PGD are reflected in the user PGD as well. One side-effect of this is that set_pgd() expects to be passed whole pages. Unfortunately, init_trampoline_kaslr() passes in a single entry: 'trampoline_pgd_entry'. When KPTI is on, set_pgd() will update 'trampoline_pgd_entry' (an 8-Byte globally stored [.bss] variable) and will then proceed to replicate that value into the non-existent neighboring user page (located +4k away), leading to the corruption of other global [.bss] stored variables. Fix it by directly assigning 'trampoline_pgd_entry' and avoiding set_pgd(). [ dhansen: tweak subject and changelog ] Fixes: 0925dda5962e ("x86/mm/KASLR: Use only one PUD entry for real mode trampoline") Suggested-by: Dave Hansen Signed-off-by: Lee Jones Signed-off-by: Dave Hansen Cc: Link: https://lore.kernel.org/all/20230614163859.924309-1-lee@kernel.org/g commit 13bb06f8dd42071cb9a49f6e21099eea05d4b856 Author: Thomas Gleixner Date: Thu Jun 15 11:18:30 2023 +0200 tick/common: Align tick period during sched_timer setup The tick period is aligned very early while the first clock_event_device is registered. At that point the system runs in periodic mode and switches later to one-shot mode if possible. The next wake-up event is programmed based on the aligned value (tick_next_period) but the delta value, that is used to program the clock_event_device, is computed based on ktime_get(). With the subtracted offset, the device fires earlier than the exact time frame. With a large enough offset the system programs the timer for the next wake-up and the remaining time left is too small to make any boot progress. The system hangs. Move the alignment later to the setup of tick_sched timer. At this point the system switches to oneshot mode and a high resolution clocksource is available. At this point it is safe to align tick_next_period because ktime_get() will now return accurate (not jiffies based) time. [bigeasy: Patch description + testing]. Fixes: e9523a0d81899 ("tick/common: Align tick period with the HZ tick.") Reported-by: Mathias Krause Reported-by: "Bhatnagar, Rishabh" Suggested-by: Mathias Krause Signed-off-by: Thomas Gleixner Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Tested-by: Richard W.M. Jones Tested-by: Mathias Krause Acked-by: SeongJae Park Cc: stable@vger.kernel.org Link: https://lore.kernel.org/5a56290d-806e-b9a5-f37c-f21958b5a8c0@grsecurity.net Link: https://lore.kernel.org/12c6f9a3-d087-b824-0d05-0d18c9bc1bf3@amazon.com Link: https://lore.kernel.org/r/20230615091830.RxMV2xf_@linutronix.de commit b73056e9f82ebdf9f5dbcd378e5e51ae95d5000c Merge: f4fd69a325510 de29a96acceae Author: Linus Torvalds Date: Fri Jun 16 11:43:15 2023 -0700 Merge tag 'urgent-rcu.2023.06.11a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU fix from Paul McKenney: "This fixes a spinlock-initialization regression in SRCU that causes the SRCU notifier to fail. The fix simply adds the initialization, but introduces a #ifdef because there is no spinlock to initialize for the Tiny SRCU used in !SMP builds. Yes, it would be nice to abstract this somehow in order to hide it in SRCU, but I still don't see a good way of doing this" * tag 'urgent-rcu.2023.06.11a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: notifier: Initialize new struct srcu_usage field commit f4fd69a32551036ac84bf4487b680167df77477d Merge: 40f71e7cd3c6a b104dbedbe61d Author: Linus Torvalds Date: Fri Jun 16 11:27:34 2023 -0700 Merge tag 'riscv-for-linus-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fix from Palmer Dabbelt: - A documentation patch describing how we use patchwork * tag 'riscv-for-linus-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: Documentation: RISC-V: patch-acceptance: mention patchwork's role commit b9f174c811e3ae4ae8959dc57e6adb9990e913f4 Author: Omar Sandoval Date: Tue Jun 13 14:14:56 2023 -0700 x86/unwind/orc: Add ELF section with ORC version identifier Commits ffb1b4a41016 ("x86/unwind/orc: Add 'signal' field to ORC metadata") and fb799447ae29 ("x86,objtool: Split UNWIND_HINT_EMPTY in two") changed the ORC format. Although ORC is internal to the kernel, it's the only way for external tools to get reliable kernel stack traces on x86-64. In particular, the drgn debugger [1] uses ORC for stack unwinding, and these format changes broke it [2]. As the drgn maintainer, I don't care how often or how much the kernel changes the ORC format as long as I have a way to detect the change. It suffices to store a version identifier in the vmlinux and kernel module ELF files (to use when parsing ORC sections from ELF), and in kernel memory (to use when parsing ORC from a core dump+symbol table). Rather than hard-coding a version number that needs to be manually bumped, Peterz suggested hashing the definitions from orc_types.h. If there is a format change that isn't caught by this, the hashing script can be updated. This patch adds an .orc_header allocated ELF section containing the 20-byte hash to vmlinux and kernel modules, along with the corresponding __start_orc_header and __stop_orc_header symbols in vmlinux. 1: https://github.com/osandov/drgn 2: https://github.com/osandov/drgn/issues/303 Fixes: ffb1b4a41016 ("x86/unwind/orc: Add 'signal' field to ORC metadata") Fixes: fb799447ae29 ("x86,objtool: Split UNWIND_HINT_EMPTY in two") Signed-off-by: Omar Sandoval Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://lkml.kernel.org/r/aef9c8dc43915b886a8c48509a12ec1b006ca1ca.1686690801.git.osandov@osandov.com commit a6742cb90b567f952a95efa27dee345748d09fc7 Author: Kan Liang Date: Thu Jun 15 10:32:42 2023 -0700 perf/x86/intel: Fix the FRONTEND encoding on GNR and MTL When counting a FRONTEND event, the MSR_PEBS_FRONTEND is not correctly set on GNR and MTL p-core. The umask value for the FRONTEND events is changed on GNR and MTL. The new umask is missing in the extra_regs[] table. Add a dedicated intel_gnr_extra_regs[] for GNR and MTL p-core. Fixes: bc4000fdb009 ("perf/x86/intel: Add Granite Rapids") Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20230615173242.3726364-1-kan.liang@linux.intel.com commit b50f26a44887f3f71ff5457135ee1d5f1d542d7d Author: Marc Zyngier Date: Fri Jun 16 12:48:31 2023 +0100 perf/core: Drop __weak attribute from arch_perf_update_userpage() prototype Reiji reports that the arm64 implementation of arch_perf_update_userpage() is now ignored and replaced by the dummy stub in core code. This seems to happen since the PMUv3 driver was moved to driver/perf. As it turns out, dropping the __weak attribute from the *prototype* of the function solves the problem. You're right, this doesn't seem to make much sense. And yet... It appears that both symbols get flagged as weak, and that the first one to appear in the link order wins: $ nm drivers/perf/arm_pmuv3.o|grep arch_perf_update_userpage 0000000000001db0 W arch_perf_update_userpage Dropping the attribute from the prototype restores the expected behaviour, and arm64 is able to enjoy arch_perf_update_userpage() again. Fixes: 7755cec63ade ("arm64: perf: Move PMUv3 driver to drivers/perf") Fixes: f1ec3a517b43 ("kernel/events: Add a missing prototype for arch_perf_update_userpage()") Reported-by: Reiji Watanabe Signed-off-by: Marc Zyngier Signed-off-by: Peter Zijlstra (Intel) Acked-by: Mark Rutland Tested-by: Reiji Watanabe Link: https://lkml.kernel.org/r/20230616114831.3186980-1-maz@kernel.org commit 5b00369fcf6d1ff9050b94800dc596925ff3623f Author: Su Hui Date: Thu Jun 8 10:19:34 2023 +0800 iommu/amd: Fix possible memory leak of 'domain' Move allocation code down to avoid memory leak. Fixes: 29f54745f245 ("iommu/amd: Add missing domain type checks") Signed-off-by: Su Hui Reviewed-by: Jason Gunthorpe Reviewed-by: Jerry Snitselaar Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20230608021933.856045-1-suhui@nfschina.com Signed-off-by: Joerg Roedel commit f015b900bc3285322029b4a7d132d6aeb0e51857 Author: Sebastian Andrzej Siewior Date: Wed Jun 14 12:02:02 2023 +0200 xfrm: Linearize the skb after offloading if needed. With offloading enabled, esp_xmit() gets invoked very late, from within validate_xmit_xfrm() which is after validate_xmit_skb() validates and linearizes the skb if the underlying device does not support fragments. esp_output_tail() may add a fragment to the skb while adding the auth tag/ IV. Devices without the proper support will then send skb->data points to with the correct length so the packet will have garbage at the end. A pcap sniffer will claim that the proper data has been sent since it parses the skb properly. It is not affected with INET_ESP_OFFLOAD disabled. Linearize the skb after offloading if the sending hardware requires it. It was tested on v4, v6 has been adopted. Fixes: 7785bba299a8d ("esp: Add a software GRO codepath") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Steffen Klassert commit 227d2c3154a93f424503d3e4b7e157288848cf1b Merge: 122e2cb7e1a30 f9fd804aa0a36 Author: Takashi Iwai Date: Fri Jun 16 09:28:27 2023 +0200 Merge tag 'asoc-fix-v6.4-rc6-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.4 A couple more fixes for v6.4, one fixing a misleading error log and another stopping us seeing spurious failures setting the master volume on some Tegra systems introduced by a change to how we calculate delay times. commit 122e2cb7e1a30438cc0e8bf70d4279db245d7d5b Author: Lukasz Tyl Date: Wed Jun 14 14:25:24 2023 +0200 ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD playback This commit adds new DEVICE_FLG with QUIRK_FLAG_DSD_RAW and Vendor Id for HEM devices which supports native DSD. Prior to this change Linux kernel was not enabling native DSD playback for HEM devices, and as a result, DSD audio was being converted to PCM "on the fly". HEM devices, when connected to the system, would only play audio in PCM format, even if the source material was in DSD format. With the addition of new VENDOR_FLG in the quircks.c file, the devices are now correctly recognized, and raw DSD data is transmitted to the device, allowing for native DSD playback. Signed-off-by: Lukasz Tyl Cc: Link: https://lore.kernel.org/r/20230614122524.30271-1-ltyl@hem-e.com Signed-off-by: Takashi Iwai commit 8ba61c9f6c9bdfbf9d197b0282641d24ae909778 Author: Takashi Iwai Date: Mon Jun 12 15:28:18 2023 +0200 ALSA: usb-audio: Fix broken resume due to UAC3 power state As reported in the bugzilla below, the PM resume of a UAC3 device may fail due to the incomplete power state change, stuck at D1. The reason is that the driver expects the full D0 power state change only at hw_params, while the normal PCM resume procedure doesn't call hw_params. For fixing the bug, we add the same power state update to D0 at the prepare callback, which is certainly called by the resume procedure. Note that, with this change, the power state change in the hw_params becomes almost redundant, since snd_usb_hw_params() doesn't touch the parameters (at least it tires so). But dropping it is still a bit risky (e.g. we have the media-driver binding), so I leave the D0 power state change in snd_usb_hw_params() as is for now. Fixes: a0a4959eb4e9 ("ALSA: usb-audio: Operate UAC3 Power Domains in PCM callbacks") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=217539 Link: https://lore.kernel.org/r/20230612132818.29486-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 297224fc0922e7385573a30c29ffdabb67f27b7d Author: Takashi Iwai Date: Mon Jun 12 14:55:33 2023 +0200 ALSA: seq: oss: Fix racy open/close of MIDI devices Although snd_seq_oss_midi_open() and snd_seq_oss_midi_close() can be called concurrently from different code paths, we have no proper data protection against races. Introduce open_mutex to each seq_oss_midi object for avoiding the races. Reported-by: "Gong, Sishuai" Closes: https://lore.kernel.org/r/7DC9AF71-F481-4ABA-955F-76C535661E33@purdue.edu Link: https://lore.kernel.org/r/20230612125533.27461-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d4e067287b41b9eba278533d32afda35b25fbdd5 Merge: 40f71e7cd3c6a d7a2fc1437f71 Author: Jakub Kicinski Date: Thu Jun 15 22:24:03 2023 -0700 Merge branch 'check-if-fips-mode-is-enabled-when-running-selftests' Magali Lemes says: ==================== Check if FIPS mode is enabled when running selftests Some test cases from net/tls, net/fcnal-test and net/vrf-xfrm-tests that rely on cryptographic functions to work and use non-compliant FIPS algorithms fail in FIPS mode. In order to allow these tests to pass in a wider set of kernels, - for net/tls, skip the test variants that use the ChaCha20-Poly1305 and SM4 algorithms, when FIPS mode is enabled; - for net/fcnal-test, skip the MD5 tests, when FIPS mode is enabled; - for net/vrf-xfrm-tests, replace the algorithms that are not FIPS-compliant with compliant ones. v1: https://lore.kernel.org/netdev/20230607174302.19542-1-magali.lemes@canonical.com/ v2: https://lore.kernel.org/netdev/20230609164324.497813-1-magali.lemes@canonical.com/ v3: https://lore.kernel.org/netdev/20230612125107.73795-1-magali.lemes@canonical.com/ ==================== Link: https://lore.kernel.org/r/20230613123222.631897-1-magali.lemes@canonical.com Signed-off-by: Jakub Kicinski commit d7a2fc1437f71cb058c7b11bc33dfc19e4bf277a Author: Magali Lemes Date: Tue Jun 13 09:32:22 2023 -0300 selftests: net: fcnal-test: check if FIPS mode is enabled There are some MD5 tests which fail when the kernel is in FIPS mode, since MD5 is not FIPS compliant. Add a check and only run those tests if FIPS mode is not enabled. Fixes: f0bee1ebb5594 ("fcnal-test: Add TCP MD5 tests") Fixes: 5cad8bce26e01 ("fcnal-test: Add TCP MD5 tests for VRF") Reviewed-by: David Ahern Signed-off-by: Magali Lemes Signed-off-by: Jakub Kicinski commit cb43c60e64ca67fcc9d23bd08f51d2ab8209d9d7 Author: Magali Lemes Date: Tue Jun 13 09:32:21 2023 -0300 selftests: net: vrf-xfrm-tests: change authentication and encryption algos The vrf-xfrm-tests tests use the hmac(md5) and cbc(des3_ede) algorithms for performing authentication and encryption, respectively. This causes the tests to fail when fips=1 is set, since these algorithms are not allowed in FIPS mode. Therefore, switch from hmac(md5) and cbc(des3_ede) to hmac(sha1) and cbc(aes), which are FIPS compliant. Fixes: 3f251d741150 ("selftests: Add tests for vrf and xfrms") Reviewed-by: David Ahern Signed-off-by: Magali Lemes Signed-off-by: Jakub Kicinski commit d113c395c67b62fc0d3f2004c0afc406aca0a2b7 Author: Magali Lemes Date: Tue Jun 13 09:32:20 2023 -0300 selftests: net: tls: check if FIPS mode is enabled TLS selftests use the ChaCha20-Poly1305 and SM4 algorithms, which are not FIPS compliant. When fips=1, this set of tests fails. Add a check and only run these tests if not in FIPS mode. Fixes: 4f336e88a870 ("selftests/tls: add CHACHA20-POLY1305 to tls selftests") Fixes: e506342a03c7 ("selftests/tls: add SM4 GCM/CCM to tls selftests") Reviewed-by: Jakub Kicinski Signed-off-by: Magali Lemes Signed-off-by: Jakub Kicinski commit 372b304c1e517c4d3e5b6ca6c9cfb20f027c3b03 Author: Magali Lemes Date: Tue Jun 13 09:32:19 2023 -0300 selftests/harness: allow tests to be skipped during setup Before executing each test from a fixture, FIXTURE_SETUP is run once. When SKIP is used in FIXTURE_SETUP, the setup function returns early but the test still proceeds to run, unless another SKIP macro is used within the test definition, leading to some code repetition. Therefore, allow tests to be skipped directly from the setup function. Suggested-by: Jakub Kicinski Signed-off-by: Magali Lemes Signed-off-by: Jakub Kicinski commit 40f71e7cd3c6ac04293556ab0504a372393838ff Merge: 627d858674f54 8f0e3703571fe Author: Linus Torvalds Date: Thu Jun 15 21:11:17 2023 -0700 Merge tag 'net-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless, and netfilter. Selftests excluded - we have 58 patches and diff of +442/-199, which isn't really small but perhaps with the exception of the WiFi locking change it's old(ish) bugs. We have no known problems with v6.4. The selftest changes are rather large as MPTCP folks try to apply Greg's guidance that selftest from torvalds/linux should be able to run against stable kernels. Last thing I should call out is the DCCP/UDP-lite deprecation notices. We are fairly sure those are dead, but if we're wrong reverting them back in won't be fun. Current release - regressions: - wifi: - cfg80211: fix double lock bug in reg_wdev_chan_valid() - iwlwifi: mvm: spin_lock_bh() to fix lockdep regression Current release - new code bugs: - handshake: remove fput() that causes use-after-free Previous releases - regressions: - sched: cls_u32: fix reference counter leak leading to overflow - sched: cls_api: fix lockup on flushing explicitly created chain Previous releases - always broken: - nf_tables: integrate pipapo into commit protocol - nf_tables: incorrect error path handling with NFT_MSG_NEWRULE, fix dangling pointer on failure - ping6: fix send to link-local addresses with VRF - sched: act_pedit: parse L3 header for L4 offset, the skb may not have the offset saved - sched: act_ct: fix promotion of offloaded unreplied tuple - sched: refuse to destroy an ingress and clsact Qdiscs if there are lockless change operations in flight - wifi: mac80211: fix handful of bugs in multi-link operation - ipvlan: fix bound dev checking for IPv6 l3s mode - eth: enetc: correct the indexes of highest and 2nd highest TCs - eth: ice: fix XDP memory leak when NIC is brought up and down Misc: - add deprecation notices for UDP-lite and DCCP - selftests: mptcp: skip tests not supported by old kernels - sctp: handle invalid error codes without calling BUG()" * tag 'net-6.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (91 commits) dccp: Print deprecation notice. udplite: Print deprecation notice. octeon_ep: Add missing check for ioremap selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET net: ethernet: stmicro: stmmac: fix possible memory leak in __stmmac_open net: tipc: resize nlattr array to correct size sfc: fix XDP queues mode with legacy IRQ net: macsec: fix double free of percpu stats net: lapbether: only support ethernet devices MAINTAINERS: add reviewers for SMC Sockets s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit() net: dsa: felix: fix taprio guard band overflow at 10Mbps with jumbo frames net/sched: cls_api: Fix lockup on flushing explicitly created chain ice: Fix ice module unload net/handshake: remove fput() that causes use-after-free selftests: forwarding: hw_stats_l3: Set addrgenmode in a separate step net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs net/sched: act_ct: Fix promotion of offloaded unreplied tuple wifi: iwlwifi: mvm: spin_lock_bh() to fix lockdep regression ... commit 627d858674f54f585b5dc82529f629fb8d0f85b4 Merge: 0e306952d7151 41efbb682de12 Author: Linus Torvalds Date: Thu Jun 15 20:56:39 2023 -0700 Merge tag 'loongarch-fixes-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Some trivial bug fixes for v6.4-rc7" * tag 'loongarch-fixes-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Fix debugfs_create_dir() error checking LoongArch: Avoid uninitialized alignment_mask LoongArch: Fix perf event id calculation LoongArch: Fix the write_fcsr() macro LoongArch: Let pmd_present() return true when splitting pmd commit 0e306952d7151afdaa16e9acf280a739d1fe7b29 Merge: 93fd8eb053800 be04c14a1bd26 Author: Linus Torvalds Date: Thu Jun 15 20:19:21 2023 -0700 Merge tag 'for-6.4/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM thinp discard performance regression introduced during this merge window where DM core was splitting large discards every 128K (max_sectors_kb) rather than every 64M (discard_max_bytes). - Extend DM core LOCKFS fix, made during 6.4 merge, to also fix race between do_mount and dm's do_suspend (in addition to the earlier fix's do_mount race with dm's do_resume). - Fix DM thin metadata operations to first check if the thin-pool is in "fail_io" mode; otherwise UAF can occur. - Fix DM thinp's call to __blkdev_issue_discard to use GFP_NOIO rather than GFP_NOWAIT (__blkdev_issue_discard cannot handle NULL return from bio_alloc). * tag 'for-6.4/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: use op specific max_sectors when splitting abnormal io dm thin: fix issue_discard to pass GFP_NOIO to __blkdev_issue_discard dm thin metadata: check fail_io before using data_sm dm: don't lock fs when the map is NULL during suspend or resume commit 93fd8eb053800a241d09c00ef075cae0b5b03ecf Merge: b7feaa490b3dd 0c7e314a63526 Author: Linus Torvalds Date: Thu Jun 15 20:13:56 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "This is an unusually large bunch of bug fixes for the later rc cycle, rxe and mlx5 both dumped a lot of things at once. rxe continues to fix itself, and mlx5 is fixing a bunch of "queue counters" related bugs. There is one highly notable bug fix regarding the qkey. This small security check was missed in the original 2005 implementation and it allows some significant issues. Summary: - Two rtrs bug fixes for error unwind bugs - Several rxe bug fixes: * Incorrect Rx packet validation * Using memory without a refcount * Syzkaller found use before initialization * Regression fix for missing locking with the tasklet conversion from this merge window - Have bnxt report the correct link properties to userspace, this was a regression in v6.3 - Several mlx5 bug fixes: * Kernel crash triggerable by userspace for the RAW ethernet profile * Defend against steering refcounting issues created by userspace * Incorrect change of QP port affinity parameters in some LAG configurations - Fix mlx5 Q counters: * Do not over allocate Q counters to allow userspace to use the full port capacity * Kernel crash triggered by eswitch due to mis-use of Q counters * Incorrect mlx5_device for Q counters in some LAG configurations - Properly implement the IBA spec restricting privileged qkeys to root - Always an error when reading from a disassociated device's event queue - isert bug fixes: * Avoid a deadlock with the CM handler and CM ID destruction * Correct list corruption due to incorrect locking * Fix a use after free around connection tear down" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/rxe: Fix rxe_cq_post IB/isert: Fix incorrect release of isert connection IB/isert: Fix possible list corruption in CMA handler IB/isert: Fix dead lock in ib_isert RDMA/mlx5: Fix affinity assignment IB/uverbs: Fix to consider event queue closing also upon non-blocking mode RDMA/uverbs: Restrict usage of privileged QKEYs RDMA/cma: Always set static rate to 0 for RoCE RDMA/mlx5: Fix Q-counters query in LAG mode RDMA/mlx5: Remove vport Q-counters dependency on normal Q-counters RDMA/mlx5: Fix Q-counters per vport allocation RDMA/mlx5: Create an indirect flow table for steering anchor RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions RDMA/rxe: Fix the use-before-initialization error of resp_pkts RDMA/bnxt_re: Fix reporting active_{speed,width} attributes RDMA/rxe: Fix ref count error in check_rkey() RDMA/rxe: Fix packet length checks RDMA/rtrs: Fix rxe_dealloc_pd warning RDMA/rtrs: Fix the last iu->buf leak in err path commit b7feaa490b3ddeed8801ead5e92e647439ce9e65 Merge: eee71c3473e68 eee4369921750 Author: Linus Torvalds Date: Thu Jun 15 20:03:15 2023 -0700 Merge tag 'spi-fix-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few more driver specific fixes. The DesignWare fix is for an issue introduced by conversion to the chip select accessor functions and is pretty important but the other two are less severe" * tag 'spi-fix-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dw: Replace incorrect spi_get_chipselect with set spi: fsl-dspi: avoid SCK glitches with continuous transfers spi: cadence-quadspi: Add missing check for dma_set_mask commit eee71c3473e6830e8e20017b2429bcd83e1fce9b Merge: 231a1e31574e3 b00de0000a695 Author: Linus Torvalds Date: Thu Jun 15 19:54:58 2023 -0700 Merge tag 'regulator-fix-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "The set of regulators described for the Qualcomm PM8550 just seems to have been completely wrong and would likely not have worked at all if anything tried to actually configure anything except for enabling and disabling at runtime" * tag 'regulator-fix-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: qcom-rpmh: Fix regulators for PM8550 commit 231a1e31574e3584cd2c297c98a5afb364715b3a Merge: c926a55f650ce 44e46572f0bae Author: Linus Torvalds Date: Thu Jun 15 19:50:57 2023 -0700 Merge tag 'regmap-fix-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "Another fix for the maple tree cache, Takashi noticed that unlike other caches the maple tree cache didn't check for read only registers before trying to sync which would result in spurious syncs for read only registers where we don't have a default. This was due to the check being open coded in the caches, we now check in the shared 'does this register need sync' function so that is fixed for this and future caches" * tag 'regmap-fix-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: regcache: Don't sync read-only registers commit c926a55f650ce58eae33cda504d50ac1837d53fd Merge: 62d8779610bb7 ec21a38df77a5 Author: Linus Torvalds Date: Thu Jun 15 19:13:45 2023 -0700 Merge tag 'media/v6.4-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "A fix for dvb-core to avoid a race condition during DVB board registration" * tag 'media/v6.4-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: Revert "media: dvb-core: Fix use-after-free on race condition at dvb_frontend" commit c8a5d5ea3ba6a18958f8d76430e4cd68eea33943 Author: Dave Airlie Date: Thu Jun 15 12:22:11 2023 +1000 nouveau: fix client work fence deletion race This seems to have existed for ever but is now more apparant after commit 9bff18d13473 ("drm/ttm: use per BO cleanup workers") My analysis: two threads are running, one in the irq signalling the fence, in dma_fence_signal_timestamp_locked, it has done the DMA_FENCE_FLAG_SIGNALLED_BIT setting, but hasn't yet reached the callbacks. The second thread in nouveau_cli_work_ready, where it sees the fence is signalled, so then puts the fence, cleanups the object and frees the work item, which contains the callback. Thread one goes again and tries to call the callback and causes the use-after-free. Proposed fix: lock the fence signalled check in nouveau_cli_work_ready, so either the callbacks are done or the memory is freed. Reviewed-by: Karol Herbst Fixes: 11e451e74050 ("drm/nouveau: remove fence wait code from deferred client work handler") Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie Link: https://lore.kernel.org/dri-devel/20230615024008.1600281-1-airlied@gmail.com/ commit c8ac109e21e12a25dd127a426c813d771ff90b1e Merge: 858fd168a95c5 7c5835bcb9176 Author: Dave Airlie Date: Fri Jun 16 09:08:13 2023 +1000 Merge tag 'amd-drm-fixes-6.4-2023-06-14' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.4-2023-06-14: amdgpu: - GFX9 preemption fixes - Add missing radeon secondary PCI ID - vblflash fixes - SMU 13 fix - VCN 4.0 fix - Re-enable TOPDOWN flag for large BAR systems to fix regression - eDP fix - PSR hang fix - DPIA fix radeon: - fbdev client warning fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230615024011.7773-1-alexander.deucher@amd.com commit 62d8779610bb7a7b8f9c7ab8bf317193ebe76d93 Merge: 7a043feb6cc02 f451fd97dd2b7 Author: Linus Torvalds Date: Thu Jun 15 15:40:58 2023 -0700 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Fix two regressions in ext4, one report by syzkaller[1], and reported by multiple users (and tracked by regzbot[2])" [1] https://syzkaller.appspot.com/bug?extid=4acc7d910e617b360859 [2] https://linux-regtracking.leemhuis.info/regzbot/regression/ZIauBR7YiV3rVAHL@glitch/ * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: drop the call to ext4_error() from ext4_get_group_info() Revert "ext4: remove unnecessary check in ext4_bg_num_gdb_nometa" commit 7a043feb6cc02c9273c34392c41d17e08804a323 Merge: b6dad5178ceaf e4645cc2f1e2d Author: Linus Torvalds Date: Thu Jun 15 15:24:33 2023 -0700 Merge tag '6.4-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Eight, mostly small, smb3 client fixes: - important fix for deferred close oops (race with unmount) found with xfstest generic/098 to some servers - important reconnect fix - fix problem with max_credits mount option - two multichannel (interface related) fixes - one trivial removal of confusing comment - two small debugging improvements (to better spot crediting problems)" * tag '6.4-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: add a warning when the in-flight count goes negative cifs: fix lease break oops in xfstest generic/098 cifs: fix max_credits implementation cifs: fix sockaddr comparison in iface_cmp smb/client: print "Unknown" instead of bogus link speed value cifs: print all credit counters in DebugData cifs: fix status checks in cifs_tree_connect smb: remove obsolete comment commit 8f0e3703571fe771d06235870ccbbf4ad41e63e8 Merge: 9a36e2d44d122 b144fcaf46d43 Author: Jakub Kicinski Date: Thu Jun 15 15:09:00 2023 -0700 Merge branch 'udplite-dccp-print-deprecation-notice' Kuniyuki Iwashima says: ==================== udplite/dccp: Print deprecation notice. UDP-Lite is assumed to have no users for 7 years, and DCCP is orphaned for 7 years too. Let's add deprecation notice and see if anyone responds to it. ==================== Link: https://lore.kernel.org/r/20230614194705.90673-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit b144fcaf46d43b1471ad6e4de66235b8cebb3c87 Author: Kuniyuki Iwashima Date: Wed Jun 14 12:47:05 2023 -0700 dccp: Print deprecation notice. DCCP was marked as Orphan in the MAINTAINERS entry 2 years ago in commit 054c4610bd05 ("MAINTAINERS: dccp: move Gerrit Renker to CREDITS"). It says we haven't heard from the maintainer for five years, so DCCP is not well maintained for 7 years now. Recently DCCP only receives updates for bugs, and major distros disable it by default. Removing DCCP would allow for better organisation of TCP fields to reduce the number of cache lines hit in the fast path. Let's add a deprecation notice when DCCP socket is created and schedule its removal to 2025. Signed-off-by: Kuniyuki Iwashima Signed-off-by: Jakub Kicinski commit be28c14ac8bbe1ff0b2a18a06cd10981f90fc741 Author: Kuniyuki Iwashima Date: Wed Jun 14 12:47:04 2023 -0700 udplite: Print deprecation notice. Recently syzkaller reported a 7-year-old null-ptr-deref [0] that occurs when a UDP-Lite socket tries to allocate a buffer under memory pressure. Someone should have stumbled on the bug much earlier if UDP-Lite had been used in a real app. Also, we do not always need a large UDP-Lite workload to hit the bug since UDP and UDP-Lite share the same memory accounting limit. Removing UDP-Lite would simplify UDP code removing a bunch of conditionals in fast path. Let's add a deprecation notice when UDP-Lite socket is created and schedule its removal to 2025. Link: https://lore.kernel.org/netdev/20230523163305.66466-1-kuniyu@amazon.com/ [0] Signed-off-by: Kuniyuki Iwashima Signed-off-by: Jakub Kicinski commit 9a36e2d44d122fe73a2a76ba73f1d50a65cf8210 Author: Jiasheng Jiang Date: Thu Jun 15 11:34:00 2023 +0800 octeon_ep: Add missing check for ioremap Add check for ioremap() and return the error if it fails in order to guarantee the success of ioremap(). Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization") Signed-off-by: Jiasheng Jiang Reviewed-by: Kalesh AP Link: https://lore.kernel.org/r/20230615033400.2971-1-jiasheng@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 76a4c8b82938bc5020b67663db41f451684bf327 Author: Alex Maftei Date: Thu Jun 15 09:34:04 2023 +0100 selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET Previously, timestamps were printed using "%lld.%u" which is incorrect for nanosecond values lower than 100,000,000 as they're fractional digits, therefore leading zeros are meaningful. This patch changes the format strings to "%lld.%09u" in order to add leading zeros to the nanosecond value. Fixes: 568ebc5985f5 ("ptp: add the PTP_SYS_OFFSET ioctl to the testptp program") Fixes: 4ec54f95736f ("ptp: Fix compiler warnings in the testptp utility") Fixes: 6ab0e475f1f3 ("Documentation: fix misc. warnings") Signed-off-by: Alex Maftei Acked-by: Richard Cochran Link: https://lore.kernel.org/r/20230615083404.57112-1-alex.maftei@amd.com Signed-off-by: Jakub Kicinski commit 30134b7c47bd28fdb4db4d12aef824e0579cfee4 Author: Christian Marangi Date: Wed Jun 14 11:17:14 2023 +0200 net: ethernet: stmicro: stmmac: fix possible memory leak in __stmmac_open Fix a possible memory leak in __stmmac_open when stmmac_init_phy fails. It's also needed to free everything allocated by stmmac_setup_dma_desc and not just the dma_conf struct. Drop free_dma_desc_resources from __stmmac_open and correctly call free_dma_desc_resources on each user of __stmmac_open on error. Reported-by: Jose Abreu Fixes: ba39b344e924 ("net: ethernet: stmicro: stmmac: generate stmmac dma conf before open") Signed-off-by: Christian Marangi Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Reviewed-by: Jose Abreu Link: https://lore.kernel.org/r/20230614091714.15912-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 44194cb1b6045dea33ae9a0d54fb7e7cd93a2e09 Author: Lin Ma Date: Wed Jun 14 20:06:04 2023 +0800 net: tipc: resize nlattr array to correct size According to nla_parse_nested_deprecated(), the tb[] is supposed to the destination array with maxtype+1 elements. In current tipc_nl_media_get() and __tipc_nl_media_set(), a larger array is used which is unnecessary. This patch resize them to a proper size. Fixes: 1e55417d8fc6 ("tipc: add media set to new netlink api") Fixes: 46f15c6794fb ("tipc: add media get/dump to new netlink api") Signed-off-by: Lin Ma Reviewed-by: Florian Westphal Reviewed-by: Tung Nguyen Link: https://lore.kernel.org/r/20230614120604.1196377-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski commit be04c14a1bd262a49e5764e5cf864259b7e740fd Author: Mike Snitzer Date: Wed Jun 14 21:47:46 2023 -0400 dm: use op specific max_sectors when splitting abnormal io Split abnormal IO in terms of the corresponding operation specific max_sectors (max_discard_sectors, max_secure_erase_sectors or max_write_zeroes_sectors). This fixes a significant dm-thinp discard performance regression that was introduced with commit e2dd8aca2d76 ("dm bio prison v1: improve concurrent IO performance"). Relative to discard: max_discard_sectors is used instead of max_sectors; which fixes excessive discard splitting (e.g. max_sectors=128K vs max_discard_sectors=64M). Tested by discarding an 1 Petabyte dm-thin device: lvcreate -V 1125899906842624B -T test/pool -n thin time blkdiscard /dev/test/thin Before this fix (splitting discards every 128K): ~116m After this fix (splitting discards every 64M) : 0m33.460s Reported-by: Zorro Lang Fixes: 06961c487a33 ("dm: split discards further if target sets max_discard_granularity") Requires: 13f6facf3fae ("dm: allow targets to require splitting WRITE_ZEROES and SECURE_ERASE") Fixes: e2dd8aca2d76 ("dm bio prison v1: improve concurrent IO performance") Signed-off-by: Mike Snitzer commit 722d90822321497e2837cfc9000202e256e6b32f Author: Mike Snitzer Date: Tue Jun 13 20:05:34 2023 -0400 dm thin: fix issue_discard to pass GFP_NOIO to __blkdev_issue_discard issue_discard() passes GFP_NOWAIT to __blkdev_issue_discard() despite its code assuming bio_alloc() always succeeds. Commit 3dba53a958a75 ("dm thin: use __blkdev_issue_discard for async discard support") clearly shows where things went bad: Before commit 3dba53a958a75, dm-thin.c's open-coded __blkdev_issue_discard_async() properly handled using GFP_NOWAIT. Unfortunately __blkdev_issue_discard() doesn't and it was missed during review. Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer commit cb65b282c9640c27d3129e2e04b711ce1b352838 Author: Li Lingfeng Date: Tue Jun 6 20:20:24 2023 +0800 dm thin metadata: check fail_io before using data_sm Must check pmd->fail_io before using pmd->data_sm since pmd->data_sm may be destroyed by other processes. P1(kworker) P2(message) do_worker process_prepared process_prepared_discard_passdown_pt2 dm_pool_dec_data_range pool_message commit dm_pool_commit_metadata ↓ // commit failed metadata_operation_failed abort_transaction dm_pool_abort_metadata __open_or_format_metadata ↓ dm_sm_disk_open ↓ // open failed // pmd->data_sm is NULL dm_sm_dec_blocks ↓ // try to access pmd->data_sm --> UAF As shown above, if dm_pool_commit_metadata() and dm_pool_abort_metadata() fail in pool_message process, kworker may trigger UAF. Fixes: be500ed721a6 ("dm space maps: improve performance with inc/dec on ranges of blocks") Cc: stable@vger.kernel.org Signed-off-by: Li Lingfeng Signed-off-by: Mike Snitzer commit 2760904d895279f87196f0fa9ec570c79fe6a2e4 Author: Li Lingfeng Date: Thu Jun 1 14:14:23 2023 +0800 dm: don't lock fs when the map is NULL during suspend or resume As described in commit 38d11da522aa ("dm: don't lock fs when the map is NULL in process of resume"), a deadlock may be triggered between do_resume() and do_mount(). This commit preserves the fix from commit 38d11da522aa but moves it to where it also serves to fix a similar deadlock between do_suspend() and do_mount(). It does so, if the active map is NULL, by clearing DM_SUSPEND_LOCKFS_FLAG in dm_suspend() which is called by both do_suspend() and do_resume(). Fixes: 38d11da522aa ("dm: don't lock fs when the map is NULL in process of resume") Signed-off-by: Li Lingfeng Signed-off-by: Mike Snitzer commit 0bb619f9227aa370330d2b309733d74750705053 Author: Hans de Goede Date: Wed Jun 14 12:07:56 2023 +0200 thermal/intel/intel_soc_dts_iosf: Fix reporting wrong temperatures Since commit 955fb8719efb ("thermal/intel/intel_soc_dts_iosf: Use Intel TCC library") intel_soc_dts_iosf is reporting the wrong temperature. The driver expects tj_max to be in milli-degrees-celcius but after the switch to the TCC library this is now in degrees celcius so instead of e.g. 90000 it is set to 90 causing a temperature 45 degrees below tj_max to be reported as -44910 milli-degrees instead of as 45000 milli-degrees. Fix this by adding back the lost factor of 1000. Fixes: 955fb8719efb ("thermal/intel/intel_soc_dts_iosf: Use Intel TCC library") Reported-by: Bernhard Krug Signed-off-by: Hans de Goede Acked-by: Zhang Rui Cc: 6.3+ # 6.3+ Signed-off-by: Rafael J. Wysocki commit 22db06337f590d01d79f60f181d8dfe5a9ef9085 Author: Rafael J. Wysocki Date: Wed Jun 14 17:29:21 2023 +0200 ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() The addition of might_sleep() to down_timeout() caused the latter to enable interrupts unconditionally in some cases, which in turn broke the ACPI S3 wakeup path in acpi_suspend_enter(), where down_timeout() is called by acpi_disable_all_gpes() via acpi_ut_acquire_mutex(). Namely, if CONFIG_DEBUG_ATOMIC_SLEEP is set, might_sleep() causes might_resched() to be used and if CONFIG_PREEMPT_VOLUNTARY is set, this triggers __cond_resched() which may call preempt_schedule_common(), so __schedule() gets invoked and it ends up with enabled interrupts (in the prev == next case). Now, enabling interrupts early in the S3 wakeup path causes the kernel to crash. Address this by modifying acpi_suspend_enter() to disable GPEs without attempting to acquire the sleeping lock which is not needed in that code path anyway. Fixes: 99409b935c9a ("locking/semaphore: Add might_sleep() to down_*() family") Reported-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki Acked-by: Peter Zijlstra (Intel) Cc: 5.15+ # 5.15+ commit 9d7054fb3ac2e8d252aae1268f20623f244e644f Author: Neil Armstrong Date: Thu Jun 15 14:51:45 2023 +0200 spi: spi-geni-qcom: correctly handle -EPROBE_DEFER from dma_request_chan() Now spi_geni_grab_gpi_chan() errors are correctly reported, the -EPROBE_DEFER error should be returned from probe in case the GPI dma driver is built as module and/or not probed yet. Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma") Fixes: 6532582c353f ("spi: spi-geni-qcom: fix error handling in spi_geni_grab_gpi_chan()") Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20230615-topic-sm8550-upstream-fix-spi-geni-qcom-probe-v2-1-670c3d9e8c9c@linaro.org Signed-off-by: Mark Brown commit e84a1e1e683f3558e30f437d7c99df35afb8b52c Author: Íñigo Huguet Date: Tue Jun 13 15:38:54 2023 +0200 sfc: fix XDP queues mode with legacy IRQ In systems without MSI-X capabilities, xdp_txq_queues_mode is calculated in efx_allocate_msix_channels, but when enabling MSI-X fails, it was not changed to a proper default value. This was leading to the driver thinking that it has dedicated XDP queues, when it didn't. Fix it by setting xdp_txq_queues_mode to the correct value if the driver fallbacks to MSI or legacy IRQ mode. The correct value is EFX_XDP_TX_QUEUES_BORROWED because there are no XDP dedicated queues. The issue can be easily visible if the kernel is started with pci=nomsi, then a call trace is shown. It is not shown only with sfc's modparam interrupt_mode=2. Call trace example: WARNING: CPU: 2 PID: 663 at drivers/net/ethernet/sfc/efx_channels.c:828 efx_set_xdp_channels+0x124/0x260 [sfc] [...skip...] Call Trace: efx_set_channels+0x5c/0xc0 [sfc] efx_probe_nic+0x9b/0x15a [sfc] efx_probe_all+0x10/0x1a2 [sfc] efx_pci_probe_main+0x12/0x156 [sfc] efx_pci_probe_post_io+0x18/0x103 [sfc] efx_pci_probe.cold+0x154/0x257 [sfc] local_pci_probe+0x42/0x80 Fixes: 6215b608a8c4 ("sfc: last resort fallback for lack of xdp tx queues") Reported-by: Yanghang Liu Signed-off-by: Íñigo Huguet Acked-by: Martin Habets Signed-off-by: David S. Miller commit 0c0cf3db83f8c7c9bb141c2771a34043bcf952ef Author: Fedor Pchelkin Date: Tue Jun 13 22:22:20 2023 +0300 net: macsec: fix double free of percpu stats Inside macsec_add_dev() we free percpu macsec->secy.tx_sc.stats and macsec->stats on some of the memory allocation failure paths. However, the net_device is already registered to that moment: in macsec_newlink(), just before calling macsec_add_dev(). This means that during unregister process its priv_destructor - macsec_free_netdev() - will be called and will free the stats again. Remove freeing percpu stats inside macsec_add_dev() because macsec_free_netdev() will correctly free the already allocated ones. The pointers to unallocated stats stay NULL, and free_percpu() treats that correctly. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 0a28bfd4971f ("net/macsec: Add MACsec skb_metadata_dst Tx Data path support") Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Fedor Pchelkin Reviewed-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 9eed321cde22fc1afd76eac563ce19d899e0d6b2 Author: Eric Dumazet Date: Wed Jun 14 16:18:02 2023 +0000 net: lapbether: only support ethernet devices It probbaly makes no sense to support arbitrary network devices for lapbether. syzbot reported: skbuff: skb_under_panic: text:ffff80008934c100 len:44 put:40 head:ffff0000d18dd200 data:ffff0000d18dd1ea tail:0x16 end:0x140 dev:bond1 kernel BUG at net/core/skbuff.c:200 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 5643 Comm: dhcpcd Not tainted 6.4.0-rc5-syzkaller-g4641cff8e810 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:196 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:210 lr : skb_panic net/core/skbuff.c:196 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:210 sp : ffff8000973b7260 x29: ffff8000973b7270 x28: ffff8000973b7360 x27: dfff800000000000 x26: ffff0000d85d8150 x25: 0000000000000016 x24: ffff0000d18dd1ea x23: ffff0000d18dd200 x22: 000000000000002c x21: 0000000000000140 x20: 0000000000000028 x19: ffff80008934c100 x18: ffff8000973b68a0 x17: 0000000000000000 x16: ffff80008a43bfbc x15: 0000000000000202 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000201 x10: 0000000000000000 x9 : f22f7eb937cced00 x8 : f22f7eb937cced00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000973b6b78 x4 : ffff80008df9ee80 x3 : ffff8000805974f4 x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086 Call trace: skb_panic net/core/skbuff.c:196 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:210 skb_push+0xf0/0x108 net/core/skbuff.c:2409 ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1383 dev_hard_header include/linux/netdevice.h:3137 [inline] lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257 lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447 lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149 lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251 lapb_establish_data_link+0x94/0xec lapb_device_event+0x348/0x4e0 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2bc/0x544 dev_change_flags+0xd0/0x15c net/core/dev.c:8643 devinet_ioctl+0x858/0x17e4 net/ipv4/devinet.c:1150 inet_ioctl+0x2ac/0x4d8 net/ipv4/af_inet.c:979 sock_do_ioctl+0x134/0x2dc net/socket.c:1201 sock_ioctl+0x4ec/0x858 net/socket.c:1318 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191 el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: aa1803e6 aa1903e7 a90023f5 947730f5 (d4210000) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Martin Schiller Signed-off-by: David S. Miller commit 7d03646d77cf837598b11c645ed2a79f29319111 Author: Jan Karcher Date: Wed Jun 14 08:54:56 2023 +0200 MAINTAINERS: add reviewers for SMC Sockets adding three people from Alibaba as reviewers for SMC. They are currently working on improving SMC on other architectures than s390 and help with reviewing patches on top. Thank you D. Wythe, Tony Lu and Wen Gu for your contributions and collaboration and welcome on board as reviewers! Reviewed-by: Wenjia Zhang Signed-off-by: Jan Karcher Acked-by: Tony Lu Acked-by: Wen Gu Signed-off-by: David S. Miller commit 78d0f94902afce8ec2c7a60f600cc0e3729d7412 Author: Julian Ruess Date: Tue Jun 13 14:25:37 2023 +0200 s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit() This patch prevents the system from crashing when unloading the ISM module. How to reproduce: Attach an ISM device and execute 'rmmod ism'. Error-Log: - Trying to free already-free IRQ 0 - WARNING: CPU: 1 PID: 966 at kernel/irq/manage.c:1890 free_irq+0x140/0x540 After calling ism_dev_exit() for each ISM device in the exit routine, pci_unregister_driver() will execute ism_remove() for each ISM device. Because ism_remove() also calls ism_dev_exit(), free_irq(pci_irq_vector(pdev, 0), ism) is called twice for each ISM device. This results in a crash with the error 'Trying to free already-free IRQ'. In the exit routine, it is enough to call pci_unregister_driver() because it ensures that ism_dev_exit() is called once per ISM device. Cc: # 6.3+ Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration") Reviewed-by: Niklas Schnelle Signed-off-by: Julian Ruess Signed-off-by: David S. Miller commit 41efbb682de1231c3f6361039f46ad149e3ff5b9 Author: Immad Mir Date: Thu Jun 15 14:35:56 2023 +0800 LoongArch: Fix debugfs_create_dir() error checking The debugfs_create_dir() returns ERR_PTR in case of an error and the correct way of checking it is using the IS_ERR_OR_NULL inline function rather than the simple null comparision. This patch fixes the issue. Cc: stable@vger.kernel.org Suggested-By: Ivan Orlov Signed-off-by: Immad Mir Signed-off-by: Huacai Chen commit 0246d0aaf0a634a65135050011767b56ba351a8f Author: Qing Zhang Date: Thu Jun 15 14:35:52 2023 +0800 LoongArch: Avoid uninitialized alignment_mask The hardware monitoring points for instruction fetching and load/store operations need to align 4 bytes and 1/2/4/8 bytes respectively. Reported-by: Colin King Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 962369120d750cbc9c4dc492f32b4304669ff6aa Author: Huacai Chen Date: Thu Jun 15 14:35:52 2023 +0800 LoongArch: Fix perf event id calculation LoongArch PMCFG has 10bit event id rather than 8 bit, so fix it. Cc: stable@vger.kernel.org Signed-off-by: Jun Yi Signed-off-by: Huacai Chen commit 346dc929623cef70ff7832a4fa0ffd1b696e312a Author: Qi Hu Date: Thu Jun 15 14:35:52 2023 +0800 LoongArch: Fix the write_fcsr() macro The "write_fcsr()" macro uses wrong the positions for val and dest in asm. Fix it! Reported-by: Miao HAO Signed-off-by: Qi Hu Signed-off-by: Huacai Chen commit ddc1729b07cc84bb29f577698b8d2e74a4004a6e Author: Hongchen Zhang Date: Thu Jun 15 14:35:52 2023 +0800 LoongArch: Let pmd_present() return true when splitting pmd When we split a pmd into ptes, pmd_present() and pmd_trans_huge() should return true, otherwise it would be treated as a swap pmd. This is the same as arm64 does in commit b65399f6111b ("arm64/mm: Change THP helpers to comply with generic MM semantics"), we also add a new bit named _PAGE_PRESENT_INVALID for LoongArch. Signed-off-by: Hongchen Zhang Signed-off-by: Huacai Chen commit 6ac7a27a8b07588497ed53dfd885df9c72bc67e0 Author: Vladimir Oltean Date: Tue Jun 13 20:09:07 2023 +0300 net: dsa: felix: fix taprio guard band overflow at 10Mbps with jumbo frames The DEV_MAC_MAXLEN_CFG register contains a 16-bit value - up to 65535. Plus 2 * VLAN_HLEN (4), that is up to 65543. The picos_per_byte variable is the largest when "speed" is lowest - SPEED_10 = 10. In that case it is (1000000L * 8) / 10 = 800000. Their product - 52434400000 - exceeds 32 bits, which is a problem, because apparently, a multiplication between two 32-bit factors is evaluated as 32-bit before being assigned to a 64-bit variable. In fact it's a problem for any MTU value larger than 5368. Cast one of the factors of the multiplication to u64 to force the multiplication to take place on 64 bits. Issue found by Coverity. Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230613170907.2413559-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit c9a82bec02c339cdda99b37c5e62b3b71fc4209c Author: Vlad Buslov Date: Mon Jun 12 11:34:26 2023 +0200 net/sched: cls_api: Fix lockup on flushing explicitly created chain Mingshuai Ren reports: When a new chain is added by using tc, one soft lockup alarm will be generated after delete the prio 0 filter of the chain. To reproduce the problem, perform the following steps: (1) tc qdisc add dev eth0 root handle 1: htb default 1 (2) tc chain add dev eth0 (3) tc filter del dev eth0 chain 0 parent 1: prio 0 (4) tc filter add dev eth0 chain 0 parent 1: Fix the issue by accounting for additional reference to chains that are explicitly created by RTM_NEWCHAIN message as opposed to implicitly by RTM_NEWTFILTER message. Fixes: 726d061286ce ("net: sched: prevent insertion of new classifiers during chain flush") Reported-by: Mingshuai Ren Closes: https://lore.kernel.org/lkml/87legswvi3.fsf@nvidia.com/T/ Signed-off-by: Vlad Buslov Link: https://lore.kernel.org/r/20230612093426.2867183-1-vladbu@nvidia.com Signed-off-by: Jakub Kicinski commit 24b454bc354ab7b1aa918a4fe3d7696516f592d4 Author: Jakub Buchocki Date: Mon Jun 12 10:14:21 2023 -0700 ice: Fix ice module unload Clearing the interrupt scheme before PFR reset, during the removal routine, could cause the hardware errors and possibly lead to system reboot, as the PF reset can cause the interrupt to be generated. Place the call for PFR reset inside ice_deinit_dev(), wait until reset and all pending transactions are done, then call ice_clear_interrupt_scheme(). This introduces a PFR reset to multiple error paths. Additionally, remove the call for the reset from ice_load() - it will be a part of ice_unload() now. Error example: [ 75.229328] ice 0000:ca:00.1: Failed to read Tx Scheduler Tree - User Selection data from flash [ 77.571315] {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 [ 77.571418] {1}[Hardware Error]: event severity: recoverable [ 77.571459] {1}[Hardware Error]: Error 0, type: recoverable [ 77.571500] {1}[Hardware Error]: section_type: PCIe error [ 77.571540] {1}[Hardware Error]: port_type: 4, root port [ 77.571580] {1}[Hardware Error]: version: 3.0 [ 77.571615] {1}[Hardware Error]: command: 0x0547, status: 0x4010 [ 77.571661] {1}[Hardware Error]: device_id: 0000:c9:02.0 [ 77.571703] {1}[Hardware Error]: slot: 25 [ 77.571736] {1}[Hardware Error]: secondary_bus: 0xca [ 77.571773] {1}[Hardware Error]: vendor_id: 0x8086, device_id: 0x347a [ 77.571821] {1}[Hardware Error]: class_code: 060400 [ 77.571858] {1}[Hardware Error]: bridge: secondary_status: 0x2800, control: 0x0013 [ 77.572490] pcieport 0000:c9:02.0: AER: aer_status: 0x00200000, aer_mask: 0x00100020 [ 77.572870] pcieport 0000:c9:02.0: [21] ACSViol (First) [ 77.573222] pcieport 0000:c9:02.0: AER: aer_layer=Transaction Layer, aer_agent=Receiver ID [ 77.573554] pcieport 0000:c9:02.0: AER: aer_uncor_severity: 0x00463010 [ 77.691273] {2}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 [ 77.691738] {2}[Hardware Error]: event severity: recoverable [ 77.691971] {2}[Hardware Error]: Error 0, type: recoverable [ 77.692192] {2}[Hardware Error]: section_type: PCIe error [ 77.692403] {2}[Hardware Error]: port_type: 4, root port [ 77.692616] {2}[Hardware Error]: version: 3.0 [ 77.692825] {2}[Hardware Error]: command: 0x0547, status: 0x4010 [ 77.693032] {2}[Hardware Error]: device_id: 0000:c9:02.0 [ 77.693238] {2}[Hardware Error]: slot: 25 [ 77.693440] {2}[Hardware Error]: secondary_bus: 0xca [ 77.693641] {2}[Hardware Error]: vendor_id: 0x8086, device_id: 0x347a [ 77.693853] {2}[Hardware Error]: class_code: 060400 [ 77.694054] {2}[Hardware Error]: bridge: secondary_status: 0x0800, control: 0x0013 [ 77.719115] pci 0000:ca:00.1: AER: can't recover (no error_detected callback) [ 77.719140] pcieport 0000:c9:02.0: AER: device recovery failed [ 77.719216] pcieport 0000:c9:02.0: AER: aer_status: 0x00200000, aer_mask: 0x00100020 [ 77.719390] pcieport 0000:c9:02.0: [21] ACSViol (First) [ 77.719557] pcieport 0000:c9:02.0: AER: aer_layer=Transaction Layer, aer_agent=Receiver ID [ 77.719723] pcieport 0000:c9:02.0: AER: aer_uncor_severity: 0x00463010 Fixes: 5b246e533d01 ("ice: split probe into smaller functions") Signed-off-by: Jakub Buchocki Reviewed-by: Przemek Kitszel Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230612171421.21570-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit d6858e190425db1da92f3131b1f3411480c356aa Merge: 361b6889ae636 48a821fd58837 Author: Jakub Kicinski Date: Wed Jun 14 22:36:53 2023 -0700 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-06-12 (igc, igb) This series contains updates to igc and igb drivers. Husaini clears Tx rings when interface is brought down for igc. Vinicius disables PTM and PCI busmaster when removing igc driver. Alex adds error check and path for NVM read error on igb. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igb: fix nvm.ops.read() error handling igc: Fix possible system crash when loading module igc: Clean the TX buffer and TX descriptor ring ==================== Link: https://lore.kernel.org/r/20230612205208.115292-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 361b6889ae636926cdff517add240c3c8e24593a Author: Lin Ma Date: Wed Jun 14 09:52:49 2023 +0800 net/handshake: remove fput() that causes use-after-free A reference underflow is found in TLS handshake subsystem that causes a direct use-after-free. Part of the crash log is like below: [ 2.022114] ------------[ cut here ]------------ [ 2.022193] refcount_t: underflow; use-after-free. [ 2.022288] WARNING: CPU: 0 PID: 60 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 [ 2.022432] Modules linked in: [ 2.022848] RIP: 0010:refcount_warn_saturate+0xbe/0x110 [ 2.023231] RSP: 0018:ffffc900001bfe18 EFLAGS: 00000286 [ 2.023325] RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00000000ffffdfff [ 2.023438] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001 [ 2.023555] RBP: ffff888004c20098 R08: ffffffff82b392c8 R09: 00000000ffffdfff [ 2.023693] R10: ffffffff82a592e0 R11: ffffffff82b092e0 R12: ffff888004c200d8 [ 2.023813] R13: 0000000000000000 R14: ffff888004c20000 R15: ffffc90000013ca8 [ 2.023930] FS: 0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 [ 2.024062] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.024161] CR2: ffff888003601000 CR3: 0000000002a2e000 CR4: 00000000000006f0 [ 2.024275] Call Trace: [ 2.024322] [ 2.024367] ? __warn+0x7f/0x130 [ 2.024430] ? refcount_warn_saturate+0xbe/0x110 [ 2.024513] ? report_bug+0x199/0x1b0 [ 2.024585] ? handle_bug+0x3c/0x70 [ 2.024676] ? exc_invalid_op+0x18/0x70 [ 2.024750] ? asm_exc_invalid_op+0x1a/0x20 [ 2.024830] ? refcount_warn_saturate+0xbe/0x110 [ 2.024916] ? refcount_warn_saturate+0xbe/0x110 [ 2.024998] __tcp_close+0x2f4/0x3d0 [ 2.025065] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 2.025168] tcp_close+0x1f/0x70 [ 2.025231] inet_release+0x33/0x60 [ 2.025297] sock_release+0x1f/0x80 [ 2.025361] handshake_req_cancel_test2+0x100/0x2d0 [ 2.025457] kunit_try_run_case+0x4c/0xa0 [ 2.025532] kunit_generic_run_threadfn_adapter+0x15/0x20 [ 2.025644] kthread+0xe1/0x110 [ 2.025708] ? __pfx_kthread+0x10/0x10 [ 2.025780] ret_from_fork+0x2c/0x50 One can enable CONFIG_NET_HANDSHAKE_KUNIT_TEST config to reproduce above crash. The root cause of this bug is that the commit 1ce77c998f04 ("net/handshake: Unpin sock->file if a handshake is cancelled") adds one additional fput() function. That patch claims that the fput() is used to enable sock->file to be freed even when user space never calls DONE. However, it seems that the intended DONE routine will never give an additional fput() of ths sock->file. The existing two of them are just used to balance the reference added in sockfd_lookup(). This patch revert the mentioned commit to avoid the use-after-free. The patched kernel could successfully pass the KUNIT test and boot to shell. [ 0.733613] # Subtest: Handshake API tests [ 0.734029] 1..11 [ 0.734255] KTAP version 1 [ 0.734542] # Subtest: req_alloc API fuzzing [ 0.736104] ok 1 handshake_req_alloc NULL proto [ 0.736114] ok 2 handshake_req_alloc CLASS_NONE [ 0.736559] ok 3 handshake_req_alloc CLASS_MAX [ 0.737020] ok 4 handshake_req_alloc no callbacks [ 0.737488] ok 5 handshake_req_alloc no done callback [ 0.737988] ok 6 handshake_req_alloc excessive privsize [ 0.738529] ok 7 handshake_req_alloc all good [ 0.739036] # req_alloc API fuzzing: pass:7 fail:0 skip:0 total:7 [ 0.739444] ok 1 req_alloc API fuzzing [ 0.740065] ok 2 req_submit NULL req arg [ 0.740436] ok 3 req_submit NULL sock arg [ 0.740834] ok 4 req_submit NULL sock->file [ 0.741236] ok 5 req_lookup works [ 0.741621] ok 6 req_submit max pending [ 0.741974] ok 7 req_submit multiple [ 0.742382] ok 8 req_cancel before accept [ 0.742764] ok 9 req_cancel after accept [ 0.743151] ok 10 req_cancel after done [ 0.743510] ok 11 req_destroy works [ 0.743882] # Handshake API tests: pass:11 fail:0 skip:0 total:11 [ 0.744205] # Totals: pass:17 fail:0 skip:0 total:17 Acked-by: Chuck Lever Fixes: 1ce77c998f04 ("net/handshake: Unpin sock->file if a handshake is cancelled") Signed-off-by: Lin Ma Link: https://lore.kernel.org/r/20230613083204.633896-1-linma@zju.edu.cn Link: https://lore.kernel.org/r/20230614015249.987448-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski commit 37cec6ed8dc5f626ec08ec7c4e20d4dc65a95a46 Merge: bef68e201e538 f1a0898b5d6a7 Author: Jakub Kicinski Date: Wed Jun 14 21:28:59 2023 -0700 Merge tag 'wireless-2023-06-14' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== A couple of straggler fixes, mostly in the stack: - fix fragmentation for multi-link related elements - fix callback copy/paste error - fix multi-link locking - remove double-locking of wiphy mutex - transmit only on active links, not all - activate links in the correct order - don't remove links that weren't added - disable soft-IRQs for LQ lock in iwlwifi * tag 'wireless-2023-06-14' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: mvm: spin_lock_bh() to fix lockdep regression wifi: mac80211: fragment per STA profile correctly wifi: mac80211: Use active_links instead of valid_links in Tx wifi: cfg80211: remove links only on AP wifi: mac80211: take lock before setting vif links wifi: cfg80211: fix link del callback to call correct handler wifi: mac80211: fix link activation settings order wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid() ==================== Link: https://lore.kernel.org/r/20230614075502.11765-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit f451fd97dd2b78f286379203a47d9d295c467255 Author: Fabio M. De Francesco Date: Wed Jun 14 12:02:55 2023 +0200 ext4: drop the call to ext4_error() from ext4_get_group_info() A recent patch added a call to ext4_error() which is problematic since some callers of the ext4_get_group_info() function may be holding a spinlock, whereas ext4_error() must never be called in atomic context. This triggered a report from Syzbot: "BUG: sleeping function called from invalid context in ext4_update_super" (see the link below). Therefore, drop the call to ext4_error() from ext4_get_group_info(). In the meantime use eight characters tabs instead of nine characters ones. Reported-by: syzbot+4acc7d910e617b360859@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/00000000000070575805fdc6cdb2@google.com/ Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail") Suggested-by: Theodore Ts'o Signed-off-by: Fabio M. De Francesco Link: https://lore.kernel.org/r/20230614100446.14337-1-fmdefrancesco@gmail.com commit 19482792113fa1dc419f9bc7b04b9dbdaa5256fd Author: Kemeng Shi Date: Wed Jun 14 06:50:25 2023 +0800 Revert "ext4: remove unnecessary check in ext4_bg_num_gdb_nometa" This reverts commit ad3f09be6cfe332be8ff46c78e6ec0f8839107aa. The reverted commit was intended to simpfy the code to get group descriptor block number in non-meta block group by assuming s_gdb_count is block number used for all non-meta block group descriptors. However s_gdb_count is block number used for all meta *and* non-meta group descriptors. So s_gdb_group will be > actual group descriptor block number used for all non-meta block group which should be "total non-meta block group" / "group descriptors per block", e.g. s_first_meta_bg. Signed-off-by: Kemeng Shi Link: https://lore.kernel.org/r/20230613225025.3859522-1-shikemeng@huaweicloud.com Fixes: ad3f09be6cfe ("ext4: remove unnecessary check in ext4_bg_num_gdb_nometa") Cc: stable@kernel.org Signed-off-by: Theodore Ts'o commit 9cefd6e7e0a77b0fbca5c793f6fb6821b0962775 Author: Justin Tee Date: Wed Jun 14 10:59:44 2023 -0700 scsi: lpfc: Fix incorrect big endian type assignment in bsg loopback path The kernel test robot reported sparse warnings regarding incorrect type assignment for __be16 variables in bsg loopback path. Change the flagged lines to use the be16_to_cpu() and cpu_to_be16() macros appropriately. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20230614175944.3577-1-justintee8345@gmail.com Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306110819.sDIKiGgg-lkp@intel.com/ Signed-off-by: Martin K. Petersen commit 91271699228bfc66f1bc8abc0327169dc156d854 Author: Bob Pearson Date: Tue Jun 13 09:43:00 2023 -0500 scsi: target: core: Fix error path in target_setup_session() In the error exits in target_setup_session(), if a branch is taken to free_sess: transport_free_session() may call to target_free_cmd_counter() and then fall through to call target_free_cmd_counter() a second time. This can, and does, sometimes cause seg faults since the data field in cmd_cnt->refcnt has been freed in the first call. Fix this problem by simply returning after the call to transport_free_session(). The second call is redundant for those cases. Fixes: 4edba7e4a8f3 ("scsi: target: Move cmd counter allocation") Signed-off-by: Bob Pearson Link: https://lore.kernel.org/r/20230613144259.12890-1-rpearsonhpe@gmail.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit 31d16e712bdcaee769de4780f72ff8d6cd3f0589 Author: Michael Kelley Date: Fri Jun 9 13:38:21 2023 -0700 scsi: storvsc: Always set no_report_opcodes Hyper-V synthetic SCSI devices do not support the MAINTENANCE_IN SCSI command, so scsi_report_opcode() always fails, resulting in messages like this: hv_storvsc : tag#205 cmd 0xa3 status: scsi 0x2 srb 0x86 hv 0xc0000001 The recently added support for command duration limits calls scsi_report_opcode() four times as each device comes online, which significantly increases the number of messages logged in a system with many disks. Fix the problem by always marking Hyper-V synthetic SCSI devices as not supporting scsi_report_opcode(). With this setting, the MAINTENANCE_IN SCSI command is not issued and no messages are logged. Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1686343101-18930-1-git-send-email-mikelley@microsoft.com Signed-off-by: Martin K. Petersen commit 9dc704dcc09eae7d21b5da0615eb2ed79278f63e Author: Sagar Biradar Date: Fri May 19 16:08:34 2023 -0700 scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity Fix the I/O hang that arises because of the MSIx vector not having a mapped online CPU upon receiving completion. SCSI cmds take the blk_mq route, which is setup during init. Reserved cmds fetch the vector_no from mq_map after init is complete. Before init, they have to use 0 - as per the norm. Reviewed-by: Gilbert Wu Signed-off-by: Sagar Biradar Reviewed-by: John Garry Link: https://lore.kernel.org/r/20230519230834.27436-1-sagar.biradar@microchip.com Signed-off-by: Martin K. Petersen commit 23200a4c8ac284f8b4263d7cecaefecaa3ad6732 Author: Arnd Bergmann Date: Thu May 11 12:58:33 2023 +0200 clk: pxa: fix NULL pointer dereference in pxa3xx_clk_update_accr sparse points out an embarrasing bug in an older patch of mine, which uses the register offset instead of an __iomem pointer: drivers/clk/pxa/clk-pxa3xx.c:167:9: sparse: sparse: Using plain integer as NULL pointer Unlike sparse, gcc and clang ignore this bug and fail to warn because a literal '0' is considered a valid representation of a NULL pointer. Fixes: 3c816d950a49 ("ARM: pxa: move clk register definitions to driver") Cc: stable@vger.kernel.org Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202305111301.RAHohdob-lkp@intel.com/ Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230511105845.299859-1-arnd@kernel.org Signed-off-by: Stephen Boyd commit ec21a38df77a5aefbd2f70c48127003b6f259cf3 Author: Mauro Carvalho Chehab Date: Fri Jun 9 09:16:21 2023 +0100 Revert "media: dvb-core: Fix use-after-free on race condition at dvb_frontend" As reported by Thomas Voegtle , sometimes a DVB card does not initialize properly booting Linux 6.4-rc4. This is not always, maybe in 3 out of 4 attempts. After double-checking, the root cause seems to be related to the UAF fix, which is causing a race issue: [ 26.332149] tda10071 7-0005: found a 'NXP TDA10071' in cold state, will try to load a firmware [ 26.340779] tda10071 7-0005: downloading firmware from file 'dvb-fe-tda10071.fw' [ 989.277402] INFO: task vdr:743 blocked for more than 491 seconds. [ 989.283504] Not tainted 6.4.0-rc5-i5 #249 [ 989.288036] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 989.295860] task:vdr state:D stack:0 pid:743 ppid:711 flags:0x00004002 [ 989.295865] Call Trace: [ 989.295867] [ 989.295869] __schedule+0x2ea/0x12d0 [ 989.295877] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 989.295881] schedule+0x57/0xc0 [ 989.295884] schedule_preempt_disabled+0xc/0x20 [ 989.295887] __mutex_lock.isra.16+0x237/0x480 [ 989.295891] ? dvb_get_property.isra.10+0x1bc/0xa50 [ 989.295898] ? dvb_frontend_stop+0x36/0x180 [ 989.338777] dvb_frontend_stop+0x36/0x180 [ 989.338781] dvb_frontend_open+0x2f1/0x470 [ 989.338784] dvb_device_open+0x81/0xf0 [ 989.338804] ? exact_lock+0x20/0x20 [ 989.338808] chrdev_open+0x7f/0x1c0 [ 989.338811] ? generic_permission+0x1a2/0x230 [ 989.338813] ? link_path_walk.part.63+0x340/0x380 [ 989.338815] ? exact_lock+0x20/0x20 [ 989.338817] do_dentry_open+0x18e/0x450 [ 989.374030] path_openat+0xca5/0xe00 [ 989.374031] ? terminate_walk+0xec/0x100 [ 989.374034] ? path_lookupat+0x93/0x140 [ 989.374036] do_filp_open+0xc0/0x140 [ 989.374038] ? __call_rcu_common.constprop.91+0x92/0x240 [ 989.374041] ? __check_object_size+0x147/0x260 [ 989.374043] ? __check_object_size+0x147/0x260 [ 989.374045] ? alloc_fd+0xbb/0x180 [ 989.374048] ? do_sys_openat2+0x243/0x310 [ 989.374050] do_sys_openat2+0x243/0x310 [ 989.374052] do_sys_open+0x52/0x80 [ 989.374055] do_syscall_64+0x5b/0x80 [ 989.421335] ? __task_pid_nr_ns+0x92/0xa0 [ 989.421337] ? syscall_exit_to_user_mode+0x20/0x40 [ 989.421339] ? do_syscall_64+0x67/0x80 [ 989.421341] ? syscall_exit_to_user_mode+0x20/0x40 [ 989.421343] ? do_syscall_64+0x67/0x80 [ 989.421345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 989.421348] RIP: 0033:0x7fe895d067e3 [ 989.421349] RSP: 002b:00007fff933c2ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 989.421351] RAX: ffffffffffffffda RBX: 00007fff933c2c10 RCX: 00007fe895d067e3 [ 989.421352] RDX: 0000000000000802 RSI: 00005594acdce160 RDI: 00000000ffffff9c [ 989.421353] RBP: 0000000000000802 R08: 0000000000000000 R09: 0000000000000000 [ 989.421353] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 989.421354] R13: 00007fff933c2ca0 R14: 00000000ffffffff R15: 00007fff933c2c90 [ 989.421355] This reverts commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f. Fixes: 6769a0b7ee0c ("media: dvb-core: Fix use-after-free on race condition at dvb_frontend") Link: https://lore.kernel.org/all/da5382ad-09d6-20ac-0d53-611594b30861@lio96.de/ Signed-off-by: Mauro Carvalho Chehab commit adeaa3f290ecf7f6a6a5c53219a4686cbdff5fbd Author: Jens Axboe Date: Tue Jun 13 19:26:55 2023 -0600 io_uring/io-wq: clear current->worker_private on exit A recent fix stopped clearing PF_IO_WORKER from current->flags on exit, which meant that we can now call inc/dec running on the worker after it has been removed if it ends up scheduling in/out as part of exit. If this happens after an RCU grace period has passed, then the struct pointed to by current->worker_private may have been freed, and we can now be accessing memory that is freed. Ensure this doesn't happen by clearing the task worker_private field. Both io_wq_worker_running() and io_wq_worker_sleeping() check this field before going any further, and we don't need any accounting etc done after this worker has exited. Fixes: fd37b884003c ("io_uring/io-wq: don't clear PF_IO_WORKER on exit") Reported-by: Zorro Lang Signed-off-by: Jens Axboe commit 0113d4615dbf053ae9a7a1e0acbc6652713af01f Author: Beau Belgrave Date: Wed Jun 14 09:33:36 2023 -0700 tracing/user_events: Document auto-cleanup and remove dyn_event refs Now user_events auto-cleanup upon the last reference by default. This makes it not possible to use the dynamics event file via tracefs. Document that auto-cleanup is enabled by default and remove the refernce to /sys/kernel/tracing/dynamic_events file to make this clear. Link: https://lkml.kernel.org/r/20230614163336.5797-7-beaub@linux.microsoft.com Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 61701242e86f0b509a0f5f9deb226bedfc8dfab7 Author: Beau Belgrave Date: Wed Jun 14 09:33:35 2023 -0700 selftests/user_events: Adapt dyn_test to non-persist events Now that user_events does not honor persist events the dynamic_events file cannot be easily used to test parsing and matching cases. Update dyn_test to use the direct ABI file instead of dynamic_events so that we still have testing coverage until persist events and dynamic_events file integration has been decided. Link: https://lkml.kernel.org/r/20230614163336.5797-6-beaub@linux.microsoft.com Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 216a137e3eadac888cece141bd2c940785e235a2 Author: Beau Belgrave Date: Wed Jun 14 09:33:34 2023 -0700 selftests/user_events: Ensure auto cleanup works as expected User events now auto cleanup upon the last reference put. Update ftrace_test to ensure this works as expected. Ensure EBUSY delays while event is being deleted do not cause transient failures by waiting and re-attempting. Link: https://lkml.kernel.org/r/20230614163336.5797-5-beaub@linux.microsoft.com Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit a65442edb47a6d9c974b50049296ac9ddb378fee Author: Beau Belgrave Date: Wed Jun 14 09:33:33 2023 -0700 tracing/user_events: Add auto cleanup and future persist flag Currently user events need to be manually deleted via the delete IOCTL call or via the dynamic_events file. Most operators and processes wish to have these events auto cleanup when they are no longer used by anything to prevent them piling without manual maintenance. However, some operators may not want this, such as pre-registering events via the dynamic_events tracefs file. Update user_event_put() to attempt an auto delete of the event if it's the last reference. The auto delete must run in a work queue to ensure proper behavior of class->reg() invocations that don't expect the call to go away from underneath them during the unregister. Add work_struct to user_event struct to ensure we can do this reliably. Add a persist flag, that is not yet exposed, to ensure we can toggle between auto-cleanup and leaving the events existing in the future. When a non-zero flag is seen during register, return -EINVAL to ensure ABI is clear for the user processes while we work out the best approach for persistent events. Link: https://lkml.kernel.org/r/20230614163336.5797-4-beaub@linux.microsoft.com Link: https://lore.kernel.org/linux-trace-kernel/20230518093600.3f119d68@rorschach.local.home/ Suggested-by: Steven Rostedt Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit f0dbf6fd0bddb9290c89fdd7afc53dad5051030e Author: Beau Belgrave Date: Wed Jun 14 09:33:32 2023 -0700 tracing/user_events: Track refcount consistently via put/get Various parts of the code today track user_event's refcnt field directly via a refcount_add/dec. This makes it hard to modify the behavior of the last reference decrement in all code paths consistently. For example, in the future we will auto-delete events upon the last reference going away. This last reference could happen in many places, but we want it to be consistently handled. Add user_event_get() and user_event_put() for the add/dec. Update all places where direct refcounts are being used to utilize these new functions. In each location pass if event_mutex is locked or not. This allows us to drop events automatically in future patches clearly. Ensure when caller states the lock is held, it really is (or is not) held. Link: https://lkml.kernel.org/r/20230614163336.5797-3-beaub@linux.microsoft.com Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit b08d72580584ab89c41d6fc0f15cd1cf4ce2ed93 Author: Beau Belgrave Date: Wed Jun 14 09:33:31 2023 -0700 tracing/user_events: Store register flags on events Currently we don't have any available flags for user processes to use to indicate options for user_events. We will soon have a flag to indicate the event should or should not auto-delete once it's not being used by anyone. Add a reg_flags field to user_events and parameters to existing functions to allow for this in future patches. Link: https://lkml.kernel.org/r/20230614163336.5797-2-beaub@linux.microsoft.com Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 0c7e314a6352664e12ec465f576cf039e95f8369 Author: Bob Pearson Date: Mon Jun 12 10:50:33 2023 -0500 RDMA/rxe: Fix rxe_cq_post A recent patch replaced a tasklet execution of cq->comp_handler by a direct call. While this made sense it let changes to cq->notify state be unprotected and assumed that the cq completion machinery and the ulp done callbacks were reentrant. The result is that in some cases completion events can be lost. This patch moves the cq->comp_handler call inside of the spinlock in rxe_cq_post which solves both issues. This is compatible with the matching code in the request notify verb. Fixes: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c") Link: https://lore.kernel.org/r/20230612155032.17036-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit ed0e0ae0c932188654422d01f4e0ea14ff97c063 Author: Beau Belgrave Date: Thu Jun 1 15:49:28 2023 -0700 tracing/user_events: Remove user_ns walk for groups During discussions it was suggested that user_ns is not a good place to try to attach a tracing namespace. The current code has stubs to enable that work that are very likely to change and incur a performance cost. Remove the user_ns walk when creating a group and determining the system name to use, since it's unlikely user_ns will be used in the future. Link: https://lore.kernel.org/all/20230601-urenkel-holzofen-cd9403b9cadd@brauner/ Link: https://lore.kernel.org/linux-trace-kernel/20230601224928.301-1-beaub@linux.microsoft.com Suggested-by: Christian Brauner Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 42187bdc3ca45435bec96c66a90276315b2db1cb Author: sunliming Date: Tue Jun 6 14:20:27 2023 +0800 selftests/user_events: Add perf self-test for empty arguments events Tests to ensure events that has empty arguments can input trace record correctly when using perf. Link: https://lkml.kernel.org/r/20230606062027.1008398-5-sunliming@kylinos.cn Acked-by: Beau Belgrave Acked-by: Masami Hiramatsu (Google) Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit 4b56c21b11dcd2c6e4c6ee81bde77bea05e64db0 Author: sunliming Date: Tue Jun 6 14:20:26 2023 +0800 selftests/user_events: Clear the events after perf self-test When the self test is completed, perf self-test left the user events not to be cleared. Clear the events by unregister and delete the event. Link: https://lkml.kernel.org/r/20230606062027.1008398-4-sunliming@kylinos.cn Acked-by: Beau Belgrave Acked-by: Masami Hiramatsu (Google) Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit 3e7269dd5fd5e77c215829e80fc1f29c989c9c42 Author: sunliming Date: Tue Jun 6 14:20:25 2023 +0800 selftests/user_events: Add ftrace self-test for empty arguments events Tests to ensure events that has empty arguments can input trace record correctly when using ftrace. Link: https://lkml.kernel.org/r/20230606062027.1008398-3-sunliming@kylinos.cn Acked-by: Beau Belgrave Acked-by: Masami Hiramatsu (Google) Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit 6f05dcabe5c241d066ec472cf38ac8b84f8c9c6f Author: sunliming Date: Tue Jun 6 14:20:24 2023 +0800 tracing/user_events: Fix the incorrect trace record for empty arguments events The user_events support events that has empty arguments. But the trace event is discarded and not really committed when the arguments is empty. Fix this by not attempting to copy in zero-length data. Link: https://lkml.kernel.org/r/20230606062027.1008398-2-sunliming@kylinos.cn Acked-by: Beau Belgrave Acked-by: Masami Hiramatsu (Google) Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit e70bb54d7a51299e7feca9169c07d79f9a3fc01d Author: sunliming Date: Thu May 25 16:52:32 2023 +0800 tracing: Modify print_fields() for fields output order Now the print_fields() print trace event fields in reverse order. Modify it to the positive sequence. Example outputs for a user event: test0 u32 count1; u32 count2 Output before: example-2547 [000] ..... 325.666387: test0: count2=0x2 (2) count1=0x1 (1) Output after: example-2742 [002] ..... 429.769370: test0: count1=0x1 (1) count2=0x2 (2) Link: https://lore.kernel.org/linux-trace-kernel/20230525085232.5096-1-sunliming@kylinos.cn Fixes: 80a76994b2d88 ("tracing: Add "fields" option to show raw trace event fields") Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit cfac4ed7279d056df6167bd665e460787dc9e0c4 Author: sunliming Date: Mon May 29 14:51:10 2023 +0800 tracing/user_events: Handle matching arguments that is null from dyn_events When A registering user event from dyn_events has no argments, it will pass the matching check, regardless of whether there is a user event with the same name and arguments. Add the matching check when the arguments of registering user event is null. Link: https://lore.kernel.org/linux-trace-kernel/20230529065110.303440-1-sunliming@kylinos.cn Signed-off-by: sunliming Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit ba470eebc2f6c2f704872955a715b9555328e7d0 Author: sunliming Date: Mon May 29 11:21:00 2023 +0800 tracing/user_events: Prevent same name but different args event User processes register name_args for events. If the same name but different args event are registered. The trace outputs of second event are printed as the first event. This is incorrect. Return EADDRINUSE back to the user process if the same name but different args event has being registered. Link: https://lore.kernel.org/linux-trace-kernel/20230529032100.286534-1-sunliming@kylinos.cn Signed-off-by: sunliming Reviewed-by: Masami Hiramatsu (Google) Acked-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit b50f2d048ecf1512ff85128ea4153bceb0e60590 Author: Qu Wenruo Date: Wed Jun 14 14:49:35 2023 +0800 btrfs: scrub: fix a return value overwrite in scrub_stripe() [RETURN VALUE OVERWRITE] Inside scrub_stripe(), we would submit all the remaining stripes after iterating all extents. But since flush_scrub_stripes() can return error, we need to avoid overwriting the existing @ret if there is any error. However the existing check is doing the wrong check: ret2 = flush_scrub_stripes(); if (!ret2) ret = ret2; This would overwrite the existing @ret to 0 as long as the final flush detects no critical errors. [FIX] We should check @ret other than @ret2 in that case. Fixes: 8eb3dd17eadd ("btrfs: dev-replace: error out if we have unrepaired metadata error during") Reviewed-by: Christoph Hellwig Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit e4645cc2f1e2d6f268bb8dcfac40997c52432aed Author: Shyam Prasad N Date: Fri Jun 9 17:46:56 2023 +0000 cifs: add a warning when the in-flight count goes negative We've seen the in-flight count go into negative with some internal stress testing in Microsoft. Adding a WARN when this happens, in hope of understanding why this happens when it happens. Signed-off-by: Shyam Prasad N Reviewed-by: Bharath SM Signed-off-by: Steve French commit c774e6779f38bf36f0cce65e30793704bab4b0d7 Author: Steve French Date: Sun Jun 11 11:23:32 2023 -0500 cifs: fix lease break oops in xfstest generic/098 umount can race with lease break so need to check if tcon->ses->server is still valid to send the lease break response. Reviewed-by: Bharath SM Reviewed-by: Shyam Prasad N Fixes: 59a556aebc43 ("SMB3: drop reference to cfile before sending oplock break") Signed-off-by: Steve French commit b104dbedbe61d89a933479f8effce6409037ef73 Author: Conor Dooley Date: Tue Jun 6 07:59:19 2023 +0100 Documentation: RISC-V: patch-acceptance: mention patchwork's role Palmer suggested at some point, not sure if it was in one of the weekly linux-riscv syncs, or a conversation at FOSDEM, that we should document the role of the automation running on our patchwork instance plays in patch acceptance. Add a short note to the patch-acceptance document to that end. Signed-off-by: Conor Dooley Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230606-rehab-monsoon-12c17bbe08e3@wendy Signed-off-by: Palmer Dabbelt commit bef68e201e538eaa3a91f97aae8161eb2d0a8ed7 Author: Danielle Ratson Date: Mon Jun 12 16:34:58 2023 +0200 selftests: forwarding: hw_stats_l3: Set addrgenmode in a separate step Setting the IPv6 address generation mode of a net device during its creation never worked, but after commit b0ad3c179059 ("rtnetlink: call validate_linkmsg in rtnl_create_link") it explicitly fails [1]. The failure is caused by the fact that validate_linkmsg() is called before the net device is registered, when it still does not have an 'inet6_dev'. Likewise, raising the net device before setting the address generation mode is meaningless, because by the time the mode is set, the address has already been generated. Therefore, fix the test to first create the net device, then set its IPv6 address generation mode and finally bring it up. [1] # ip link add name mydev addrgenmode eui64 type dummy RTNETLINK answers: Address family not supported by protocol Fixes: ba95e7930957 ("selftests: forwarding: hw_stats_l3: Add a new test") Signed-off-by: Danielle Ratson Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Link: https://lore.kernel.org/r/f3b05d85b2bc0c3d6168fe8f7207c6c8365703db.1686580046.git.petrm@nvidia.com Signed-off-by: Paolo Abeni commit 3c40eb8145325b0f5b93b8a169146078cb2c49d6 Author: Martin Hundebøll Date: Wed Jun 7 10:27:12 2023 +0200 mmc: meson-gx: remove redundant mmc_request_done() call from irq context The call to mmc_request_done() can schedule, so it must not be called from irq context. Wake the irq thread if it needs to be called, and let its existing logic do its work. Fixes the following kernel bug, which appears when running an RT patched kernel on the AmLogic Meson AXG A113X SoC: [ 11.111407] BUG: scheduling while atomic: kworker/0:1H/75/0x00010001 [ 11.111438] Modules linked in: [ 11.111451] CPU: 0 PID: 75 Comm: kworker/0:1H Not tainted 6.4.0-rc3-rt2-rtx-00081-gfd07f41ed6b4-dirty #1 [ 11.111461] Hardware name: RTX AXG A113X Linux Platform Board (DT) [ 11.111469] Workqueue: kblockd blk_mq_run_work_fn [ 11.111492] Call trace: [ 11.111497] dump_backtrace+0xac/0xe8 [ 11.111510] show_stack+0x18/0x28 [ 11.111518] dump_stack_lvl+0x48/0x60 [ 11.111530] dump_stack+0x18/0x24 [ 11.111537] __schedule_bug+0x4c/0x68 [ 11.111548] __schedule+0x80/0x574 [ 11.111558] schedule_loop+0x2c/0x50 [ 11.111567] schedule_rtlock+0x14/0x20 [ 11.111576] rtlock_slowlock_locked+0x468/0x730 [ 11.111587] rt_spin_lock+0x40/0x64 [ 11.111596] __wake_up_common_lock+0x5c/0xc4 [ 11.111610] __wake_up+0x18/0x24 [ 11.111620] mmc_blk_mq_req_done+0x68/0x138 [ 11.111633] mmc_request_done+0x104/0x118 [ 11.111644] meson_mmc_request_done+0x38/0x48 [ 11.111654] meson_mmc_irq+0x128/0x1f0 [ 11.111663] __handle_irq_event_percpu+0x70/0x114 [ 11.111674] handle_irq_event_percpu+0x18/0x4c [ 11.111683] handle_irq_event+0x80/0xb8 [ 11.111691] handle_fasteoi_irq+0xa4/0x120 [ 11.111704] handle_irq_desc+0x20/0x38 [ 11.111712] generic_handle_domain_irq+0x1c/0x28 [ 11.111721] gic_handle_irq+0x8c/0xa8 [ 11.111735] call_on_irq_stack+0x24/0x4c [ 11.111746] do_interrupt_handler+0x88/0x94 [ 11.111757] el1_interrupt+0x34/0x64 [ 11.111769] el1h_64_irq_handler+0x18/0x24 [ 11.111779] el1h_64_irq+0x64/0x68 [ 11.111786] __add_wait_queue+0x0/0x4c [ 11.111795] mmc_blk_rw_wait+0x84/0x118 [ 11.111804] mmc_blk_mq_issue_rq+0x5c4/0x654 [ 11.111814] mmc_mq_queue_rq+0x194/0x214 [ 11.111822] blk_mq_dispatch_rq_list+0x3ac/0x528 [ 11.111834] __blk_mq_sched_dispatch_requests+0x340/0x4d0 [ 11.111847] blk_mq_sched_dispatch_requests+0x38/0x70 [ 11.111858] blk_mq_run_work_fn+0x3c/0x70 [ 11.111865] process_one_work+0x17c/0x1f0 [ 11.111876] worker_thread+0x1d4/0x26c [ 11.111885] kthread+0xe4/0xf4 [ 11.111894] ret_from_fork+0x10/0x20 Fixes: 51c5d8447bd7 ("MMC: meson: initial support for GX platforms") Cc: stable@vger.kernel.org Signed-off-by: Martin Hundebøll Link: https://lore.kernel.org/r/20230607082713.517157-1-martin@geanix.com Signed-off-by: Ulf Hansson commit 3b0d2819522235d003df8da68caadc5d226d4c1d Merge: 41f2c7c342d3a 84ad0af0bccd3 Author: Paolo Abeni Date: Wed Jun 14 10:31:42 2023 +0200 Merge branch 'net-sched-fix-race-conditions-in-mini_qdisc_pair_swap' Peilin Ye says: ==================== net/sched: Fix race conditions in mini_qdisc_pair_swap() These 2 patches fix race conditions for ingress and clsact Qdiscs as reported [1] by syzbot, split out from another [2] series (last 2 patches of it). Per-patch changelog omitted. Patch 1 hasn't been touched since last version; I just included everybody's tag. Patch 2 bases on patch 6 v1 of [2], with comments and commit log slightly changed. We also need rtnl_dereference() to load ->qdisc_sleeping since commit d636fc5dd692 ("net: sched: add rcu annotations around qdisc->qdisc_sleeping"), so I changed that; please take yet another look, thanks! Patch 2 has been tested with the new reproducer Pedro posted [3]. [1] https://syzkaller.appspot.com/bug?extid=b53a9c0d1ea4ad62da8b [2] https://lore.kernel.org/r/cover.1684887977.git.peilin.ye@bytedance.com/ [3] https://lore.kernel.org/r/7879f218-c712-e9cc-57ba-665990f5f4c9@mojatatu.com/ ==================== Link: https://lore.kernel.org/r/cover.1686355297.git.peilin.ye@bytedance.com Signed-off-by: Paolo Abeni commit 84ad0af0bccd3691cb951c2974c5cb2c10594d4a Author: Peilin Ye Date: Sat Jun 10 20:30:25 2023 -0700 net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting mini_Qdisc_pair::p_miniq is a double pointer to mini_Qdisc, initialized in ingress_init() to point to net_device::miniq_ingress. ingress Qdiscs access this per-net_device pointer in mini_qdisc_pair_swap(). Similar for clsact Qdiscs and miniq_egress. Unfortunately, after introducing RTNL-unlocked RTM_{NEW,DEL,GET}TFILTER requests (thanks Hillf Danton for the hint), when replacing ingress or clsact Qdiscs, for example, the old Qdisc ("@old") could access the same miniq_{in,e}gress pointer(s) concurrently with the new Qdisc ("@new"), causing race conditions [1] including a use-after-free bug in mini_qdisc_pair_swap() reported by syzbot: BUG: KASAN: slab-use-after-free in mini_qdisc_pair_swap+0x1c2/0x1f0 net/sched/sch_generic.c:1573 Write of size 8 at addr ffff888045b31308 by task syz-executor690/14901 ... Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:319 print_report mm/kasan/report.c:430 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:536 mini_qdisc_pair_swap+0x1c2/0x1f0 net/sched/sch_generic.c:1573 tcf_chain_head_change_item net/sched/cls_api.c:495 [inline] tcf_chain0_head_change.isra.0+0xb9/0x120 net/sched/cls_api.c:509 tcf_chain_tp_insert net/sched/cls_api.c:1826 [inline] tcf_chain_tp_insert_unique net/sched/cls_api.c:1875 [inline] tc_new_tfilter+0x1de6/0x2290 net/sched/cls_api.c:2266 ... @old and @new should not affect each other. In other words, @old should never modify miniq_{in,e}gress after @new, and @new should not update @old's RCU state. Fixing without changing sch_api.c turned out to be difficult (please refer to Closes: for discussions). Instead, make sure @new's first call always happen after @old's last call (in {ingress,clsact}_destroy()) has finished: In qdisc_graft(), return -EBUSY if @old has any ongoing filter requests, and call qdisc_destroy() for @old before grafting @new. Introduce qdisc_refcount_dec_if_one() as the counterpart of qdisc_refcount_inc_nz() used for filter requests. Introduce a non-static version of qdisc_destroy() that does a TCQ_F_BUILTIN check, just like qdisc_put() etc. Depends on patch "net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs". [1] To illustrate, the syzkaller reproducer adds ingress Qdiscs under TC_H_ROOT (no longer possible after commit c7cfbd115001 ("net/sched: sch_ingress: Only create under TC_H_INGRESS")) on eth0 that has 8 transmission queues: Thread 1 creates ingress Qdisc A (containing mini Qdisc a1 and a2), then adds a flower filter X to A. Thread 2 creates another ingress Qdisc B (containing mini Qdisc b1 and b2) to replace A, then adds a flower filter Y to B. Thread 1 A's refcnt Thread 2 RTM_NEWQDISC (A, RTNL-locked) qdisc_create(A) 1 qdisc_graft(A) 9 RTM_NEWTFILTER (X, RTNL-unlocked) __tcf_qdisc_find(A) 10 tcf_chain0_head_change(A) mini_qdisc_pair_swap(A) (1st) | | RTM_NEWQDISC (B, RTNL-locked) RCU sync 2 qdisc_graft(B) | 1 notify_and_destroy(A) | tcf_block_release(A) 0 RTM_NEWTFILTER (Y, RTNL-unlocked) qdisc_destroy(A) tcf_chain0_head_change(B) tcf_chain0_head_change_cb_del(A) mini_qdisc_pair_swap(B) (2nd) mini_qdisc_pair_swap(A) (3rd) | ... ... Here, B calls mini_qdisc_pair_swap(), pointing eth0->miniq_ingress to its mini Qdisc, b1. Then, A calls mini_qdisc_pair_swap() again during ingress_destroy(), setting eth0->miniq_ingress to NULL, so ingress packets on eth0 will not find filter Y in sch_handle_ingress(). This is just one of the possible consequences of concurrently accessing miniq_{in,e}gress pointers. Fixes: 7a096d579e8e ("net: sched: ingress: set 'unlocked' flag for Qdisc ops") Fixes: 87f373921c4e ("net: sched: ingress: set 'unlocked' flag for clsact Qdisc ops") Reported-by: syzbot+b53a9c0d1ea4ad62da8b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/0000000000006cf87705f79acf1a@google.com/ Cc: Hillf Danton Cc: Vlad Buslov Signed-off-by: Peilin Ye Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit 2d5f6a8d7aef7852a9ecc555f88c673a1c91754f Author: Peilin Ye Date: Sat Jun 10 20:30:15 2023 -0700 net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs Grafting ingress and clsact Qdiscs does not need a for-loop in qdisc_graft(). Refactor it. No functional changes intended. Tested-by: Pedro Tammela Acked-by: Jamal Hadi Salim Reviewed-by: Jamal Hadi Salim Reviewed-by: Vlad Buslov Signed-off-by: Peilin Ye Signed-off-by: Paolo Abeni commit 41f2c7c342d3adb1c4dd5f2e3dd831adff16a669 Author: Paul Blakey Date: Fri Jun 9 15:22:59 2023 +0300 net/sched: act_ct: Fix promotion of offloaded unreplied tuple Currently UNREPLIED and UNASSURED connections are added to the nf flow table. This causes the following connection packets to be processed by the flow table which then skips conntrack_in(), and thus such the connections will remain UNREPLIED and UNASSURED even if reply traffic is then seen. Even still, the unoffloaded reply packets are the ones triggering hardware update from new to established state, and if there aren't any to triger an update and/or previous update was missed, hardware can get out of sync with sw and still mark packets as new. Fix the above by: 1) Not skipping conntrack_in() for UNASSURED packets, but still refresh for hardware, as before the cited patch. 2) Try and force a refresh by reply-direction packets that update the hardware rules from new to established state. 3) Remove any bidirectional flows that didn't failed to update in hardware for re-insertion as bidrectional once any new packet arrives. Fixes: 6a9bad0069cf ("net/sched: act_ct: offload UDP NEW connections") Co-developed-by: Vlad Buslov Signed-off-by: Vlad Buslov Signed-off-by: Paul Blakey Reviewed-by: Florian Westphal Link: https://lore.kernel.org/r/1686313379-117663-1-git-send-email-paulb@nvidia.com Signed-off-by: Paolo Abeni commit f1a0898b5d6a77d332d036da03bad6fa9770de5b Author: Hugh Dickins Date: Fri Jun 9 14:29:39 2023 -0700 wifi: iwlwifi: mvm: spin_lock_bh() to fix lockdep regression Lockdep on 6.4-rc on ThinkPad X1 Carbon 5th says ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 6.4.0-rc5 #1 Not tainted ----------------------------------------------------- kworker/3:1/49 [HC0[0]:SC0[4]:HE1:SE0] is trying to acquire: ffff8881066fa368 (&mvm_sta->deflink.lq_sta.rs_drv.pers.lock){+.+.}-{2:2}, at: rs_drv_get_rate+0x46/0xe7 and this task is already holding: ffff8881066f80a8 (&sta->rate_ctrl_lock){+.-.}-{2:2}, at: rate_control_get_rate+0xbd/0x126 which would create a new lock dependency: (&sta->rate_ctrl_lock){+.-.}-{2:2} -> (&mvm_sta->deflink.lq_sta.rs_drv.pers.lock){+.+.}-{2:2} but this new dependency connects a SOFTIRQ-irq-safe lock: (&sta->rate_ctrl_lock){+.-.}-{2:2} etc. etc. etc. Changing the spin_lock() in rs_drv_get_rate() to spin_lock_bh() was not enough to pacify lockdep, but changing them all on pers.lock has worked. Fixes: a8938bc881d2 ("wifi: iwlwifi: mvm: Add locking to the rate read flow") Signed-off-by: Hugh Dickins Link: https://lore.kernel.org/r/79ffcc22-9775-cb6d-3ffd-1a517c40beef@google.com Signed-off-by: Johannes Berg commit 07b1cc841b4f283f3bc34d228690f88b17e57008 Merge: 374283a100127 11b8b2e70a9b4 Author: Jakub Kicinski Date: Tue Jun 13 20:49:16 2023 -0700 Merge branch 'fix-small-bugs-and-annoyances-in-tc-testing' Vlad Buslov says: ==================== Fix small bugs and annoyances in tc-testing ==================== Link: https://lore.kernel.org/r/20230612075712.2861848-1-vladbu@nvidia.com Signed-off-by: Jakub Kicinski commit 11b8b2e70a9b4a1b60eefc0cd79cd2d3c08545f1 Author: Vlad Buslov Date: Mon Jun 12 09:57:12 2023 +0200 selftests/tc-testing: Remove configs that no longer exist Some qdiscs and classifiers have recently been retired from kernel. However, tc-testing config is still cluttered with them which causes noise when using merge_config.sh script to update existing config for tc-testing compatibility. Remove the config settings for affected qdiscs and classifiers. Fixes: fb38306ceb9e ("net/sched: Retire ATM qdisc") Fixes: 051d44209842 ("net/sched: Retire CBQ qdisc") Fixes: bbe77c14ee61 ("net/sched: Retire dsmark qdisc") Fixes: 265b4da82dbf ("net/sched: Retire rsvp classifier") Fixes: 8c710f75256b ("net/sched: Retire tcindex classifier") Signed-off-by: Vlad Buslov Reviewed-by: Pedro Tammela Signed-off-by: Jakub Kicinski commit b39d8c41c7a8336ce85c376b5d4906089524a0ae Author: Vlad Buslov Date: Mon Jun 12 09:57:11 2023 +0200 selftests/tc-testing: Fix SFB db test Setting very small value of db like 10ms introduces rounding errors when converting to/from jiffies on some kernel configs. For example, on 250hz the actual value will be set to 12ms which causes the test to fail: # $ sudo ./tdc.py -d eth2 -e 3410 # -- ns/SubPlugin.__init__ # Test 3410: Create SFB with db setting # # All test results: # # 1..1 # not ok 1 3410 - Create SFB with db setting # Could not match regex pattern. Verify command output: # qdisc sfb 1: root refcnt 2 rehash 600s db 12ms limit 1000p max 25p target 20p increment 0.000503548 decrement 4.57771e-05 penalty_rate 10pps penalty_burst 20p Set the value to 100ms instead which currently seem to work on 100hz, 250hz, 300hz and 1000hz kernel configs. Fixes: 6ad92dc56fca ("selftests/tc-testing: add selftests for sfb qdisc") Signed-off-by: Vlad Buslov Reviewed-by: Pedro Tammela Signed-off-by: Jakub Kicinski commit b849c566ee9c6ed78288a522278dcaf419f8e239 Author: Vlad Buslov Date: Mon Jun 12 09:57:10 2023 +0200 selftests/tc-testing: Fix Error: failed to find target LOG Add missing netfilter config dependency. Fixes following example error when running tests via tdc.sh for all XT tests: # $ sudo ./tdc.py -d eth2 -e 2029 # Test 2029: Add xt action with log-prefix # exit: 255 # exit: 0 # failed to find target LOG # # bad action parsing # parse_action: bad value (7:xt)! # Illegal "action" # # -----> teardown stage *** Could not execute: "$TC actions flush action xt" # # -----> teardown stage *** Error message: "Error: Cannot flush unknown TC action. # We have an error flushing # " # returncode 1; expected [0] # # -----> teardown stage *** Aborting test run. # # <_io.BufferedReader name=3> *** stdout *** # # <_io.BufferedReader name=5> *** stderr *** # "-----> teardown stage" did not complete successfully # Exception ('teardown', ' failed to find target LOG\n\nbad action parsing\nparse_action: bad value (7:xt)!\nIllegal "action"\n', '"-----> teardown stage" did not complete successfully') (caught in test_runner, running test 2 2029 Add xt action with log-prefix stage teardown) # --------------- # traceback # File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 495, in test_runner # res = run_one_test(pm, args, index, tidx) # File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 434, in run_one_test # prepare_env(args, pm, 'teardown', '-----> teardown stage', tidx['teardown'], procout) # File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 245, in prepare_env # raise PluginMgrTestFail( # --------------- # accumulated output for this test: # failed to find target LOG # # bad action parsing # parse_action: bad value (7:xt)! # Illegal "action" # # --------------- # # All test results: # # 1..1 # ok 1 2029 - Add xt action with log-prefix # skipped - "-----> teardown stage" did not complete successfully Fixes: 910d504bc187 ("selftests/tc-testings: add selftests for xt action") Signed-off-by: Vlad Buslov Reviewed-by: Pedro Tammela Signed-off-by: Jakub Kicinski commit aef6e908b54200d04f2d77dab31509fcff2e60ae Author: Vlad Buslov Date: Mon Jun 12 09:57:09 2023 +0200 selftests/tc-testing: Fix Error: Specified qdisc kind is unknown. All TEQL tests assume that sch_teql module is loaded. Load module in tdc.sh before running qdisc tests. Fixes following example error when running tests via tdc.sh for all TEQL tests: # $ sudo ./tdc.py -d eth2 -e 84a0 # -- ns/SubPlugin.__init__ # Test 84a0: Create TEQL with default setting # exit: 2 # exit: 0 # Error: Specified qdisc kind is unknown. # # -----> teardown stage *** Could not execute: "$TC qdisc del dev $DUMMY handle 1: root" # # -----> teardown stage *** Error message: "Error: Invalid handle. # " # returncode 2; expected [0] # # -----> teardown stage *** Aborting test run. # # <_io.BufferedReader name=3> *** stdout *** # # <_io.BufferedReader name=5> *** stderr *** # "-----> teardown stage" did not complete successfully # Exception ('teardown', 'Error: Specified qdisc kind is unknown.\n', '"-----> teardown stage" did not complete successfully') (caught in test_runner, running test 2 84a0 Create TEQL with default setting stage teardown) # --------------- # traceback # File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 495, in test_runner # res = run_one_test(pm, args, index, tidx) # File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 434, in run_one_test # prepare_env(args, pm, 'teardown', '-----> teardown stage', tidx['teardown'], procout) # File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 245, in prepare_env # raise PluginMgrTestFail( # --------------- # accumulated output for this test: # Error: Specified qdisc kind is unknown. # # --------------- # # All test results: # # 1..1 # ok 1 84a0 - Create TEQL with default setting # skipped - "-----> teardown stage" did not complete successfully Fixes: cc62fbe114c9 ("selftests/tc-testing: add selftests for teql qdisc") Signed-off-by: Vlad Buslov Reviewed-by: Victor Nogueira Reviewed-by: Pedro Tammela Signed-off-by: Jakub Kicinski commit 374283a1001277e4d07491387aac1fad5aa08d43 Author: Dan Carpenter Date: Mon Jun 12 10:18:50 2023 +0300 net: ethernet: ti: am65-cpsw: Call of_node_put() on error path This code returns directly but it should instead call of_node_put() to drop some reference counts. Fixes: dab2b265dd23 ("net: ethernet: ti: am65-cpsw: Add support for SERDES configuration") Signed-off-by: Dan Carpenter Reviewed-by: Roger Quadros Link: https://lore.kernel.org/r/e3012f0c-1621-40e6-bf7d-03c276f6e07f@kili.mountain Signed-off-by: Jakub Kicinski commit cac9e4418f4cbd548ccb065b3adcafe073f7f7d2 Author: Jens Axboe Date: Mon Jun 12 13:51:36 2023 -0600 io_uring/net: save msghdr->msg_control for retries If the application sets ->msg_control and we have to later retry this command, or if it got queued with IOSQE_ASYNC to begin with, then we need to retain the original msg_control value. This is due to the net stack overwriting this field with an in-kernel pointer, to copy it in. Hitting that path for the second time will now fail the copy from user, as it's attempting to copy from a non-user address. Cc: stable@vger.kernel.org # 5.10+ Link: https://github.com/axboe/liburing/issues/880 Reported-and-tested-by: Marek Majkowski Signed-off-by: Jens Axboe commit b6dad5178ceaf23f369c3711062ce1f2afc33644 Merge: 15adb51c04ccf 85041e12418fd Author: Linus Torvalds Date: Tue Jun 13 17:00:33 2023 -0700 Merge tag 'nios2_fix_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull NIOS2 dts fix from Dinh Nguyen: - Fix tse_mac "max-frame-size" property * tag 'nios2_fix_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: dts: Fix tse_mac "max-frame-size" property commit b78b34c6043ec811ab03bf77a7808a2df522d549 Merge: ad96f1c9138e0 84a62b445c86d Author: Alexei Starovoitov Date: Tue Jun 13 15:13:52 2023 -0700 Merge branch 'bpf: fix NULL dereference during extable search' Krister Johansen says: ==================== Hi, Enclosed are a pair of patches for an oops that can occur if an exception is generated while a bpf subprogram is running. One of the bpf_prog_aux entries for the subprograms are missing an extable. This can lead to an exception that would otherwise be handled turning into a NULL pointer bug. These changes were tested via the verifier and progs selftests and no regressions were observed. Changes from v4: - Ensure that num_exentries is copied to prog->aux from func[0] (Feedback from Ilya Leoshkevich) Changes from v3: - Selftest style fixups (Feedback from Yonghong Song) - Selftest needs to assert that test bpf program executed (Feedback from Yonghong Song) - Selftest should combine open and load using open_and_load (Feedback from Yonghong Song) Changes from v2: - Insert only the main program's kallsyms (Feedback from Yonghong Song and Alexei Starovoitov) - Selftest should use ASSERT instead of CHECK (Feedback from Yonghong Song) - Selftest needs some cleanup (Feedback from Yonghong Song) - Switch patch order (Feedback from Alexei Starovoitov) Changes from v1: - Add a selftest (Feedback From Alexei Starovoitov) - Move to a 1-line verifier change instead of searching multiple extables ==================== Signed-off-by: Alexei Starovoitov commit 84a62b445c86d0f2c9831290ffecee7269f18254 Author: Krister Johansen Date: Mon Jun 12 17:44:54 2023 -0700 selftests/bpf: add a test for subprogram extables In certain situations a program with subprograms may have a NULL extable entry. This should not happen, and when it does, it turns a single trap into multiple. Add a test case for further debugging and to prevent regressions. The test-case contains three essentially identical versions of the same test because just one program may not be sufficient to trigger the oops. This is due to the fact that the items are stored in a binary tree and have identical values so it's possible to sometimes find the ksym with the extable. With 3 copies, this has been reliable on this author's test systems. When triggered out of this test case, the oops looks like this: BUG: kernel NULL pointer dereference, address: 000000000000000c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 1132 Comm: test_progs Tainted: G OE 6.4.0-rc3+ #2 RIP: 0010:cmp_ex_search+0xb/0x30 Code: cc cc cc cc e8 36 cb 03 00 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 48 8b 07 <48> 63 0e 48 01 f1 31 d2 48 39 c8 19 d2 48 39 c8 b8 01 00 00 00 0f RSP: 0018:ffffb30c4291f998 EFLAGS: 00010006 RAX: ffffffffc00b49da RBX: 0000000000000002 RCX: 000000000000000c RDX: 0000000000000002 RSI: 000000000000000c RDI: ffffb30c4291f9e8 RBP: ffffb30c4291f998 R08: ffffffffab1a42d0 R09: 0000000000000001 R10: 0000000000000000 R11: ffffffffab1a42d0 R12: ffffb30c4291f9e8 R13: 000000000000000c R14: 000000000000000c R15: 0000000000000000 FS: 00007fb5d9e044c0(0000) GS:ffff92e95ee00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 000000010c3a2005 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: bsearch+0x41/0x90 ? __pfx_cmp_ex_search+0x10/0x10 ? bpf_prog_45a7907e7114d0ff_handle_fexit_ret_subprogs3+0x2a/0x6c search_extable+0x3b/0x60 ? bpf_prog_45a7907e7114d0ff_handle_fexit_ret_subprogs3+0x2a/0x6c search_bpf_extables+0x10d/0x190 ? bpf_prog_45a7907e7114d0ff_handle_fexit_ret_subprogs3+0x2a/0x6c search_exception_tables+0x5d/0x70 fixup_exception+0x3f/0x5b0 ? look_up_lock_class+0x61/0x110 ? __lock_acquire+0x6b8/0x3560 ? __lock_acquire+0x6b8/0x3560 ? __lock_acquire+0x6b8/0x3560 kernelmode_fixup_or_oops+0x46/0x110 __bad_area_nosemaphore+0x68/0x2b0 ? __lock_acquire+0x6b8/0x3560 bad_area_nosemaphore+0x16/0x20 do_kern_addr_fault+0x81/0xa0 exc_page_fault+0xd6/0x210 asm_exc_page_fault+0x2b/0x30 RIP: 0010:bpf_prog_45a7907e7114d0ff_handle_fexit_ret_subprogs3+0x2a/0x6c Code: f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 7f 08 49 bb 00 00 00 00 00 80 00 00 4c 39 df 73 04 31 f6 eb 04 <48> 8b 77 00 49 bb 00 00 00 00 00 80 00 00 48 81 c7 7c 00 00 00 4c RSP: 0018:ffffb30c4291fcb8 EFLAGS: 00010282 RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 00000000cddf1af1 RSI: 000000005315a00d RDI: ffffffffffffffea RBP: ffffb30c4291fcb8 R08: ffff92e644bf38a8 R09: 0000000000000000 R10: 0000000000000000 R11: 0000800000000000 R12: ffff92e663652690 R13: 00000000000001c8 R14: 00000000000001c8 R15: 0000000000000003 bpf_trampoline_251255721842_2+0x63/0x1000 bpf_testmod_return_ptr+0x9/0xb0 [bpf_testmod] ? bpf_testmod_test_read+0x43/0x2d0 [bpf_testmod] sysfs_kf_bin_read+0x60/0x90 kernfs_fop_read_iter+0x143/0x250 vfs_read+0x240/0x2a0 ksys_read+0x70/0xe0 __x64_sys_read+0x1f/0x30 do_syscall_64+0x68/0xa0 ? syscall_exit_to_user_mode+0x77/0x1f0 ? do_syscall_64+0x77/0xa0 ? irqentry_exit+0x35/0xa0 ? sysvec_apic_timer_interrupt+0x4d/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fb5da00a392 Code: ac 00 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb be 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 RSP: 002b:00007ffc5b3cab68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000055bee7b8b100 RCX: 00007fb5da00a392 RDX: 00000000000001c8 RSI: 0000000000000000 RDI: 0000000000000009 RBP: 00007ffc5b3caba0 R08: 0000000000000000 R09: 0000000000000037 R10: 000055bee7b8c2a7 R11: 0000000000000246 R12: 000055bee78f1f60 R13: 00007ffc5b3cae90 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: bpf_testmod(OE) nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua intel_rapl_msr intel_rapl_common intel_uncore_frequency_common ppdev nfit crct10dif_pclmul crc32_pclmul psmouse ghash_clmulni_intel sha512_ssse3 aesni_intel parport_pc crypto_simd cryptd input_leds parport rapl ena i2c_piix4 mac_hid serio_raw ramoops reed_solomon pstore_blk drm pstore_zone efi_pstore autofs4 [last unloaded: bpf_testmod(OE)] CR2: 000000000000000c Though there may be some variation, depending on which suprogram triggers the bug. Signed-off-by: Krister Johansen Acked-by: Yonghong Song Link: https://lore.kernel.org/r/4ebf95ec857cd785b81db69f3e408c039ad8408b.1686616663.git.kjlx@templeofstupid.com Signed-off-by: Alexei Starovoitov commit 0108a4e9f3584a7a2c026d1601b0682ff7335d95 Author: Krister Johansen Date: Mon Jun 12 17:44:40 2023 -0700 bpf: ensure main program has an extable When subprograms are in use, the main program is not jit'd after the subprograms because jit_subprogs sets a value for prog->bpf_func upon success. Subsequent calls to the JIT are bypassed when this value is non-NULL. This leads to a situation where the main program and its func[0] counterpart are both in the bpf kallsyms tree, but only func[0] has an extable. Extables are only created during JIT. Now there are two nearly identical program ksym entries in the tree, but only one has an extable. Depending upon how the entries are placed, there's a chance that a fault will call search_extable on the aux with the NULL entry. Since jit_subprogs already copies state from func[0] to the main program, include the extable pointer in this state duplication. Additionally, ensure that the copy of the main program in func[0] is not added to the bpf_prog_kallsyms table. Instead, let the main program get added later in bpf_prog_load(). This ensures there is only a single copy of the main program in the kallsyms table, and that its tag matches the tag observed by tooling like bpftool. Cc: stable@vger.kernel.org Fixes: 1c2a088a6626 ("bpf: x64: add JIT support for multi-function programs") Signed-off-by: Krister Johansen Acked-by: Yonghong Song Acked-by: Ilya Leoshkevich Tested-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/6de9b2f4b4724ef56efbb0339daaa66c8b68b1e7.1686616663.git.kjlx@templeofstupid.com Signed-off-by: Alexei Starovoitov commit 85041e12418fd0c08ff972b7729f7971afb361f8 Author: Janne Grunau Date: Sun Feb 12 13:16:32 2023 +0100 nios2: dts: Fix tse_mac "max-frame-size" property The given value of 1518 seems to refer to the layer 2 ethernet frame size without 802.1Q tag. Actual use of the "max-frame-size" including in the consumer of the "altr,tse-1.0" compatible is the MTU. Fixes: 95acd4c7b69c ("nios2: Device tree support") Fixes: 61c610ec61bb ("nios2: Add Max10 device tree") Cc: Signed-off-by: Janne Grunau Signed-off-by: Dinh Nguyen commit 7c5835bcb9176df94683396f1c0e5df6bf5094b3 Author: Peichen Huang Date: Wed May 31 13:36:14 2023 +0800 drm/amd/display: limit DPIA link rate to HBR3 [Why] DPIA doesn't support UHBR, driver should not enable UHBR for dp tunneling [How] limit DPIA link rate to HBR3 Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Acked-by: Stylon Wang Signed-off-by: Peichen Huang Reviewed-by: Mustapha Ghaddar Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ea2062dd1f0384ae1b136d333ee4ced15bedae38 Author: Tom Chung Date: Mon May 29 18:00:09 2023 +0800 drm/amd/display: fix the system hang while disable PSR [Why] When the PSR enabled. If you try to adjust the timing parameters, it may cause system hang. Because the timing mismatch with the DMCUB settings. [How] Disable the PSR before adjusting timing parameters. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Acked-by: Stylon Wang Signed-off-by: Tom Chung Reviewed-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e749dd10e5f292061ad63d2b030194bf7d7d452c Author: Hersen Wu Date: Thu May 25 08:37:40 2023 -0400 drm/amd/display: edp do not add non-edid timings [Why] most edp support only timings from edid. applying non-edid timings, especially those timings out of edp bandwidth, may damage edp. [How] do not add non-edid timings for edp. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Acked-by: Stylon Wang Signed-off-by: Hersen Wu Reviewed-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 34e5a54327dce5033582f3609eb54812a8c61b90 Author: Arunpravin Paneer Selvam Date: Fri Jun 9 06:18:41 2023 -0700 Revert "drm/amdgpu: remove TOPDOWN flags when allocating VRAM in large bar system" This reverts commit c105518679b6e87232874ffc989ec403bee59664. This patch disables the TOPDOWN flag for APU and few dGPU cards which has the VRAM size equal to the BAR size. When we enable the TOPDOWN flag, we get the free blocks at the highest available memory region and we don't split the lower order blocks. This change is required to keep off the fragmentation related issues particularly in ASIC which has VRAM space <= 500MiB Hence, we are reverting this patch. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2270 Signed-off-by: Arunpravin Paneer Selvam Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 9db5ec1ceb5303398ec4f899d691073d531257c3 Author: Sonny Jiang Date: Tue Jun 6 17:18:52 2023 -0400 drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1 Only vcn0 can process AV1 codecx. In order to use both vcn0 and vcn1 in h264/265 transcode to AV1 cases, set vcn0 sched score to 1 at initialization time. Signed-off-by: Sonny Jiang Reviewed-by: Leo Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 7ac9be96b0113a34c33110b32912642bdc8ff33d Author: Thomas Zimmermann Date: Fri Jun 9 16:03:56 2023 +0200 drm/radeon: Disable outputs when releasing fbdev client Disable the modesetting pipeline before release the radeon's fbdev client. Fixes the following error: [ 17.217408] WARNING: CPU: 5 PID: 1464 at drivers/gpu/drm/ttm/ttm_bo.c:326 ttm_bo_release+0x27e/0x2d0 [ttm] [ 17.217418] Modules linked in: edac_mce_amd radeon(+) drm_ttm_helper ttm video drm_suballoc_helper drm_display_helper kvm irqbypass drm_kms_helper syscopyarea crc32_pclmul sysfillrect sha512_ssse3 sysimgblt sha512_generic cfbfillrect cfbimgblt wmi_bmof aesni_intel cfbcopyarea crypto_simd cryptd k10temp acpi_cpufreq wmi dm_mod [ 17.217432] CPU: 5 PID: 1464 Comm: systemd-udevd Not tainted 6.4.0-rc4+ #1 [ 17.217436] Hardware name: Micro-Star International Co., Ltd. MS-7A38/B450M PRO-VDH MAX (MS-7A38), BIOS B.G0 07/26/2022 [ 17.217438] RIP: 0010:ttm_bo_release+0x27e/0x2d0 [ttm] [ 17.217444] Code: 48 89 43 38 48 89 43 40 48 8b 5c 24 30 48 8b b5 40 08 00 00 48 8b 6c 24 38 48 83 c4 58 e9 7a 49 f7 e0 48 89 ef e9 6c fe ff ff <0f> 0b 48 83 7b 20 00 0f 84 b7 fd ff ff 0f 0b 0f 1f 00 e9 ad fd ff [ 17.217448] RSP: 0018:ffffc9000095fbb0 EFLAGS: 00010202 [ 17.217451] RAX: 0000000000000001 RBX: ffff8881052c8de0 RCX: 0000000000000000 [ 17.217453] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8881052c8de0 [ 17.217455] RBP: ffff888104a66e00 R08: ffff8881052c8de0 R09: ffff888104a7cf08 [ 17.217457] R10: ffffc9000095fbe0 R11: ffffc9000095fbe8 R12: ffff8881052c8c78 [ 17.217458] R13: ffff8881052c8c78 R14: dead000000000100 R15: ffff88810528b108 [ 17.217460] FS: 00007f319fcbb8c0(0000) GS:ffff88881a540000(0000) knlGS:0000000000000000 [ 17.217463] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 17.217464] CR2: 000055dc8b0224a0 CR3: 000000010373d000 CR4: 0000000000750ee0 [ 17.217466] PKRU: 55555554 [ 17.217468] Call Trace: [ 17.217470] [ 17.217472] ? __warn+0x97/0x160 [ 17.217476] ? ttm_bo_release+0x27e/0x2d0 [ttm] [ 17.217481] ? report_bug+0x1ec/0x200 [ 17.217487] ? handle_bug+0x3c/0x70 [ 17.217490] ? exc_invalid_op+0x1f/0x90 [ 17.217493] ? preempt_count_sub+0xb5/0x100 [ 17.217496] ? asm_exc_invalid_op+0x16/0x20 [ 17.217500] ? ttm_bo_release+0x27e/0x2d0 [ttm] [ 17.217505] ? ttm_resource_move_to_lru_tail+0x1ab/0x1d0 [ttm] [ 17.217511] radeon_bo_unref+0x1a/0x30 [radeon] [ 17.217547] radeon_gem_object_free+0x20/0x30 [radeon] [ 17.217579] radeon_fbdev_fb_destroy+0x57/0x90 [radeon] [ 17.217616] unregister_framebuffer+0x72/0x110 [ 17.217620] drm_client_dev_unregister+0x6d/0xe0 [ 17.217623] drm_dev_unregister+0x2e/0x90 [ 17.217626] drm_put_dev+0x26/0x90 [ 17.217628] pci_device_remove+0x44/0xc0 [ 17.217631] really_probe+0x257/0x340 [ 17.217635] __driver_probe_device+0x73/0x120 [ 17.217638] driver_probe_device+0x2c/0xb0 [ 17.217641] __driver_attach+0xa0/0x150 [ 17.217643] ? __pfx___driver_attach+0x10/0x10 [ 17.217646] bus_for_each_dev+0x67/0xa0 [ 17.217649] bus_add_driver+0x10e/0x210 [ 17.217651] driver_register+0x5c/0x120 [ 17.217653] ? __pfx_radeon_module_init+0x10/0x10 [radeon] [ 17.217681] do_one_initcall+0x44/0x220 [ 17.217684] ? kmalloc_trace+0x37/0xc0 [ 17.217688] do_init_module+0x64/0x240 [ 17.217691] __do_sys_finit_module+0xb2/0x100 [ 17.217694] do_syscall_64+0x3b/0x90 [ 17.217697] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 17.217700] RIP: 0033:0x7f319feaa5a9 [ 17.217702] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 27 08 0d 00 f7 d8 64 89 01 48 [ 17.217706] RSP: 002b:00007ffc6bf3e7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 17.217709] RAX: ffffffffffffffda RBX: 00005607204f3170 RCX: 00007f319feaa5a9 [ 17.217710] RDX: 0000000000000000 RSI: 00007f31a002eefd RDI: 0000000000000018 [ 17.217712] RBP: 00007f31a002eefd R08: 0000000000000000 R09: 00005607204f1860 [ 17.217714] R10: 0000000000000018 R11: 0000000000000246 R12: 0000000000020000 [ 17.217716] R13: 0000000000000000 R14: 0000560720522450 R15: 0000560720255899 [ 17.217718] [ 17.217719] ---[ end trace 0000000000000000 ]--- The buffer object backing the fbdev emulation got pinned twice: by the fb_probe helper radeon_fbdev_create_pinned_object() and the modesetting code when the framebuffer got displayed. It only got unpinned once by the fbdev helper radeon_fbdev_destroy_pinned_object(). Hence TTM's BO- release function complains about the pin counter. Forcing the outputs off also undoes the modesettings pin increment. Tested-by: Borislav Petkov (AMD) Reported-by: Borislav Petkov Closes: https://lore.kernel.org/dri-devel/20230603174814.GCZHt83pN+wNjf63sC@fat_crate.local/ Signed-off-by: Thomas Zimmermann Fixes: e317a69fe891 ("drm/radeon: Implement client-based fbdev emulation") Cc: Alex Deucher Cc: Thomas Zimmermann Cc: "Christian König" Cc: "Pan, Xinhui" Cc: amd-gfx@lists.freedesktop.org Signed-off-by: Alex Deucher commit 7ca302d488f80cf4529620acc1c545f9022d8bb8 Author: Kenneth Feng Date: Thu Jun 8 22:07:11 2023 +0800 drm/amd/pm: workaround for compute workload type on some skus On smu 13.0.0, the compute workload type cannot be set on all the skus due to some other problems. This workaround is to make sure compute workload type can also run on some specific skus. v2: keep the variable consistent Signed-off-by: Kenneth Feng Acked-by: Lijo Lazar Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 7ab1a4913d0051cf5196ef7987b5fa42c25e13b6 Author: Mario Limonciello Date: Wed Jun 7 01:45:20 2023 -0500 drm/amd: Tighten permissions on VBIOS flashing attributes Non-root users shouldn't be able to try to trigger a VBIOS flash or query the flashing status. This should be reserved for users with the appropriate permissions. Cc: stable@vger.kernel.org Fixes: 8424f2ccb3c0 ("drm/amdgpu/psp: Add vbflash sysfs interface support") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 3eb1a3a04056ba3df3205e169b8acc9da0c65a94 Author: Mario Limonciello Date: Wed Jun 7 01:41:22 2023 -0500 drm/amd: Make sure image is written to trigger VBIOS image update flow The VBIOS image update flow requires userspace to: 1) Write the image to `psp_vbflash` 2) Read `psp_vbflash` 3) Poll `psp_vbflash_status` to check for completion If userspace reads `psp_vbflash` before writing an image, it's possible that it causes problems that can put the dGPU into an invalid state. Explicitly check that an image has been written before letting a read succeed. Cc: stable@vger.kernel.org Fixes: 8424f2ccb3c0 ("drm/amdgpu/psp: Add vbflash sysfs interface support") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit e61f67749b351c19455ce3085af2ae9af80023bc Author: Alex Deucher Date: Tue Jun 6 11:14:04 2023 -0400 drm/amdgpu: add missing radeon secondary PCI ID 0x5b70 is a missing RV370 secondary id. Add it so we don't try and probe it with amdgpu. Cc: michel@daenzer.net Reviewed-by: Michel Dänzer Tested-by: Michel Dänzer Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5b711e7f9c73e5ff44d6ac865711d9a05c2a0360 Author: Jiadong Zhu Date: Thu May 25 18:42:15 2023 +0800 drm/amdgpu: Implement gfx9 patch functions for resubmission Patch the packages including CONTEXT_CONTROL and WRITE_DATA for gfx9 during the resubmission scenario. Signed-off-by: Jiadong Zhu Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.3.x commit 87af86ae89963c227a3beb4d914f3dc7959a690e Author: Jiadong Zhu Date: Thu May 25 16:52:55 2023 +0800 drm/amdgpu: Modify indirect buffer packages for resubmission When the preempted IB frame resubmitted to cp, we need to modify the frame data including: 1. set PRE_RESUME 1 in CONTEXT_CONTROL. 2. use meta data(DE and CE) read from CSA in WRITE_DATA. Add functions to save the location the first time IBs emitted and callback to patch the package when resubmission happens. Signed-off-by: Jiadong Zhu Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.3.x commit 94034b306ddde4a4a9c1a597ae7f61f04b710dc7 Author: Jiadong Zhu Date: Wed May 24 16:51:32 2023 +0800 drm/amdgpu: Program gds backup address as zero if no gds allocated It is firmware requirement to set gds_backup_addrlo and gds_backup_addrhi of DE meta both zero if no gds partition is allocated for the frame. Signed-off-by: Jiadong Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.3.x commit 55b94bb8c42464bad3d2217f6874aa1a85664eac Author: Natalia Petrova Date: Fri May 12 13:33:20 2023 +0300 drm/nouveau: add nv_encoder pointer check for NULL Pointer nv_encoder could be dereferenced at nouveau_connector.c in case it's equal to NULL by jumping to goto label. This patch adds a NULL-check to avoid it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 3195c5f9784a ("drm/nouveau: set encoder for lvds") Signed-off-by: Natalia Petrova Reviewed-by: Lyude Paul [Fixed patch title] Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230512103320.82234-1-n.petrova@fintech.ru commit 1dbcf770cc2d15baf8a1e8174d6fd014a68b45ca Author: Jiadong Zhu Date: Wed May 24 11:42:19 2023 +0800 drm/amdgpu: Reset CP_VMID_PREEMPT after trailing fence signaled When MEC executes unmap_queue for mid command buffer preemption, it will kick the write pointer of the gfx ring, set CP_VMID_PREEMPT to trigger the preemption and wait for CP_VMID_PREEMPT becomes zero after the preemption done. There is a race condition that PFP may excute the resetting command before MEC set CP_VMID_PREEMPT. As a result, hang happens as CP_VMID_PREEMPT is always 0xffff. To avoid this, we send resetting CP_VMID_PREEMPT command after the trailing fence is siganled and update gfx write pointer explicitly. Signed-off-by: Jiadong Zhu Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.3.x Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2535 commit 20a2ce87fbaf81e4c3dcb631d738e423959eb320 Author: Natalia Petrova Date: Fri May 12 14:15:26 2023 +0300 drm/nouveau/dp: check for NULL nv_connector->native_mode Add checking for NULL before calling nouveau_connector_detect_depth() in nouveau_connector_get_modes() function because nv_connector->native_mode could be dereferenced there since connector pointer passed to nouveau_connector_detect_depth() and the same value of nv_connector->native_mode is used there. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d4c2c99bdc83 ("drm/nouveau/dp: remove broken display depth function, use the improved one") Signed-off-by: Natalia Petrova Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230512111526.82408-1-n.petrova@fintech.ru commit eee43699217504ba69cadefc85c6992df555e33f Author: Abe Kohandel Date: Tue Jun 13 09:21:03 2023 -0700 spi: dw: Replace incorrect spi_get_chipselect with set Commit 445164e8c136 ("spi: dw: Replace spi->chip_select references with function calls") replaced direct access to spi.chip_select with spi_*_chipselect calls but incorrectly replaced a set instance with a get instance, replace the incorrect instance. Fixes: 445164e8c136 ("spi: dw: Replace spi->chip_select references with function calls") Signed-off-by: Abe Kohandel Reviewed-by: Andy Shevchenko Acked-by: Serge Semin Link: https://lore.kernel.org/r/20230613162103.569812-1-abe.kohandel@intel.com Signed-off-by: Mark Brown commit 95011f267c44a4d1f9ca1769e8a29ab2c559e004 Author: Su Hui Date: Thu Jun 8 09:24:43 2023 +0800 drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow Smatch error:buffer overflow 'ti_sn_bridge_refclk_lut' 5 <= 5. Fixes: cea86c5bb442 ("drm/bridge: ti-sn65dsi86: Implement the pwm_chip") Signed-off-by: Su Hui Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20230608012443.839372-1-suhui@nfschina.com commit 15adb51c04ccfcf58ac3eec7464a2768fe175fcc Merge: fb054096aea05 c7753ed71c160 Author: Linus Torvalds Date: Tue Jun 13 10:27:56 2023 -0700 Merge tag 'devicetree-fixes-for-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix missing of_node_put() in init_overlay_changeset() - Fix schema for qcom,pmic-mpp "qcom,paired" property - Fix 'additionalProperties' in silvaco,i3c-master binding - usage-model.rst: Use documented "arm,primecell" compatible string - Update Damien Le Moal's email address - Fixes in Realtek Bluetooth binding * tag 'devicetree-fixes-for-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: pinctrl: qcom,pmic-mpp: Fix schema for "qcom,paired" dt-bindings: i3c: silvaco,i3c-master: fix missing schema restriction of: overlay: Fix missing of_node_put() in error case of init_overlay_changeset() docs: zh_CN/devicetree: sync usage-model fix docs: dt: fix documented Primecell compatible string dt-bindings: Change Damien Le Moal's contact email dt-bindings: net: realtek-bluetooth: Fix double RTL8723CS in desc dt-bindings: net: realtek-bluetooth: Fix RTL8821CS binding commit c1bcb976d8feb107ff2c12caaf12ac5e70f44d5f Author: Jiasheng Jiang Date: Tue Jun 6 11:11:59 2023 +0800 gpio: sifive: add missing check for platform_get_irq Add the missing check for platform_get_irq() and return error code if it fails. The returned error code will be dealed with in builtin_platform_driver(sifive_gpio_driver) and the driver will not be registered. Fixes: f52d6d8b43e5 ("gpio: sifive: To get gpio irq offset from device tree data") Signed-off-by: Jiasheng Jiang Signed-off-by: Bartosz Golaszewski commit 47b3ad6b7842f49d374a01b054a4b1461a621bdc Author: Christophe Kerello Date: Tue Jun 13 15:41:46 2023 +0200 mmc: mmci: stm32: fix max busy timeout calculation The way that the timeout is currently calculated could lead to a u64 timeout value in mmci_start_command(). This value is then cast in a u32 register that leads to mmc erase failed issue with some SD cards. Fixes: 8266c585f489 ("mmc: mmci: add hardware busy timeout feature") Signed-off-by: Yann Gautier Signed-off-by: Christophe Kerello Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230613134146.418016-1-yann.gautier@foss.st.com Signed-off-by: Ulf Hansson commit c7753ed71c160f75f92ff5679e9fc22526e56fc5 Author: Rob Herring Date: Tue Apr 18 10:06:06 2023 -0500 dt-bindings: pinctrl: qcom,pmic-mpp: Fix schema for "qcom,paired" The "qcom,paired" schema is all wrong. First, it's a list rather than an object(dictionary). Second, it is missing a required type. The meta-schema normally catches this, but schemas under "$defs" was not getting checked. A fix for that is pending. Fixes: f9a06b810951 ("dt-bindings: pinctrl: qcom,pmic-mpp: Convert qcom pmic mpp bindings to YAML") Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230418150606.1528107-1-robh@kernel.org Signed-off-by: Rob Herring commit 8c00914e5438e3636f26b4f814b3297ae2a1b9ee Author: Jiawen Wu Date: Wed Jun 7 16:18:03 2023 +0800 gpiolib: Fix GPIO chip IRQ initialization restriction In case of gpio-regmap, IRQ chip is added by regmap-irq and associated with GPIO chip by gpiochip_irqchip_add_domain(). The initialization flag was not added in gpiochip_irqchip_add_domain(), causing gpiochip_to_irq() to return -EPROBE_DEFER. Fixes: 5467801f1fcb ("gpio: Restrict usage of GPIO chip irq members before initialization") Signed-off-by: Jiawen Wu Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit 44e46572f0bae431a6092e3cfd2f47bff8b8d18c Author: Takashi Iwai Date: Tue Jun 13 13:22:40 2023 +0200 regmap: regcache: Don't sync read-only registers regcache_maple_sync() tries to sync all cached values no matter whether it's writable or not. OTOH, regache_sync_val() does care the wrtability and returns -EIO for a read-only register. This results in an error message like: snd_hda_codec_realtek hdaudioC0D0: Unable to sync register 0x2f0009. -5 and the sync loop is aborted incompletely. This patch adds the writable register check to regcache_sync_val() for addressing the bug above. Note that, although we may add the check in the caller side (regcache_maple_sync()), here we put in regcache_sync_val(), so that a similar case like this can be avoided in future. Fixes: f033c26de5a5 ("regmap: Add maple tree based register cache") Link: https://lore.kernel.org/r/877cs7g6f1.wl-tiwai@suse.de Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20230613112240.3361-1-tiwai@suse.de Signed-off-by: Mark Brown commit f9fd804aa0a36f15a35ca070ec4c52650876cc29 Author: Jon Hunter Date: Tue Jun 13 10:34:53 2023 +0100 ASoC: tegra: Fix Master Volume Control Commit 3ed2b549b39f ("ALSA: pcm: fix wait_time calculations") corrected the PCM wait_time calculations and in doing so reduced the calculated wait_time. This exposed an issue with the Tegra Master Volume Control (MVC) device where the reduced wait_time caused the MVC to fail. For now fix this by setting the default wait_time for Tegra to be 500ms. Fixes: 3ed2b549b39f ("ALSA: pcm: fix wait_time calculations") Signed-off-by: Jon Hunter Link: https://lore.kernel.org/r/20230613093453.13927-1-jonathanh@nvidia.com Signed-off-by: Mark Brown commit a82c3df955f8c1c726e4976527aa6ae924a67dd9 Author: Robert Hodaszi Date: Fri Jun 9 14:13:34 2023 +0200 tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A LS1028A is using DMA with LPUART. Having RX watermark set to 1, means DMA transactions are started only after receiving the second character. On other platforms with newer LPUART IP, Receiver Idle Empty function initiates the DMA request after the receiver is idling for 4 characters. But this feature is missing on LS1028A, which is causing a 1-character delay in the RX direction on this platform. Set RX watermark to 0 to initiate RX DMA after each character. Link: https://lore.kernel.org/linux-serial/20230607103459.1222426-1-robert.hodaszi@digi.com/ Fixes: 9ad9df844754 ("tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case") Cc: stable Signed-off-by: Robert Hodaszi Message-ID: <20230609121334.1878626-1-robert.hodaszi@digi.com> Signed-off-by: Greg Kroah-Hartman commit 11d24327c2d7ad7f24fcc44fb00e1fa91ebf6525 Author: Ratchanan Srirattanamet Date: Wed May 24 04:11:56 2023 +0700 drm/nouveau: don't detect DSM for non-NVIDIA device The call site of nouveau_dsm_pci_probe() uses single set of output variables for all invocations. So, we must not write anything to them unless it's an NVIDIA device. Otherwise, if we are called with another device after the NVIDIA device, we'll clober the result of the NVIDIA device. For example, if the other device doesn't have _PR3 resources, the detection later would miss the presence of power resource support, and the rest of the code will keep using Optimus DSM, breaking power management for that machine. Also, because we're detecting NVIDIA's DSM, it doesn't make sense to run this detection on a non-NVIDIA device anyway. Thus, check at the beginning of the detection code if this is an NVIDIA card, and just return if it isn't. This, together with commit d22915d22ded ("drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS == COMPLETED") developed independently and landed earlier, fixes runtime power management of the NVIDIA card in Lenovo Legion 5-15ARH05. Without this patch, the GPU resumption code will "timeout", sometimes hanging userspace. As a bonus, we'll also stop preventing _PR3 usage from the bridge for unrelated devices, which is always nice, I guess. Fixes: ccfc2d5cdb02 ("drm/nouveau: Use generic helper to check _PR3 presence") Signed-off-by: Ratchanan Srirattanamet Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/79 Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/DM6PR19MB2780805D4BE1E3F9B3AC96D0BC409@DM6PR19MB2780.namprd19.prod.outlook.com commit 286d9975a838d0a54da049765fa1d1fb96b89682 Author: Badhri Jagan Sridharan Date: Fri Jun 9 01:02:27 2023 +0000 usb: gadget: udc: core: Prevent soft_connect_store() race usb_udc_connect_control(), soft_connect_store() and usb_gadget_deactivate() can potentially race against each other to invoke usb_gadget_connect()/usb_gadget_disconnect(). To prevent this, guard udc->started, gadget->allow_connect, gadget->deactivate and gadget->connect with connect_lock so that ->pullup() is only invoked when the gadget is bound, started and not deactivated. The routines usb_gadget_connect_locked(), usb_gadget_disconnect_locked(), usb_udc_connect_control_locked(), usb_gadget_udc_start_locked(), usb_gadget_udc_stop_locked() are called with this lock held. An earlier version of this commit was reverted due to the crash reported in https://lore.kernel.org/all/ZF4BvgsOyoKxdPFF@francesco-nb.int.toradex.com/. commit 16737e78d190 ("usb: gadget: udc: core: Offload usb_udc_vbus_handler processing") addresses the crash reported. Cc: stable@vger.kernel.org Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler") Signed-off-by: Badhri Jagan Sridharan Reviewed-by: Alan Stern Message-ID: <20230609010227.978661-2-badhri@google.com> Signed-off-by: Greg Kroah-Hartman commit 50966da807c81c5eb3bdfd392990fe0bba94d1ee Author: Badhri Jagan Sridharan Date: Fri Jun 9 01:02:26 2023 +0000 usb: gadget: udc: core: Offload usb_udc_vbus_handler processing usb_udc_vbus_handler() can be invoked from interrupt context by irq handlers of the gadget drivers, however, usb_udc_connect_control() has to run in non-atomic context due to the following: a. Some of the gadget driver implementations expect the ->pullup callback to be invoked in non-atomic context. b. usb_gadget_disconnect() acquires udc_lock which is a mutex. Hence offload invocation of usb_udc_connect_control() to workqueue. UDC should not be pulled up unless gadget driver is bound. The new flag "allow_connect" is now set by gadget_bind_driver() and cleared by gadget_unbind_driver(). This prevents work item to pull up the gadget even if queued when the gadget driver is already unbound. Cc: stable@vger.kernel.org Fixes: 1016fc0c096c ("USB: gadget: Fix obscure lockdep violation for udc_mutex") Signed-off-by: Badhri Jagan Sridharan Reviewed-by: Alan Stern Message-ID: <20230609010227.978661-1-badhri@google.com> Signed-off-by: Greg Kroah-Hartman commit 92c9c3baad6b1fd584fbabeaa4756f9b77926cb5 Author: Pavan Holla Date: Wed Jun 7 19:33:26 2023 +0000 usb: typec: Fix fast_role_swap_current show function The current implementation mistakenly performs a & operation on the output of sysfs_emit. This patch performs the & operation before calling sysfs_emit. Fixes: 662a60102c12 ("usb: typec: Separate USB Power Delivery from USB Type-C") Cc: stable Reported-by: Benson Leung Signed-off-by: Pavan Holla Reviewed-by: Heikki Krogerus Reviewed-by: Benson Leung Message-ID: <20230607193328.3359487-1-pholla@chromium.org> Signed-off-by: Greg Kroah-Hartman commit c4a8bfabefed706bb9150867db528ceefd5cb5fe Author: Heikki Krogerus Date: Tue Jun 6 14:58:02 2023 +0300 usb: typec: ucsi: Fix command cancellation The Cancel command was passed to the write callback as the offset instead of as the actual command which caused NULL pointer dereference. Reported-by: Stephan Bolten Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217517 Fixes: 094902bc6a3c ("usb: typec: ucsi: Always cancel the command if PPM reports BUSY condition") Cc: stable@vger.kernel.org Signed-off-by: Heikki Krogerus Message-ID: <20230606115802.79339-1-heikki.krogerus@linux.intel.com> Signed-off-by: Greg Kroah-Hartman commit e3dbb657571509044be15184a13134fa7c1fdca1 Author: Johan Hovold Date: Wed Jun 7 12:05:40 2023 +0200 USB: dwc3: fix use-after-free on core driver unbind Some dwc3 glue drivers are currently accessing the driver data of the child core device directly, which is clearly a bad idea as the child may not have probed yet or may have been unbound from its driver. As a workaround until the glue drivers have been fixed, clear the driver data pointer before allowing the glue parent device to runtime suspend to prevent its driver from accessing data that has been freed during unbind. Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver") Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Cc: stable@vger.kernel.org # 5.12 Cc: Li Jun Cc: Sandeep Maheswaram Cc: Krishna Kurapati Signed-off-by: Johan Hovold Acked-by: Thinh Nguyen Reviewed-by: Manivannan Sadhasivam Message-ID: <20230607100540.31045-3-johan+linaro@kernel.org> Signed-off-by: Greg Kroah-Hartman commit d2d69354226de0b333d4405981f3d9c41ba8430a Author: Johan Hovold Date: Wed Jun 7 12:05:39 2023 +0200 USB: dwc3: qcom: fix NULL-deref on suspend The Qualcomm dwc3 glue driver is currently accessing the driver data of the child core device during suspend and on wakeup interrupts. This is clearly a bad idea as the child may not have probed yet or could have been unbound from its driver. The first such layering violation was part of the initial version of the driver, but this was later made worse when the hack that accesses the driver data of the grand child xhci device to configure the wakeup interrupts was added. Fixing this properly is not that easily done, so add a sanity check to make sure that the child driver data is non-NULL before dereferencing it for now. Note that this relies on subtleties like the fact that driver core is making sure that the parent is not suspended while the child is probing. Reported-by: Manivannan Sadhasivam Link: https://lore.kernel.org/all/20230325165217.31069-4-manivannan.sadhasivam@linaro.org/ Fixes: d9152161b4bf ("usb: dwc3: Add Qualcomm DWC3 glue layer driver") Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Cc: stable@vger.kernel.org # 3.18: a872ab303d5d: "usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup" Cc: Sandeep Maheswaram Cc: Krishna Kurapati Signed-off-by: Johan Hovold Acked-by: Thinh Nguyen Reviewed-by: Manivannan Sadhasivam Message-ID: <20230607100540.31045-2-johan+linaro@kernel.org> Signed-off-by: Greg Kroah-Hartman commit 00f8205ffcf112dcef14f8151d78075d38d22c08 Author: Elson Roy Serrao Date: Thu Jun 1 14:27:30 2023 -0700 usb: dwc3: gadget: Reset num TRBs before giving back the request Consider a scenario where cable disconnect happens when there is an active usb reqest queued to the UDC. As part of the disconnect we would issue an end transfer with no interrupt-on-completion before giving back this request. Since we are giving back the request without skipping TRBs the num_trbs field of dwc3_request still holds the stale value previously used. Function drivers re-use same request for a given bind-unbind session and hence their dwc3_request context gets preserved across cable disconnect/connect. When such a request gets re-queued after cable connect, we would increase the num_trbs field on top of the previous stale value thus incorrectly representing the number of TRBs used. Fix this by resetting num_trbs field before giving back the request. Fixes: 09fe1f8d7e2f ("usb: dwc3: gadget: track number of TRBs per request") Cc: stable Signed-off-by: Elson Roy Serrao Acked-by: Thinh Nguyen Message-ID: <1685654850-8468-1-git-send-email-quic_eserrao@quicinc.com> Signed-off-by: Greg Kroah-Hartman commit 3e6ac852fbc71a234de24b5455086f6b98d3d958 Author: Biju Das Date: Tue May 30 17:17:20 2023 +0100 usb: gadget: udc: renesas_usb3: Fix RZ/V2M {modprobe,bind} error Currently {modprobe, bind} after {rmmod, unbind} results in probe failure. genirq: Flags mismatch irq 22. 00000004 (85070400.usb3drd) vs. 00000004 (85070400.usb3drd) renesas_usb3: probe of 85070000.usb3peri failed with error -16 The reason is, it is trying to register an interrupt handler for the same IRQ twice. The devm_request_irq() was called with the parent device. So the interrupt handler won't be unregistered when the usb3-peri device is unbound. Fix this issue by replacing "parent dev"->"dev" as the irq resource is managed by this driver. Fixes: 9cad72dfc556 ("usb: gadget: Add support for RZ/V2M USB3DRD driver") Cc: stable Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Message-ID: <20230530161720.179927-1-biju.das.jz@bp.renesas.com> Signed-off-by: Greg Kroah-Hartman commit 2a809ddca08d0d1b9ac961815ce04305814e179b Author: Binbin Zhou Date: Wed May 24 09:49:24 2023 +0800 clk: clk-loongson2: Zero init clk_init_data As clk_core_populate_parent_map() checks clk_init_data.num_parents first, and checks clk_init_data.parent_names[] before clk_init_data.parent_data[] and clk_init_data.parent_hws[]. Therefore the clk_init_data structure needs to be explicitly initialised to prevent an unexpected crash if clk_init_data.parent_names[] is a random value. CPU 0 Unable to handle kernel paging request at virtual address 0000000000000dc0, era == 9000000002986290, ra == 900000000298624c Oops[#1]: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-rc2+ #4582 pc 9000000002986290 ra 900000000298624c tp 9000000100094000 sp 9000000100097a60 a0 9000000104541e00 a1 0000000000000000 a2 0000000000000dc0 a3 0000000000000001 a4 90000001000979f0 a5 90000001800977d7 a6 0000000000000000 a7 900000000362a000 t0 90000000034f3548 t1 6f8c2a9cb5ab5f64 t2 0000000000011340 t3 90000000031cf5b0 t4 0000000000000dc0 t5 0000000000000004 t6 0000000000011300 t7 9000000104541e40 t8 000000000005a4f8 u0 9000000104541e00 s9 9000000104541e00 s0 9000000104bc4700 s1 9000000104541da8 s2 0000000000000001 s3 900000000356f9d8 s4 ffffffffffffffff s5 0000000000000000 s6 0000000000000dc0 s7 90000000030d0a88 s8 0000000000000000 ra: 900000000298624c __clk_register+0x228/0x84c ERA: 9000000002986290 __clk_register+0x26c/0x84c CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000000 (-FPE -SXE -ASXE -BTE) ECFG: 00071c1c (LIE=2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) BADV: 0000000000000dc0 PRID: 0014a000 (Loongson-64bit, ) Modules linked in: Process swapper/0 (pid: 1, threadinfo=(____ptrval____), task=(____ptrval____)) Stack : 90000000031c1810 90000000030d0a88 900000000325bac0 90000000034f3548 90000001002ab410 9000000104541e00 0000000000000dc0 9000000003150098 90000000031c1810 90000000031a0460 900000000362a000 90000001002ab410 900000000362a000 9000000104541da8 9000000104541de8 90000001002ab410 900000000362a000 9000000002986a68 90000000034f3ed8 90000000030d0aa8 9000000104541da8 900000000298d3b8 90000000031c1810 0000000000000000 90000000034f3ed8 90000000030d0aa8 0000000000000dc0 90000000030d0a88 90000001002ab410 900000000298d401 0000000000000000 6f8c2a9cb5ab5f64 90000000034f4000 90000000030d0a88 9000000003a48a58 90000001002ab410 9000000104bd81a8 900000000298d484 9000000100020260 0000000000000000 ... Call Trace: [<9000000002986290>] __clk_register+0x26c/0x84c [<9000000002986a68>] devm_clk_hw_register+0x5c/0xe0 [<900000000298d3b8>] loongson2_clk_register.constprop.0+0xdc/0x10c [<900000000298d484>] loongson2_clk_probe+0x9c/0x4ac [<9000000002a4eba4>] platform_probe+0x68/0xc8 [<9000000002a4bf80>] really_probe+0xbc/0x2f0 [<9000000002a4c23c>] __driver_probe_device+0x88/0x128 [<9000000002a4c318>] driver_probe_device+0x3c/0x11c [<9000000002a4c5dc>] __driver_attach+0x98/0x18c [<9000000002a49ca0>] bus_for_each_dev+0x80/0xe0 [<9000000002a4b0dc>] bus_add_driver+0xfc/0x1ec [<9000000002a4d4a8>] driver_register+0x68/0x134 [<90000000020f0110>] do_one_initcall+0x50/0x188 [<9000000003150f00>] kernel_init_freeable+0x224/0x294 [<90000000030240fc>] kernel_init+0x20/0x110 [<90000000020f1568>] ret_from_kernel_thread+0xc/0xa4 Fixes: acc0ccffec50 ("clk: clk-loongson2: add clock controller driver support") Cc: stable@vger.kernel.org Cc: Yinbo Zhu Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/20230524014924.2869051-1-zhoubinbin@loongson.cn Signed-off-by: Stephen Boyd commit a1043fbc8f99c7df2d70993eecad3baee07dc180 Author: Markus Schneider-Pargmann Date: Thu May 11 15:32:26 2023 +0200 clk: mediatek: mt8365: Fix inverted topclk operations The given operations are inverted for the wrong registers which makes multiple of the mt8365 hardware units unusable. In my setup at least usb did not work. Fixed by swapping the operations with the inverted ones. Reported-by: Alexandre Mergnat Fixes: 905b7430d3cc ("clk: mediatek: mt8365: Convert simple_gate to mtk_gate clocks") Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/r/20230511133226.913600-1-msp@baylibre.com Tested-by: Alexandre Mergnat Reviewed-by: Alexandre Mergnat Reviewed-by: Matthias Brugger Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd commit d54fb4b25a0261bf2f2bb7093fdf11a36718bf25 Author: Sebastian Reichel Date: Fri May 26 19:10:56 2023 +0200 clk: composite: Fix handling of high clock rates ULONG_MAX is used by a few drivers to figure out the highest available clock rate via clk_round_rate(clk, ULONG_MAX). Since abs() takes a signed value as input, the current logic effectively calculates with ULONG_MAX = -1, which results in the worst parent clock being chosen instead of the best one. For example on Rockchip RK3588 the eMMC driver tries to figure out the highest available clock rate. There are three parent clocks available resulting in the following rate diffs with the existing logic: GPLL: abs(18446744073709551615 - 1188000000) = 1188000001 CPLL: abs(18446744073709551615 - 1500000000) = 1500000001 XIN24M: abs(18446744073709551615 - 24000000) = 24000001 As a result the clock framework will promote a maximum supported clock rate of 24 MHz, even though 1.5GHz are possible. With the updated logic any casting between signed and unsigned is avoided and the numbers look like this instead: GPLL: 18446744073709551615 - 1188000000 = 18446744072521551615 CPLL: 18446744073709551615 - 1500000000 = 18446744072209551615 XIN24M: 18446744073709551615 - 24000000 = 18446744073685551615 As a result the parent with the highest acceptable rate is chosen instead of the parent clock with the lowest one. Cc: stable@vger.kernel.org Fixes: 49502408007b ("mmc: sdhci-of-dwcmshc: properly determine max clock on Rockchip") Tested-by: Christopher Obbard Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20230526171057.66876-2-sebastian.reichel@collabora.com Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd commit fbf6f482b65da72744b4a82be412e53a94fd7c9c Merge: 4d17beb66b918 6673851be0fc1 Author: Jakub Kicinski Date: Mon Jun 12 16:55:45 2023 -0700 Merge branch 'mptcp-fixes' Matthieu Baerts says: ==================== selftests: mptcp: skip tests not supported by old kernels (part 3) After a few years of increasing test coverage in the MPTCP selftests, we realised [1] the last version of the selftests is supposed to run on old kernels without issues. Supporting older versions is not that easy for this MPTCP case: these selftests are often validating the internals by checking packets that are exchanged, when some MIB counters are incremented after some actions, how connections are getting opened and closed in some cases, etc. In other words, it is not limited to the socket interface between the userspace and the kernelspace. In addition to that, the current MPTCP selftests run a lot of different sub-tests but the TAP13 protocol used in the selftests don't support sub-tests: one failure in sub-tests implies that the whole selftest is seen as failed at the end because sub-tests are not tracked. It is then important to skip sub-tests not supported by old kernels. To minimise the modifications and reduce the complexity to support old versions, the idea is to look at external signs and skip the whole selftest or just some sub-tests before starting them. This cannot be applied in all cases. Similar to the second part, this third one focuses on marking different sub-tests as skipped if some MPTCP features are not supported. This time, only in "mptcp_join.sh" selftest, the remaining one, is modified. Several techniques are used here to achieve this task: - Before starting some tests: - Check if a file (sysctl knob) is present: that's what patch 12/17 is doing for the userspace PM feature. - Check if a required kernel symbol is present in /proc/kallsyms: patches 9, 10, 14 and 15/17 are using this technique. - Check if it is possible to setup a particular network environment requiring Netfilter or TC: if the preparation step fail, the linked sub-test is marked as skipped. Patch 5/17 is doing that. - Check if a MIB counter is available: patches 7 and 13/17 do that. - Check if the kernel version is newer than a specific one: patch 1/17 adds some helpers in mptcp_lib.sh to ease its use. That's not ideal and it is only used as last resort but as mentioned above, it is important to skip tests if they are not supported not to have the whole selftest always being marked as failed on old kernels. Patches 11 and 17/17 are checking the kernel version. An alternative would be to ignore the results for some sub-tests but that's not ideal too. Note that SELFTESTS_MPTCP_LIB_NO_KVERSION_CHECK env var can be set to 1 not to skip these tests if the running kernel doesn't have a supported version. - After having launched the tests: - Adapt the expectations depending on the presence of a kernel symbol (patch 6/17) or a kernel version (patch 8/17). - Check is a MIB counter is available and skip the verification if not. Patch 4/17 is using this technique. Before skipping tests, SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var value is checked: if it is set to 1, the test is marked as "failed" instead of "skipped". MPTCP public CI expects to have all features supported and it sets this env var to 1 to catch regressions in these new checks. Patch 2/17 uses 'iptables-legacy' if available because it might be needed when using an older kernel not supporting iptables-nft. Patch 3/17 adds some helpers used in the other patches mentioned to easily mark sub-tests as skipped. Patch 16/17 uniforms MPTCP Join "listener" tests: it was imported code from userspace_pm.sh but without using the "code style" and ways of using tools and printing messages from MPTCP Join selftest. Link: https://lore.kernel.org/stable/CA+G9fYtDGpgT4dckXD-y-N92nqUxuvue_7AtDdBcHrbOMsDZLg@mail.gmail.com/ [1] Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 ==================== Link: https://lore.kernel.org/r/20230609-upstream-net-20230610-mptcp-selftests-support-old-kernels-part-3-v1-0-2896fe2ee8a3@tessares.net Signed-off-by: Jakub Kicinski commit 6673851be0fc1bfc3353ffb52ff26ae5468f12c9 Author: Matthieu Baerts Date: Sat Jun 10 18:11:52 2023 +0200 selftests: mptcp: join: skip mixed tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of a mix of subflows in v4 and v6 by the in-kernel PM introduced by commit b9d69db87fb7 ("mptcp: let the in-kernel PM use mixed IPv4 and IPv6 addresses"). It looks like there is no external sign we can use to predict the expected behaviour. Instead of accepting different behaviours and thus not really checking for the expected behaviour, we are looking here for a specific kernel version. That's not ideal but it looks better than removing the test because it cannot support older kernel versions. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: ad3493746ebe ("selftests: mptcp: add test-cases for mixed v4/v6 subflows") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 96b84195df61d374d8028cf426a115ae085031ec Author: Matthieu Baerts Date: Sat Jun 10 18:11:51 2023 +0200 selftests: mptcp: join: uniform listener tests The alignment was different from the other tests because tabs were used instead of spaces. While at it, also use 'echo' instead of 'printf' to print the result to keep the same style as done in the other sub-tests. And, even if it should be better with, also remove 'stdbuf' and sed's '--unbuffered' option because they are not used in the other subtests and they are not available when using a minimal environment with busybox. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 178d023208eb ("selftests: mptcp: listener test for in-kernel PM") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 0471bb479af03874b09350fcfe51d3743a5608de Author: Matthieu Baerts Date: Sat Jun 10 18:11:50 2023 +0200 selftests: mptcp: join: skip PM listener tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of PM listener events introduced by commit f8c9dfbd875b ("mptcp: add pm listener events"). It is possible to look for "mptcp_event_pm_listener" in kallsyms to know in advance if the kernel supports this feature. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 178d023208eb ("selftests: mptcp: listener test for in-kernel PM") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 632978f0a961b4591a05ba9e39eab24541d83e84 Author: Matthieu Baerts Date: Sat Jun 10 18:11:49 2023 +0200 selftests: mptcp: join: skip MPC backups tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of sending an MP_PRIO signal for the initial subflow, introduced by commit c157bbe776b7 ("mptcp: allow the in kernel PM to set MPC subflow priority"). It is possible to look for "mptcp_subflow_send_ack" in kallsyms because it was needed to introduce the mentioned feature. So we can know in advance if the feature is supported instead of trying and accepting any results. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 914f6a59b10f ("selftests: mptcp: add MPC backup tests") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit ff8897b5189495b47895ca247b860a29dc04b36b Author: Matthieu Baerts Date: Sat Jun 10 18:11:48 2023 +0200 selftests: mptcp: join: skip fail tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of the MP_FAIL / infinite mapping introduced by commit 1e39e5a32ad7 ("mptcp: infinite mapping sending") and the following ones. It is possible to look for one of the infinite mapping counters to know in advance if the this feature is available. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: b6e074e171bc ("selftests: mptcp: add infinite map testcase") Cc: stable@vger.kernel.org Fixes: 2ba18161d407 ("selftests: mptcp: add MP_FAIL reset testcase") Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit f2b492b04a167261e1c38eb76f78fb4294473a49 Author: Matthieu Baerts Date: Sat Jun 10 18:11:47 2023 +0200 selftests: mptcp: join: skip userspace PM tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of the userspace PM introduced by commit 4638de5aefe5 ("mptcp: handle local addrs announced by userspace PMs") and the following ones. It is possible to look for the MPTCP pm_type's sysctl knob to know in advance if the userspace PM is available. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 5ac1d2d63451 ("selftests: mptcp: Add tests for userspace PM type") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 9db34c4294af9999edc773d96744e2d2d4eb5060 Author: Matthieu Baerts Date: Sat Jun 10 18:11:46 2023 +0200 selftests: mptcp: join: skip fullmesh flag tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of the fullmesh flag for the in-kernel PM introduced by commit 2843ff6f36db ("mptcp: remote addresses fullmesh") and commit 1a0d6136c5f0 ("mptcp: local addresses fullmesh"). It looks like there is no easy external sign we can use to predict the expected behaviour. We could add the flag and then check if it has been added but for that, and for each fullmesh test, we would need to setup a new environment, do the checks, clean it and then only start the test from yet another clean environment. To keep it simple and avoid introducing new issues, we look for a specific kernel version. That's not ideal but an acceptable solution for this case. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 6a0653b96f5d ("selftests: mptcp: add fullmesh setting tests") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 07216a3c5d926bf1b6b360a0073747228a1f9b7f Author: Matthieu Baerts Date: Sat Jun 10 18:11:45 2023 +0200 selftests: mptcp: join: skip backup if set flag on ID not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. Commit bccefb762439 ("selftests: mptcp: simplify pm_nl_change_endpoint") has simplified the way the backup flag is set on an endpoint. Instead of doing: ./pm_nl_ctl set 10.0.2.1 flags backup Now we do: ./pm_nl_ctl set id 1 flags backup The new way is easier to maintain but it is also incompatible with older kernels not supporting the implicit endpoints putting in place the infrastructure to set flags per ID, hence the second Fixes tag. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: bccefb762439 ("selftests: mptcp: simplify pm_nl_change_endpoint") Cc: stable@vger.kernel.org Fixes: 4cf86ae84c71 ("mptcp: strict local address ID selection") Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 36c4127ae8dd0ebac6d56d8a1b272dd483471c40 Author: Matthieu Baerts Date: Sat Jun 10 18:11:44 2023 +0200 selftests: mptcp: join: skip implicit tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of the implicit endpoints introduced by commit d045b9eb95a9 ("mptcp: introduce implicit endpoints"). It is possible to look for "mptcp_subflow_send_ack" in kallsyms because it was needed to introduce the mentioned feature. So we can know in advance if the feature is supported instead of trying and accepting any results. Note that here and in the following commits, we re-do the same check for each sub-test of the same function for a few reasons. The main one is not to break the ID assign to each test in order to be able to easily compare results between different kernel versions. Also, we can still run a specific test even if it is skipped. Another reason is that it makes it clear during the review that a specific subtest will be skipped or not under certain conditions. At the end, it looks OK to call the exact same helper multiple times: it is not a critical path and it is the same code that is executed, not really more cases to maintain. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 69c6ce7b6eca ("selftests: mptcp: add implicit endpoint test case") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 425ba803124b90cb9124d99f13b372a89dc151d9 Author: Matthieu Baerts Date: Sat Jun 10 18:11:43 2023 +0200 selftests: mptcp: join: support RM_ADDR for used endpoints or not Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. At some points, a new feature caused internal behaviour changes we are verifying in the selftests, see the Fixes tag below. It was not a UAPI change but because in these selftests, we check some internal behaviours, it is normal we have to adapt them from time to time after having added some features. It looks like there is no external sign we can use to predict the expected behaviour. Instead of accepting different behaviours and thus not really checking for the expected behaviour, we are looking here for a specific kernel version. That's not ideal but it looks better than removing the test because it cannot support older kernel versions. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 6fa0174a7c86 ("mptcp: more careful RM_ADDR generation") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit ae947bb2c253ff5f395bb70cb9db8700543bf398 Author: Matthieu Baerts Date: Sat Jun 10 18:11:42 2023 +0200 selftests: mptcp: join: skip Fastclose tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of MP_FASTCLOSE introduced in commit f284c0c77321 ("mptcp: implement fastclose xmit path"). If the MIB counter is not available, the test cannot be verified and the behaviour will not be the expected one. So we can skip the test if the counter is missing. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 01542c9bf9ab ("selftests: mptcp: add fastclose testcase") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit d4c81bbb8600257fd3076d0196cb08bd2e5bdf24 Author: Matthieu Baerts Date: Sat Jun 10 18:11:41 2023 +0200 selftests: mptcp: join: support local endpoint being tracked or not Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. At some points, a new feature caused internal behaviour changes we are verifying in the selftests, see the Fixes tag below. It was not a uAPI change but because in these selftests, we check some internal behaviours, it is normal we have to adapt them from time to time after having added some features. It is possible to look for "mptcp_pm_subflow_check_next" in kallsyms because it was needed to introduce the mentioned feature. So we can know in advance what the behaviour we are expecting here instead of supporting the two behaviours. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 4a0b866a3f7d3c22033f40e93e94befc6fe51bce Author: Matthieu Baerts Date: Sat Jun 10 18:11:40 2023 +0200 selftests: mptcp: join: skip test if iptables/tc cmds fail Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. Some tests are using IPTables and/or TC commands to force some behaviours. If one of these commands fails -- likely because some features are not available due to missing kernel config -- we should intercept the error and skip the tests requiring these features. Note that if we expect to have these features available and if SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var is set to 1, the tests will be marked as failed instead of skipped. This patch also replaces the 'exit 1' by 'return 1' not to stop the selftest in the middle without the conclusion if there is an issue with NF or TC. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 8d014eaa9254 ("selftests: mptcp: add ADD_ADDR timeout test case") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 47867f0a7e831e24e5eab3330667ce9682d50fb1 Author: Matthieu Baerts Date: Sat Jun 10 18:11:39 2023 +0200 selftests: mptcp: join: skip check if MIB counter not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the MPTCP MIB counters introduced in commit fc518953bc9c ("mptcp: add and use MIB counter infrastructure") and more later. The MPTCP Join selftest heavily relies on these counters. If a counter is not supported by the kernel, it is not displayed when using 'nstat -z'. We can then detect that and skip the verification. A new helper (get_counter()) has been added to do the required checks and return an error if the counter is not available. Note that if we expect to have these features available and if SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var is set to 1, the tests will be marked as failed instead of skipped. This new helper also makes sure we get the exact counter we want to avoid issues we had in the past, e.g. with MPTcpExtRmAddr and MPTcpExtRmAddrDrop sharing the same prefix. While at it, we uniform the way we fetch a MIB counter. Note for the backports: we rarely change these modified blocks so if there is are conflicts, it is very likely because a counter is not used in the older kernels and we don't need that chunk. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: b08fbf241064 ("selftests: add test-cases for MPTCP MP_JOIN") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit cdb50525345cf5a8359ee391032ef606a7826f08 Author: Matthieu Baerts Date: Sat Jun 10 18:11:38 2023 +0200 selftests: mptcp: join: helpers to skip tests Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. Here are some helpers that will be used to mark subtests as skipped if a feature is not supported. Marking as a fix for the commit introducing this selftest to help with the backports. While at it, also check if kallsyms feature is available as it will also be used in the following commits to check if MPTCP features are available before starting a test. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: b08fbf241064 ("selftests: add test-cases for MPTCP MP_JOIN") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 0c4cd3f86a40028845ad6f8af5b37165666404cd Author: Matthieu Baerts Date: Sat Jun 10 18:11:37 2023 +0200 selftests: mptcp: join: use 'iptables-legacy' if available IPTables commands using 'iptables-nft' fail on old kernels, at least 5.15 because it doesn't see the default IPTables chains: $ iptables -L iptables/1.8.2 Failed to initialize nft: Protocol not supported As a first step before switching to NFTables, we can use iptables-legacy if available. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 8d014eaa9254 ("selftests: mptcp: add ADD_ADDR timeout test case") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit b1a6a38ab8a633546cefae890da842f19e006c74 Author: Matthieu Baerts Date: Sat Jun 10 18:11:36 2023 +0200 selftests: mptcp: lib: skip if not below kernel version Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. A new function is now available to easily detect if a feature is missing by looking at the kernel version. That's clearly not ideal and this kind of check should be avoided as soon as possible. But sometimes, there are no external sign that a "feature" is available or not: internal behaviours can change without modifying the uAPI and these selftests are verifying the internal behaviours. Sometimes, the only (easy) way to verify if the feature is present is to run the test but then the validation cannot determine if there is a failure with the feature or if the feature is missing. Then it looks better to check the kernel version instead of having tests that can never fail. In any case, we need a solution not to have a whole selftest being marked as failed just because one sub-test has failed. Note that this env var car be set to 1 not to do such check and run the linked sub-test: SELFTESTS_MPTCP_LIB_NO_KVERSION_CHECK. This new helper is going to be used in the following commits. In order to ease the backport of such future patches, it would be good if this patch is backported up to the introduction of MPTCP selftests, hence the Fixes tag below: this type of check was supposed to be done from the beginning. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 4d17beb66b918c01e9ff5e2d623218889aa02295 Merge: 75e6def3b2673 923454c0368b8 Author: Jakub Kicinski Date: Mon Jun 12 16:51:22 2023 -0700 Merge branch 'fixes-for-q-usgmii-speeds-and-autoneg' Maxime Chevallier says: ==================== fixes for Q-USGMII speeds and autoneg This is the second version of a small changeset for QUSGMII support, fixing inconsistencies in reported max speed and control word parsing. As reported here [1], there are some inconsistencies for the Q-USGMII mode speeds and configuration. The first patch in this fixup series makes so that we correctly report the max speed of 1Gbps for this mode. The second patch uses a dedicated helper to decode the control word. This is necessary as although USGMII control words are close to USXGMII, they don't support the same speeds. [1] : https://lore.kernel.org/netdev/ZHnd+6FUO77XFJvQ@shell.armlinux.org.uk/ ==================== Link: https://lore.kernel.org/r/20230609080305.546028-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 923454c0368b8092e9d05c020f50abca577e7290 Author: Maxime Chevallier Date: Fri Jun 9 10:03:05 2023 +0200 net: phylink: use a dedicated helper to parse usgmii control word Q-USGMII is a derivative of USGMII, that uses a specific formatting for the control word. The layout is close to the USXGMII control word, but doesn't support speeds over 1Gbps. Use a dedicated decoding logic for the USGMII control word, re-using USXGMII definitions but only considering 10/100/1000Mbps speeds Fixes: 5e61fe157a27 ("net: phy: Introduce QUSGMII PHY mode") Signed-off-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit b9dc1046edfeb7d9dbc2272c8d9ad5a8c47f3199 Author: Maxime Chevallier Date: Fri Jun 9 10:03:04 2023 +0200 net: phylink: report correct max speed for QUSGMII Q-USGMII is the quad port version of USGMII, and supports a max speed of 1Gbps on each line. Make so that phylink_interface_max_speed() reports this information correctly. Fixes: ae0e4bb2a0e0 ("net: phylink: Adjust link settings based on rate matching") Signed-off-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 745806fb4554f334e6406fa82b328562aa48f08f Author: Qu Wenruo Date: Sun Jun 11 08:09:13 2023 +0800 btrfs: do not ASSERT() on duplicated global roots [BUG] Syzbot reports a reproducible ASSERT() when using rescue=usebackuproot mount option on a corrupted fs. The full report can be found here: https://syzkaller.appspot.com/bug?extid=c4614eae20a166c25bf0 BTRFS error (device loop0: state C): failed to load root csum assertion failed: !tmp, in fs/btrfs/disk-io.c:1103 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.h:3664! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 3608 Comm: syz-executor356 Not tainted 6.0.0-rc7-syzkaller-00029-g3800a713b607 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 RIP: 0010:assertfail+0x1a/0x1c fs/btrfs/ctree.h:3663 RSP: 0018:ffffc90003aaf250 EFLAGS: 00010246 RAX: 0000000000000032 RBX: 0000000000000000 RCX: f21c13f886638400 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff888021c640a0 R08: ffffffff816bd38d R09: ffffed10173667f1 R10: ffffed10173667f1 R11: 1ffff110173667f0 R12: dffffc0000000000 R13: ffff8880229c21f7 R14: ffff888021c64060 R15: ffff8880226c0000 FS: 0000555556a73300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a2637d7a00 CR3: 00000000709c4000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: btrfs_global_root_insert+0x1a7/0x1b0 fs/btrfs/disk-io.c:1103 load_global_roots_objectid+0x482/0x8c0 fs/btrfs/disk-io.c:2467 load_global_roots fs/btrfs/disk-io.c:2501 [inline] btrfs_read_roots fs/btrfs/disk-io.c:2528 [inline] init_tree_roots+0xccb/0x203c fs/btrfs/disk-io.c:2939 open_ctree+0x1e53/0x33df fs/btrfs/disk-io.c:3574 btrfs_fill_super+0x1c6/0x2d0 fs/btrfs/super.c:1456 btrfs_mount_root+0x885/0x9a0 fs/btrfs/super.c:1824 legacy_get_tree+0xea/0x180 fs/fs_context.c:610 vfs_get_tree+0x88/0x270 fs/super.c:1530 fc_mount fs/namespace.c:1043 [inline] vfs_kern_mount+0xc9/0x160 fs/namespace.c:1073 btrfs_mount+0x3d3/0xbb0 fs/btrfs/super.c:1884 [CAUSE] Since the introduction of global roots, we handle csum/extent/free-space-tree roots as global roots, even if no extent-tree-v2 feature is enabled. So for regular csum/extent/fst roots, we load them into fs_info::global_root_tree rb tree. And we should not expect any conflicts in that rb tree, thus we have an ASSERT() inside btrfs_global_root_insert(). But rescue=usebackuproot can break the assumption, as we will try to load those trees again and again as long as we have bad roots and have backup roots slot remaining. So in that case we can have conflicting roots in the rb tree, and triggering the ASSERT() crash. [FIX] We can safely remove that ASSERT(), as the caller will properly put the offending root. To make further debugging easier, also add two explicit error messages: - Error message for conflicting global roots - Error message when using backup roots slot Reported-by: syzbot+a694851c6ab28cbcfb9c@syzkaller.appspotmail.com Fixes: abed4aaae4f7 ("btrfs: track the csum, extent, and free space trees in a rb tree") CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit fb054096aea0576f0c0a61c598e5e9676443ee86 Merge: fd37b884003c7 0bdf0efa180a9 Author: Linus Torvalds Date: Mon Jun 12 16:14:34 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-06-12-12-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "19 hotfixes. 14 are cc:stable and the remainder address issues which were introduced during this development cycle or which were considered inappropriate for a backport" * tag 'mm-hotfixes-stable-2023-06-12-12-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: zswap: do not shrink if cgroup may not zswap page cache: fix page_cache_next/prev_miss off by one ocfs2: check new file size on fallocate call mailmap: add entry for John Keeping mm/damon/core: fix divide error in damon_nr_accesses_to_accesses_bp() epoll: ep_autoremove_wake_function should use list_del_init_careful mm/gup_test: fix ioctl fail for compat task nilfs2: reject devices with insufficient block count ocfs2: fix use-after-free when unmounting read-only filesystem lib/test_vmalloc.c: avoid garbage in page array nilfs2: fix possible out-of-bounds segment allocation in resize ioctl riscv/purgatory: remove PGO flags powerpc/purgatory: remove PGO flags x86/purgatory: remove PGO flags kexec: support purgatories with .text.hot sections mm/uffd: allow vma to merge as much as possible mm/uffd: fix vma operation where start addr cuts part of vma radix-tree: move declarations to header nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() commit deccae40e4b30f98837e44225194d80c8baf2233 Author: Chris Mason Date: Fri Jun 9 10:53:41 2023 -0700 btrfs: can_nocow_file_extent should pass down args->strict from callers Commit 619104ba453ad0 ("btrfs: move common NOCOW checks against a file extent into a helper") changed our call to btrfs_cross_ref_exist() to always pass false for the 'strict' parameter. We're passing this down through the stack so that we can do a full check for cross references during swapfile activation. With strict always false, this test fails: btrfs subvol create swappy chattr +C swappy fallocate -l1G swappy/swapfile chmod 600 swappy/swapfile mkswap swappy/swapfile btrfs subvol snap swappy swapsnap btrfs subvol del -C swapsnap btrfs fi sync / sync;sync;sync swapon swappy/swapfile The fix is to just use args->strict, and everyone except swapfile activation is passing false. Fixes: 619104ba453ad0 ("btrfs: move common NOCOW checks against a file extent into a helper") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Filipe Manana Signed-off-by: Chris Mason Signed-off-by: David Sterba commit 7833b865953c8e62abc76a3261c04132b2fb69de Author: Christoph Hellwig Date: Thu Jun 8 11:10:25 2023 +0200 btrfs: fix iomap_begin length for nocow writes can_nocow_extent can reduce the len passed in, which needs to be propagated to btrfs_dio_iomap_begin so that iomap does not submit more data then is mapped. This problems exists since the btrfs_get_blocks_direct helper was added in commit c5794e51784a ("btrfs: Factor out write portion of btrfs_get_blocks_direct"), but the ordered_extent splitting added in commit b73a6fd1b1ef ("btrfs: split partial dio bios before submit") added a WARN_ON that made a syzkaller test fail. Reported-by: syzbot+ee90502d5c8fd1d0dd93@syzkaller.appspotmail.com Fixes: c5794e51784a ("btrfs: Factor out write portion of btrfs_get_blocks_direct") CC: stable@vger.kernel.org # 6.1+ Tested-by: syzbot+ee90502d5c8fd1d0dd93@syzkaller.appspotmail.com Reviewed-by: Filipe Manana Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 48a821fd58837800750ec1b3962f0f799630a844 Author: Aleksandr Loktionov Date: Tue Apr 25 17:44:14 2023 +0200 igb: fix nvm.ops.read() error handling Add error handling into igb_set_eeprom() function, in case nvm.ops.read() fails just quit with error code asap. Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver") Signed-off-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit c080fe262f9e73a00934b70c16b1479cf40cd2bd Author: Vinicius Costa Gomes Date: Mon Apr 17 15:18:39 2023 -0700 igc: Fix possible system crash when loading module Guarantee that when probe() is run again, PTM and PCI busmaster will be in the same state as it was if the driver was never loaded. Avoid an i225/i226 hardware issue that PTM requests can be made even though PCI bus mastering is not enabled. These unexpected PTM requests can crash some systems. So, "force" disable PTM and busmastering before removing the driver, so they can be re-enabled in the right order during probe(). This is more like a workaround and should be applicable for i225 and i226, in any platform. Fixes: 1b5d73fb8624 ("igc: Enable PCIe PTM") Signed-off-by: Vinicius Costa Gomes Reviewed-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit e43516f5978d11d36511ce63d31d1da4db916510 Author: Muhammad Husaini Zulkifli Date: Mon May 15 23:49:36 2023 +0800 igc: Clean the TX buffer and TX descriptor ring There could be a race condition during link down where interrupt being generated and igc_clean_tx_irq() been called to perform the TX completion. Properly clear the TX buffer/descriptor ring and disable the TX Queue ring in igc_free_tx_resources() to avoid that. Kernel trace: [ 108.237177] Hardware name: Intel Corporation Tiger Lake Client Platform/TigerLake U DDR4 SODIMM RVP, BIOS TGLIFUI1.R00.4204.A00.2105270302 05/27/2021 [ 108.237178] RIP: 0010:refcount_warn_saturate+0x55/0x110 [ 108.242143] RSP: 0018:ffff9e7980003db0 EFLAGS: 00010286 [ 108.245555] Code: 84 bc 00 00 00 c3 cc cc cc cc 85 f6 74 46 80 3d 20 8c 4d 01 00 75 ee 48 c7 c7 88 f4 03 ab c6 05 10 8c 4d 01 01 e8 0b 10 96 ff <0f> 0b c3 cc cc cc cc 80 3d fc 8b 4d 01 00 75 cb 48 c7 c7 b0 f4 03 [ 108.250434] [ 108.250434] RSP: 0018:ffff9e798125f910 EFLAGS: 00010286 [ 108.254358] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 108.259325] [ 108.259325] RAX: 0000000000000000 RBX: ffff8ddb935b8000 RCX: 0000000000000027 [ 108.261868] RDX: ffff8de250a28800 RSI: ffff8de250a1c580 RDI: ffff8de250a1c580 [ 108.265538] RDX: 0000000000000027 RSI: 0000000000000002 RDI: ffff8de250a9c588 [ 108.265539] RBP: ffff8ddb935b8000 R08: ffffffffab2655a0 R09: ffff9e798125f898 [ 108.267914] RBP: ffff8ddb8a5b8d80 R08: 0000005648eba354 R09: 0000000000000000 [ 108.270196] R10: 0000000000000001 R11: 000000002d2d2d2d R12: ffff9e798125f948 [ 108.270197] R13: ffff9e798125fa1c R14: ffff8ddb8a5b8d80 R15: 7fffffffffffffff [ 108.273001] R10: 000000002d2d2d2d R11: 000000002d2d2d2d R12: ffff8ddb8a5b8ed4 [ 108.276410] FS: 00007f605851b740(0000) GS:ffff8de250a80000(0000) knlGS:0000000000000000 [ 108.280597] R13: 00000000000002ac R14: 00000000ffffff99 R15: ffff8ddb92561b80 [ 108.282966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.282967] CR2: 00007f053c039248 CR3: 0000000185850003 CR4: 0000000000f70ee0 [ 108.286206] FS: 0000000000000000(0000) GS:ffff8de250a00000(0000) knlGS:0000000000000000 [ 108.289701] PKRU: 55555554 [ 108.289702] Call Trace: [ 108.289704] [ 108.293977] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.297562] sock_alloc_send_pskb+0x20c/0x240 [ 108.301494] CR2: 00007f053c03a168 CR3: 0000000184394002 CR4: 0000000000f70ef0 [ 108.301495] PKRU: 55555554 [ 108.306464] __ip_append_data.isra.0+0x96f/0x1040 [ 108.309441] Call Trace: [ 108.309443] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 108.314927] [ 108.314928] sock_wfree+0x1c7/0x1d0 [ 108.318078] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 108.320276] skb_release_head_state+0x32/0x90 [ 108.324812] ip_make_skb+0xf6/0x130 [ 108.327188] skb_release_all+0x16/0x40 [ 108.330775] ? udp_sendmsg+0x9f3/0xcb0 [ 108.332626] napi_consume_skb+0x48/0xf0 [ 108.334134] ? xfrm_lookup_route+0x23/0xb0 [ 108.344285] igc_poll+0x787/0x1620 [igc] [ 108.346659] udp_sendmsg+0x9f3/0xcb0 [ 108.360010] ? ttwu_do_activate+0x40/0x220 [ 108.365237] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 108.366744] ? try_to_wake_up+0x289/0x5e0 [ 108.376987] ? sock_sendmsg+0x81/0x90 [ 108.395698] ? __pfx_process_timeout+0x10/0x10 [ 108.395701] sock_sendmsg+0x81/0x90 [ 108.409052] __napi_poll+0x29/0x1c0 [ 108.414279] ____sys_sendmsg+0x284/0x310 [ 108.419507] net_rx_action+0x257/0x2d0 [ 108.438216] ___sys_sendmsg+0x7c/0xc0 [ 108.439723] __do_softirq+0xc1/0x2a8 [ 108.444950] ? finish_task_switch+0xb4/0x2f0 [ 108.452077] irq_exit_rcu+0xa9/0xd0 [ 108.453584] ? __schedule+0x372/0xd00 [ 108.460713] common_interrupt+0x84/0xa0 [ 108.467840] ? clockevents_program_event+0x95/0x100 [ 108.474968] [ 108.482096] ? do_nanosleep+0x88/0x130 [ 108.489224] [ 108.489225] asm_common_interrupt+0x26/0x40 [ 108.496353] ? __rseq_handle_notify_resume+0xa9/0x4f0 [ 108.503478] RIP: 0010:cpu_idle_poll+0x2c/0x100 [ 108.510607] __sys_sendmsg+0x5d/0xb0 [ 108.518687] Code: 05 e1 d9 c8 00 65 8b 15 de 64 85 55 85 c0 7f 57 e8 b9 ef ff ff fb 65 48 8b 1c 25 00 cc 02 00 48 8b 03 a8 08 74 0b eb 1c f3 90 <48> 8b 03 a8 08 75 13 8b 05 77 63 cd 00 85 c0 75 ed e8 ce ec ff ff [ 108.525817] do_syscall_64+0x44/0xa0 [ 108.531563] RSP: 0018:ffffffffab203e70 EFLAGS: 00000202 [ 108.538693] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 108.546775] [ 108.546777] RIP: 0033:0x7f605862b7f7 [ 108.549495] RAX: 0000000000000001 RBX: ffffffffab20c940 RCX: 000000000000003b [ 108.551955] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 108.554068] RDX: 4000000000000000 RSI: 000000002da97f6a RDI: 00000000002b8ff4 [ 108.559816] RSP: 002b:00007ffc99264058 EFLAGS: 00000246 [ 108.564178] RBP: 0000000000000000 R08: 00000000002b8ff4 R09: ffff8ddb01554c80 [ 108.571302] ORIG_RAX: 000000000000002e [ 108.571303] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f605862b7f7 [ 108.574023] R10: 000000000000015b R11: 000000000000000f R12: ffffffffab20c940 [ 108.574024] R13: 0000000000000000 R14: ffff8de26fbeef40 R15: ffffffffab20c940 [ 108.578727] RDX: 0000000000000000 RSI: 00007ffc992640a0 RDI: 0000000000000003 [ 108.578728] RBP: 00007ffc99264110 R08: 0000000000000000 R09: 175f48ad1c3a9c00 [ 108.581187] do_idle+0x62/0x230 [ 108.585890] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc992642d8 [ 108.585891] R13: 00005577814ab2ba R14: 00005577814addf0 R15: 00007f605876d000 [ 108.587920] cpu_startup_entry+0x1d/0x20 [ 108.591422] [ 108.596127] rest_init+0xc5/0xd0 [ 108.600490] ---[ end trace 0000000000000000 ]--- Test Setup: DUT: - Change mac address on DUT Side. Ensure NIC not having same MAC Address - Running udp_tai on DUT side. Let udp_tai running throughout the test Example: ./udp_tai -i enp170s0 -P 100000 -p 90 -c 1 -t 0 -u 30004 Host: - Perform link up/down every 5 second. Result: Kernel panic will happen on DUT Side. Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings") Signed-off-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen commit 3d6f6d2b584e7a629158be8a3f44f5de00b337ee Author: Alexandre Mergnat Date: Fri May 26 15:10:43 2023 +0200 clk: mediatek: mt8365: Fix index issue Before the patch [1], the clock probe was done directly in the clk-mt8365 driver. In this probe function, the array which stores the data clocks is sized using the higher defined numbers (*_NR_CLOCK) in the clock lists [2]. Currently, with the patch [1], the specific clk-mt8365 probe function is replaced by the mtk generic one [3], which size the clock data array by adding all the clock descriptor array size provided by the clk-mt8365 driver. Actually, all clock indexes come from the header file [2], that mean, if there are more clock (then more index) in the header file [2] than the number of clock declared in the clock descriptor arrays (which is the case currently), the clock data array will be undersized and then the generic probe function will overflow when it will try to write in "clk_data[CLK_INDEX]". Actually, instead of crashing at boot, the probe function returns an error in the log which looks like: "of_clk_hw_onecell_get: invalid index 135", then this clock isn't enabled. Solve this issue by adding in the driver the missing clocks declared in the header clock file [2]. [1]: Commit ffe91cb28f6a ("clk: mediatek: mt8365: Convert to mtk_clk_simple_{probe,remove}()") [2]: include/dt-bindings/clock/mediatek,mt8365-clk.h [3]: drivers/clk/mediatek/clk-mtk.c Fixes: ffe91cb28f6a ("clk: mediatek: mt8365: Convert to mtk_clk_simple_{probe,remove}()") Signed-off-by: Alexandre Mergnat Link: https://lore.kernel.org/r/20230517-fix-clk-index-v3-1-be4df46065c4@baylibre.com Tested-by: Markus Schneider-Pargmann Reviewed-by: Markus Schneider-Pargmann Signed-off-by: Stephen Boyd commit 0bdf0efa180a9cb1361cbded4e2260a49306ac89 Author: Nhat Pham Date: Tue May 30 15:24:40 2023 -0700 zswap: do not shrink if cgroup may not zswap Before storing a page, zswap first checks if the number of stored pages exceeds the limit specified by memory.zswap.max, for each cgroup in the hierarchy. If this limit is reached or exceeded, then zswap shrinking is triggered and short-circuits the store attempt. However, since the zswap's LRU is not memcg-aware, this can create the following pathological behavior: the cgroup whose zswap limit is 0 will evict pages from other cgroups continually, without lowering its own zswap usage. This means the shrinking will continue until the need for swap ceases or the pool becomes empty. As a result of this, we observe a disproportionate amount of zswap writeback and a perpetually small zswap pool in our experiments, even though the pool limit is never hit. More generally, a cgroup might unnecessarily evict pages from other cgroups before we drive the memcg back below its limit. This patch fixes the issue by rejecting zswap store attempt without shrinking the pool when obj_cgroup_may_zswap() returns false. [akpm@linux-foundation.org: fix return of unintialized value] [akpm@linux-foundation.org: s/ENOSPC/ENOMEM/] Link: https://lkml.kernel.org/r/20230530222440.2777700-1-nphamcs@gmail.com Link: https://lkml.kernel.org/r/20230530232435.3097106-1-nphamcs@gmail.com Fixes: f4840ccfca25 ("zswap: memcg accounting") Signed-off-by: Nhat Pham Cc: Dan Streetman Cc: Domenico Cerasuolo Cc: Johannes Weiner Cc: Seth Jennings Cc: Vitaly Wool Cc: Yosry Ahmed Cc: Signed-off-by: Andrew Morton commit 9425c591e06a9ab27a145ba655fb50532cf0bcc9 Author: Mike Kravetz Date: Fri Jun 2 15:57:47 2023 -0700 page cache: fix page_cache_next/prev_miss off by one Ackerley Tng reported an issue with hugetlbfs fallocate here[1]. The issue showed up after the conversion of hugetlb page cache lookup code to use page_cache_next_miss. Code in hugetlb fallocate, userfaultfd and GUP is now using page_cache_next_miss to determine if a page is present the page cache. The following statement is used. present = page_cache_next_miss(mapping, index, 1) != index; There are two issues with page_cache_next_miss when used in this way. 1) If the passed value for index is equal to the 'wrap-around' value, the same index will always be returned. This wrap-around value is 0, so 0 will be returned even if page is present at index 0. 2) If there is no gap in the range passed, the last index in the range will be returned. When passed a range of 1 as above, the passed index value will be returned even if the page is present. The end result is the statement above will NEVER indicate a page is present in the cache, even if it is. As noted by Ackerley in [1], users can see this by hugetlb fallocate incorrectly returning EEXIST if pages are already present in the file. In addition, hugetlb pages will not be included in core dumps if they need to be brought in via GUP. userfaultfd UFFDIO_COPY also uses this code and will not notice pages already present in the cache. It may try to allocate a new page and potentially return ENOMEM as opposed to EEXIST. Both page_cache_next_miss and page_cache_prev_miss have similar issues. Fix by: - Check for index equal to 'wrap-around' value and do not exit early. - If no gap is found in range, return index outside range. - Update function description to say 'wrap-around' value could be returned if passed as index. [1] https://lore.kernel.org/linux-mm/cover.1683069252.git.ackerleytng@google.com/ Link: https://lkml.kernel.org/r/20230602225747.103865-2-mike.kravetz@oracle.com Fixes: d0ce0e47b323 ("mm/hugetlb: convert hugetlb fault paths to use alloc_hugetlb_folio()") Signed-off-by: Mike Kravetz Reported-by: Ackerley Tng Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Cc: Erdem Aktas Cc: Matthew Wilcox (Oracle) Cc: Mike Kravetz Cc: Muchun Song Cc: Sidhartha Kumar Cc: Vishal Annapurve Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton commit 26a6ffff7de5dd369cdb12e38ba11db682f1dec0 Author: Luís Henriques Date: Mon May 29 16:26:45 2023 +0100 ocfs2: check new file size on fallocate call When changing a file size with fallocate() the new size isn't being checked. In particular, the FSIZE ulimit isn't being checked, which makes fstest generic/228 fail. Simply adding a call to inode_newsize_ok() fixes this issue. Link: https://lkml.kernel.org/r/20230529152645.32680-1-lhenriques@suse.de Signed-off-by: Luís Henriques Reviewed-by: Mark Fasheh Reviewed-by: Joseph Qi Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit 0e4d4ef972aaa237025f994911c370a0e8e07d27 Author: John Keeping Date: Wed May 31 15:48:39 2023 +0100 mailmap: add entry for John Keeping Map my corporate address to my personal one, as I am leaving the company. Link: https://lkml.kernel.org/r/20230531144839.1157112-1-john@keeping.me.uk Signed-off-by: John Keeping Signed-off-by: Andrew Morton commit 5ff6e2fff88ef9bf110c5e85a48e7b557bfc64c1 Author: Kefeng Wang Date: Sat May 27 11:21:01 2023 +0800 mm/damon/core: fix divide error in damon_nr_accesses_to_accesses_bp() If 'aggr_interval' is smaller than 'sample_interval', max_nr_accesses in damon_nr_accesses_to_accesses_bp() becomes zero which leads to divide error, let's validate the values of them in damon_set_attrs() to fix it, which similar to others attrs check. Link: https://lkml.kernel.org/r/20230527032101.167788-1-wangkefeng.wang@huawei.com Fixes: 2f5bef5a590b ("mm/damon/core: update monitoring results for new monitoring attributes") Reported-by: syzbot+841a46899768ec7bec67@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=841a46899768ec7bec67 Link: https://lore.kernel.org/damon/00000000000055fc4e05fc975bc2@google.com/ Reviewed-by: SeongJae Park Signed-off-by: Kefeng Wang Cc: Signed-off-by: Andrew Morton commit 2192bba03d80f829233bfa34506b428f71e531e7 Author: Benjamin Segall Date: Tue May 30 11:32:28 2023 -0700 epoll: ep_autoremove_wake_function should use list_del_init_careful autoremove_wake_function uses list_del_init_careful, so should epoll's more aggressive variant. It only doesn't because it was copied from an older wait.c rather than the most recent. [bsegall@google.com: add comment] Link: https://lkml.kernel.org/r/xm26bki0ulsr.fsf_-_@google.com Link: https://lkml.kernel.org/r/xm26pm6hvfer.fsf@google.com Fixes: a16ceb139610 ("epoll: autoremove wakers even more aggressively") Signed-off-by: Ben Segall Cc: Al Viro Cc: Christian Brauner Cc: Signed-off-by: Andrew Morton commit 4f572f0074b8be8a70bd150d96a749aa94c8d85f Author: Haibo Li Date: Fri May 26 10:21:25 2023 +0800 mm/gup_test: fix ioctl fail for compat task When tools/testing/selftests/mm/gup_test.c is compiled as 32bit, then run on arm64 kernel, it reports "ioctl: Inappropriate ioctl for device". Fix it by filling compat_ioctl in gup_test_fops Link: https://lkml.kernel.org/r/20230526022125.175728-1-haibo.li@mediatek.com Signed-off-by: Haibo Li Acked-by: David Hildenbrand Cc: AngeloGioacchino Del Regno Cc: Matthias Brugger Cc: John Hubbard Cc: Signed-off-by: Andrew Morton commit 92c5d1b860e9581d64baca76779576c0ab0d943d Author: Ryusuke Konishi Date: Fri May 26 11:13:32 2023 +0900 nilfs2: reject devices with insufficient block count The current sanity check for nilfs2 geometry information lacks checks for the number of segments stored in superblocks, so even for device images that have been destructively truncated or have an unusually high number of segments, the mount operation may succeed. This causes out-of-bounds block I/O on file system block reads or log writes to the segments, the latter in particular causing "a_ops->writepages" to repeatedly fail, resulting in sync_inodes_sb() to hang. Fix this issue by checking the number of segments stored in the superblock and avoiding mounting devices that can cause out-of-bounds accesses. To eliminate the possibility of overflow when calculating the number of blocks required for the device from the number of segments, this also adds a helper function to calculate the upper bound on the number of segments and inserts a check using it. Link: https://lkml.kernel.org/r/20230526021332.3431-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+7d50f1e54a12ba3aeae2@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=7d50f1e54a12ba3aeae2 Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 Author: Luís Henriques Date: Mon May 22 11:21:12 2023 +0100 ocfs2: fix use-after-free when unmounting read-only filesystem It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... Allocated by task 632: kasan_save_stack+0x1c/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x8b/0x90 ocfs2_local_read_info+0xe3/0x9a0 [ocfs2] dquot_load_quota_sb+0x34b/0x680 dquot_load_quota_inode+0xfe/0x1a0 ocfs2_enable_quotas+0x190/0x2f0 [ocfs2] ocfs2_fill_super+0x14ef/0x2120 [ocfs2] mount_bdev+0x1be/0x200 legacy_get_tree+0x6c/0xb0 vfs_get_tree+0x3e/0x110 path_mount+0xa90/0xe10 __x64_sys_mount+0x16f/0x1a0 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 650: kasan_save_stack+0x1c/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0xf9/0x150 __kmem_cache_free+0x89/0x180 ocfs2_local_free_info+0x2ba/0x3f0 [ocfs2] dquot_disable+0x35f/0xa70 ocfs2_susp_quotas.isra.0+0x159/0x1a0 [ocfs2] ocfs2_remount+0x150/0x580 [ocfs2] reconfigure_super+0x1a5/0x3a0 path_mount+0xc8a/0xe10 __x64_sys_mount+0x16f/0x1a0 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques@suse.de Signed-off-by: Luís Henriques Reviewed-by: Joseph Qi Tested-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit 9f6c6ad161f1af37548a6b80fb15710998ccfd1e Author: Lorenzo Stoakes Date: Wed May 24 09:24:24 2023 +0100 lib/test_vmalloc.c: avoid garbage in page array It turns out that alloc_pages_bulk_array() does not treat the page_array parameter as an output parameter, but rather reads the array and skips any entries that have already been allocated. This is somewhat unexpected and breaks this test, as we allocate the pages array uninitialised on the assumption it will be overwritten. As a result, the test was referencing uninitialised data and causing the PFN to not be valid and thus a WARN_ON() followed by a null pointer deref and panic. In addition, this is an array of pointers not of struct page objects, so we need only allocate an array with elements of pointer size. We solve both problems by simply using kcalloc() and referencing sizeof(struct page *) rather than sizeof(struct page). Link: https://lkml.kernel.org/r/20230524082424.10022-1-lstoakes@gmail.com Fixes: 869cb29a61a1 ("lib/test_vmalloc.c: add vm_map_ram()/vm_unmap_ram() test case") Signed-off-by: Lorenzo Stoakes Reviewed-by: Uladzislau Rezki (Sony) Reviewed-by: Baoquan He Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit fee5eaecca86afa544355569b831c1f90f334b85 Author: Ryusuke Konishi Date: Wed May 24 18:43:48 2023 +0900 nilfs2: fix possible out-of-bounds segment allocation in resize ioctl Syzbot reports that in its stress test for resize ioctl, the log writing function nilfs_segctor_do_construct hits a WARN_ON in nilfs_segctor_truncate_segments(). It turned out that there is a problem with the current implementation of the resize ioctl, which changes the writable range on the device (the range of allocatable segments) at the end of the resize process. This order is necessary for file system expansion to avoid corrupting the superblock at trailing edge. However, in the case of a file system shrink, if log writes occur after truncating out-of-bounds trailing segments and before the resize is complete, segments may be allocated from the truncated space. The userspace resize tool was fine as it limits the range of allocatable segments before performing the resize, but it can run into this issue if the resize ioctl is called alone. Fix this issue by changing nilfs_sufile_resize() to update the range of allocatable segments immediately after successful truncation of segment space in case of file system shrink. Link: https://lkml.kernel.org/r/20230524094348.3784-1-konishi.ryusuke@gmail.com Fixes: 4e33f9eab07e ("nilfs2: implement resize ioctl") Signed-off-by: Ryusuke Konishi Reported-by: syzbot+33494cd0df2ec2931851@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/0000000000005434c405fbbafdc5@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 88ac3bbcf73853880a9b2a65c67e6854390741cc Author: Ricardo Ribalda Date: Fri May 19 16:47:39 2023 +0200 riscv/purgatory: remove PGO flags If profile-guided optimization is enabled, the purgatory ends up with multiple .text sections. This is not supported by kexec and crashes the system. Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-4-b05c520b7296@chromium.org Fixes: 930457057abe ("kernel/kexec_file.c: split up __kexec_load_puragory") Signed-off-by: Ricardo Ribalda Acked-by: Palmer Dabbelt Cc: Cc: Albert Ou Cc: Baoquan He Cc: Borislav Petkov (AMD) Cc: Christophe Leroy Cc: Dave Hansen Cc: Dave Young Cc: Eric W. Biederman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Michael Ellerman Cc: Nathan Chancellor Cc: Nicholas Piggin Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Philipp Rudo Cc: Ross Zwisler Cc: Simon Horman Cc: Steven Rostedt (Google) Cc: Thomas Gleixner Cc: Tom Rix Signed-off-by: Andrew Morton commit 20188baceb7a1463dc0bcb0c8678b69c2f447df6 Author: Ricardo Ribalda Date: Fri May 19 16:47:38 2023 +0200 powerpc/purgatory: remove PGO flags If profile-guided optimization is enabled, the purgatory ends up with multiple .text sections. This is not supported by kexec and crashes the system. Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-3-b05c520b7296@chromium.org Fixes: 930457057abe ("kernel/kexec_file.c: split up __kexec_load_puragory") Signed-off-by: Ricardo Ribalda Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Cc: Albert Ou Cc: Baoquan He Cc: Borislav Petkov (AMD) Cc: Dave Hansen Cc: Dave Young Cc: Eric W. Biederman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Philipp Rudo Cc: Ross Zwisler Cc: Simon Horman Cc: Steven Rostedt (Google) Cc: Thomas Gleixner Cc: Tom Rix Signed-off-by: Andrew Morton commit 97b6b9cbba40a21c1d9a344d5c1991f8cfbf136e Author: Ricardo Ribalda Date: Fri May 19 16:47:37 2023 +0200 x86/purgatory: remove PGO flags If profile-guided optimization is enabled, the purgatory ends up with multiple .text sections. This is not supported by kexec and crashes the system. Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-2-b05c520b7296@chromium.org Fixes: 930457057abe ("kernel/kexec_file.c: split up __kexec_load_puragory") Signed-off-by: Ricardo Ribalda Cc: Cc: Albert Ou Cc: Baoquan He Cc: Borislav Petkov (AMD) Cc: Christophe Leroy Cc: Dave Hansen Cc: Dave Young Cc: Eric W. Biederman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Michael Ellerman Cc: Nathan Chancellor Cc: Nicholas Piggin Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Philipp Rudo Cc: Ross Zwisler Cc: Simon Horman Cc: Steven Rostedt (Google) Cc: Thomas Gleixner Cc: Tom Rix Signed-off-by: Andrew Morton commit 8652d44f466ad5772e7d1756e9457046189b0dfc Author: Ricardo Ribalda Date: Fri May 19 16:47:36 2023 +0200 kexec: support purgatories with .text.hot sections Patch series "kexec: Fix kexec_file_load for llvm16 with PGO", v7. When upreving llvm I realised that kexec stopped working on my test platform. The reason seems to be that due to PGO there are multiple .text sections on the purgatory, and kexec does not supports that. This patch (of 4): Clang16 links the purgatory text in two sections when PGO is in use: [ 1] .text PROGBITS 0000000000000000 00000040 00000000000011a1 0000000000000000 AX 0 0 16 [ 2] .rela.text RELA 0000000000000000 00003498 0000000000000648 0000000000000018 I 24 1 8 ... [17] .text.hot. PROGBITS 0000000000000000 00003220 000000000000020b 0000000000000000 AX 0 0 1 [18] .rela.text.hot. RELA 0000000000000000 00004428 0000000000000078 0000000000000018 I 24 17 8 And both of them have their range [sh_addr ... sh_addr+sh_size] on the area pointed by `e_entry`. This causes that image->start is calculated twice, once for .text and another time for .text.hot. The second calculation leaves image->start in a random location. Because of this, the system crashes immediately after: kexec_core: Starting new kernel Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-0-b05c520b7296@chromium.org Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-1-b05c520b7296@chromium.org Fixes: 930457057abe ("kernel/kexec_file.c: split up __kexec_load_puragory") Signed-off-by: Ricardo Ribalda Reviewed-by: Ross Zwisler Reviewed-by: Steven Rostedt (Google) Reviewed-by: Philipp Rudo Cc: Albert Ou Cc: Baoquan He Cc: Borislav Petkov (AMD) Cc: Christophe Leroy Cc: Dave Hansen Cc: Dave Young Cc: Eric W. Biederman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Michael Ellerman Cc: Nathan Chancellor Cc: Nicholas Piggin Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Simon Horman Cc: Thomas Gleixner Cc: Tom Rix Cc: Signed-off-by: Andrew Morton commit 5543d3c43c41a8501f2a4946d0fd39ce36b5a641 Author: Peter Xu Date: Wed May 17 15:09:16 2023 -0400 mm/uffd: allow vma to merge as much as possible We used to not pass in the pgoff correctly when register/unregister uffd regions, it caused incorrect behavior on vma merging and can cause mergeable vmas being separate after ioctls return. For example, when we have: vma1(range 0-9, with uffd), vma2(range 10-19, no uffd) Then someone unregisters uffd on range (5-9), it should logically become: vma1(range 0-4, with uffd), vma2(range 5-19, no uffd) But with current code we'll have: vma1(range 0-4, with uffd), vma3(range 5-9, no uffd), vma2(range 10-19, no uffd) This patch allows such merge to happen correctly before ioctl returns. This behavior seems to have existed since the 1st day of uffd. Since pgoff for vma_merge() is only used to identify the possibility of vma merging, meanwhile here what we did was always passing in a pgoff smaller than what we should, so there should have no other side effect besides not merging it. Let's still tentatively copy stable for this, even though I don't see anything will go wrong besides vma being split (which is mostly not user visible). Link: https://lkml.kernel.org/r/20230517190916.3429499-3-peterx@redhat.com Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Peter Xu Reported-by: Lorenzo Stoakes Acked-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Andrea Arcangeli Cc: Mike Rapoport (IBM) Signed-off-by: Andrew Morton commit 270aa010620697fb27b8f892cc4e194bc2b7d134 Author: Peter Xu Date: Wed May 17 15:09:15 2023 -0400 mm/uffd: fix vma operation where start addr cuts part of vma Patch series "mm/uffd: Fix vma merge/split", v2. This series contains two patches that fix vma merge/split for userfaultfd on two separate issues. Patch 1 fixes a regression since 6.1+ due to something we overlooked when converting to maple tree apis. The plan is we use patch 1 to replace the commit "2f628010799e (mm: userfaultfd: avoid passing an invalid range to vma_merge())" in mm-hostfixes-unstable tree if possible, so as to bring uffd vma operations back aligned with the rest code again. Patch 2 fixes a long standing issue that vma can be left unmerged even if we can for either uffd register or unregister. Many thanks to Lorenzo on either noticing this issue from the assert movement patch, looking at this problem, and also provided a reproducer on the unmerged vma issue [1]. [1] https://gist.github.com/lorenzo-stoakes/a11a10f5f479e7a977fc456331266e0e This patch (of 2): It seems vma merging with uffd paths is broken with either register/unregister, where right now we can feed wrong parameters to vma_merge() and it's found by recent patch which moved asserts upwards in vma_merge() by Lorenzo Stoakes: https://lore.kernel.org/all/ZFunF7DmMdK05MoF@FVFF77S0Q05N.cambridge.arm.com/ It's possible that "start" is contained within vma but not clamped to its start. We need to convert this into either "cannot merge" case or "can merge" case 4 which permits subdivision of prev by assigning vma to prev. As we loop, each subsequent VMA will be clamped to the start. This patch will eliminate the report and make sure vma_merge() calls will become legal again. One thing to mention is that the "Fixes: 29417d292bd0" below is there only to help explain where the warning can start to trigger, the real commit to fix should be 69dbe6daf104. Commit 29417d292bd0 helps us to identify the issue, but unfortunately we may want to keep it in Fixes too just to ease kernel backporters for easier tracking. Link: https://lkml.kernel.org/r/20230517190916.3429499-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20230517190916.3429499-2-peterx@redhat.com Fixes: 69dbe6daf104 ("userfaultfd: use maple tree iterator to iterate VMAs") Signed-off-by: Peter Xu Reported-by: Mark Rutland Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Closes: https://lore.kernel.org/all/ZFunF7DmMdK05MoF@FVFF77S0Q05N.cambridge.arm.com/ Cc: Lorenzo Stoakes Cc: Mike Rapoport (IBM) Cc: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit bde1597d0f045149a254b0c2ec6f029c82e459d5 Author: Arnd Bergmann Date: Tue May 16 21:41:54 2023 +0200 radix-tree: move declarations to header The xarray.c file contains the only call to radix_tree_node_rcu_free(), and it comes with its own extern declaration for it. This means the function definition causes a missing-prototype warning: lib/radix-tree.c:288:6: error: no previous prototype for 'radix_tree_node_rcu_free' [-Werror=missing-prototypes] Instead, move the declaration for this function to a new header that can be included by both, and do the same for the radix_tree_node_cachep variable that has the same underlying problem but does not cause a warning with gcc. [zhangpeng.00@bytedance.com: fix building radix tree test suite] Link: https://lkml.kernel.org/r/20230521095450.21332-1-zhangpeng.00@bytedance.com Link: https://lkml.kernel.org/r/20230516194212.548910-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Peng Zhang Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 2f012f2baca140c488e43d27a374029c1e59098d Author: Ryusuke Konishi Date: Sat May 13 19:24:28 2023 +0900 nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() A syzbot fault injection test reported that nilfs_btnode_create_block, a helper function that allocates a new node block for b-trees, causes a kernel BUG for disk images where the file system block size is smaller than the page size. This was due to unexpected flags on the newly allocated buffer head, and it turned out to be because the buffer flags were not cleared by nilfs_btnode_abort_change_key() after an error occurred during a b-tree update operation and the buffer was later reused in that state. Fix this issue by using nilfs_btnode_delete() to abandon the unused preallocated buffer in nilfs_btnode_abort_change_key(). Link: https://lkml.kernel.org/r/20230513102428.10223-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+b0a35a5c1f7e846d3b09@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/000000000000d1d6c205ebc4d512@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit fd37b884003c7e46a0337b6e9212326d3ee1f40d Author: Jens Axboe Date: Mon Jun 12 12:11:57 2023 -0600 io_uring/io-wq: don't clear PF_IO_WORKER on exit A recent commit gated the core dumping task exit logic on current->flags remaining consistent in terms of PF_{IO,USER}_WORKER at task exit time. This exposed a problem with the io-wq handling of that, which explicitly clears PF_IO_WORKER before calling do_exit(). The reasons for this manual clear of PF_IO_WORKER is historical, where io-wq used to potentially trigger a sleep on exit. As the io-wq thread is exiting, it should not participate any further accounting. But these days we don't need to rely on current->flags anymore, so we can safely remove the PF_IO_WORKER clearing. Reported-by: Zorro Lang Reported-by: Dave Chinner Link: https://lore.kernel.org/all/ZIZSPyzReZkGBEFy@dread.disaster.area/ Fixes: f9010dbdce91 ("fork, vhost: Use CLONE_THREAD to fix freezer/ps regression") Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds commit ace9e12da2f09faf85cd1904c14e1ab3ca49a590 Merge: 858fd168a95c5 79b8ee702c918 Author: Linus Torvalds Date: Mon Jun 12 10:53:35 2023 -0700 Merge tag 'for-6.4-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A more fixes and regression fixes: - in subpage mode, fix crash when repairing metadata at the end of a stripe - properly enable async discard when remounting from read-only to read-write - scrub regression fixes: - respect read-only scrub when attempting to do a repair - fix reporting of found errors, the stats don't get properly accounted after a stripe repair" * tag 'for-6.4-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: scrub: also report errors hit during the initial read btrfs: scrub: respect the read-only flag during repair btrfs: properly enable async discard when switching from RO->RW btrfs: subpage: fix a crash in metadata repair path commit 6f363f5aa845561f7ea496d8b1175e3204470486 Author: Xiu Jianfeng Date: Sat Jun 10 17:26:43 2023 +0800 cgroup: Do not corrupt task iteration when rebinding subsystem We found a refcount UAF bug as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 342 at lib/refcount.c:25 refcount_warn_saturate+0xa0/0x148 Workqueue: events cpuset_hotplug_workfn Call trace: refcount_warn_saturate+0xa0/0x148 __refcount_add.constprop.0+0x5c/0x80 css_task_iter_advance_css_set+0xd8/0x210 css_task_iter_advance+0xa8/0x120 css_task_iter_next+0x94/0x158 update_tasks_root_domain+0x58/0x98 rebuild_root_domains+0xa0/0x1b0 rebuild_sched_domains_locked+0x144/0x188 cpuset_hotplug_workfn+0x138/0x5a0 process_one_work+0x1e8/0x448 worker_thread+0x228/0x3e0 kthread+0xe0/0xf0 ret_from_fork+0x10/0x20 then a kernel panic will be triggered as below: Unable to handle kernel paging request at virtual address 00000000c0000010 Call trace: cgroup_apply_control_disable+0xa4/0x16c rebind_subsystems+0x224/0x590 cgroup_destroy_root+0x64/0x2e0 css_free_rwork_fn+0x198/0x2a0 process_one_work+0x1d4/0x4bc worker_thread+0x158/0x410 kthread+0x108/0x13c ret_from_fork+0x10/0x18 The race that cause this bug can be shown as below: (hotplug cpu) | (umount cpuset) mutex_lock(&cpuset_mutex) | mutex_lock(&cgroup_mutex) cpuset_hotplug_workfn | rebuild_root_domains | rebind_subsystems update_tasks_root_domain | spin_lock_irq(&css_set_lock) css_task_iter_start | list_move_tail(&cset->e_cset_node[ss->id] while(css_task_iter_next) | &dcgrp->e_csets[ss->id]); css_task_iter_end | spin_unlock_irq(&css_set_lock) mutex_unlock(&cpuset_mutex) | mutex_unlock(&cgroup_mutex) Inside css_task_iter_start/next/end, css_set_lock is hold and then released, so when iterating task(left side), the css_set may be moved to another list(right side), then it->cset_head points to the old list head and it->cset_pos->next points to the head node of new list, which can't be used as struct css_set. To fix this issue, switch from all css_sets to only scgrp's css_sets to patch in-flight iterators to preserve correct iteration, and then update it->cset_head as well. Reported-by: Gaosheng Cui Link: https://www.spinics.net/lists/cgroups/msg37935.html Suggested-by: Michal Koutný Link: https://lore.kernel.org/all/20230526114139.70274-1-xiujianfeng@huaweicloud.com/ Signed-off-by: Xiu Jianfeng Fixes: 2d8f243a5e6e ("cgroup: implement cgroup->e_csets[]") Cc: stable@vger.kernel.org # v3.16+ Signed-off-by: Tejun Heo commit f0cc749254d12c78e93dae3b27b21dc9546843d0 Author: Tetsuo Handa Date: Sun Jun 11 22:48:12 2023 +0900 cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex in freezer_css_{online,offline}() syzbot is again reporting circular locking dependency between cpu_hotplug_lock and freezer_mutex. Do like what we did with commit 57dcd64c7e036299 ("cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex"). Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=2ab700fe1829880a2ec6 Signed-off-by: Tetsuo Handa Tested-by: syzbot Fixes: f5d39b020809 ("freezer,sched: Rewrite core freezer logic") Cc: stable@vger.kernel.org # v6.1+ Signed-off-by: Tejun Heo commit ad96f1c9138e0897bee7f7c5e54b3e24f8b62f57 Author: Yonghong Song Date: Thu Jun 8 17:54:39 2023 -0700 bpf: Fix a bpf_jit_dump issue for x86_64 with sysctl bpf_jit_enable. The sysctl net/core/bpf_jit_enable does not work now due to commit 1022a5498f6f ("bpf, x86_64: Use bpf_jit_binary_pack_alloc"). The commit saved the jitted insns into 'rw_image' instead of 'image' which caused bpf_jit_dump not dumping proper content. With 'echo 2 > /proc/sys/net/core/bpf_jit_enable', run './test_progs -t fentry_test'. Without this patch, one of jitted image for one particular prog is: flen=17 proglen=92 pass=4 image=0000000014c64883 from=test_progs pid=1807 00000000: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000010: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000020: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000030: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000040: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000050: cc cc cc cc cc cc cc cc cc cc cc cc With this patch, the jitte image for the same prog is: flen=17 proglen=92 pass=4 image=00000000b90254b7 from=test_progs pid=1809 00000000: f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 00000010: 0f 1e fa 31 f6 48 8b 57 00 48 83 fa 07 75 2b 48 00000020: 8b 57 10 83 fa 09 75 22 48 8b 57 08 48 81 e2 ff 00000030: 00 00 00 48 83 fa 08 75 11 48 8b 7f 18 be 01 00 00000040: 00 00 48 83 ff 0a 74 02 31 f6 48 bf 18 d0 14 00 00000050: 00 c9 ff ff 48 89 77 00 31 c0 c9 c3 Fixes: 1022a5498f6f ("bpf, x86_64: Use bpf_jit_binary_pack_alloc") Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20230609005439.3173569-1-yhs@fb.com commit e6f9e590b72e12bbb86b1b8be7e1981f357392ad Author: Stephan Gerhold Date: Thu May 18 11:39:36 2023 +0200 mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916 While SDHCI claims to support 64-bit DMA on MSM8916 it does not seem to be properly functional. It is not immediately obvious because SDHCI is usually used with IOMMU bypassed on this SoC, and all physical memory has 32-bit addresses. But when trying to enable the IOMMU it quickly fails with an error such as the following: arm-smmu 1e00000.iommu: Unhandled context fault: fsr=0x402, iova=0xfffff200, fsynr=0xe0000, cbfrsynra=0x140, cb=3 mmc1: ADMA error: 0x02000000 mmc1: sdhci: ============ SDHCI REGISTER DUMP =========== mmc1: sdhci: Sys addr: 0x00000000 | Version: 0x00002e02 mmc1: sdhci: Blk size: 0x00000008 | Blk cnt: 0x00000000 mmc1: sdhci: Argument: 0x00000000 | Trn mode: 0x00000013 mmc1: sdhci: Present: 0x03f80206 | Host ctl: 0x00000019 mmc1: sdhci: Power: 0x0000000f | Blk gap: 0x00000000 mmc1: sdhci: Wake-up: 0x00000000 | Clock: 0x00000007 mmc1: sdhci: Timeout: 0x0000000a | Int stat: 0x00000001 mmc1: sdhci: Int enab: 0x03ff900b | Sig enab: 0x03ff100b mmc1: sdhci: ACmd stat: 0x00000000 | Slot int: 0x00000000 mmc1: sdhci: Caps: 0x322dc8b2 | Caps_1: 0x00008007 mmc1: sdhci: Cmd: 0x0000333a | Max curr: 0x00000000 mmc1: sdhci: Resp[0]: 0x00000920 | Resp[1]: 0x5b590000 mmc1: sdhci: Resp[2]: 0xe6487f80 | Resp[3]: 0x0a404094 mmc1: sdhci: Host ctl2: 0x00000008 mmc1: sdhci: ADMA Err: 0x00000001 | ADMA Ptr: 0x0000000ffffff224 mmc1: sdhci_msm: ----------- VENDOR REGISTER DUMP ----------- mmc1: sdhci_msm: DLL sts: 0x00000000 | DLL cfg: 0x60006400 | DLL cfg2: 0x00000000 mmc1: sdhci_msm: DLL cfg3: 0x00000000 | DLL usr ctl: 0x00000000 | DDR cfg: 0x00000000 mmc1: sdhci_msm: Vndr func: 0x00018a9c | Vndr func2 : 0xf88018a8 Vndr func3: 0x00000000 mmc1: sdhci: ============================================ mmc1: sdhci: fffffffff200: DMA 0x0000ffffffffe100, LEN 0x0008, Attr=0x21 mmc1: sdhci: fffffffff20c: DMA 0x0000000000000000, LEN 0x0000, Attr=0x03 Looking closely it's obvious that only the 32-bit part of the address (0xfffff200) arrives at the SMMU, the higher 16-bit (0xffff...) get lost somewhere. This might not be a limitation of the SDHCI itself but perhaps the bus/interconnect it is connected to, or even the connection to the SMMU. Work around this by setting SDHCI_QUIRK2_BROKEN_64_BIT_DMA to avoid using 64-bit addresses. Signed-off-by: Stephan Gerhold Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230518-msm8916-64bit-v1-1-5694b0f35211@gerhold.net Signed-off-by: Ulf Hansson commit 842665a9008a53ff13ac22a4e4b8ae2f10e92aca Author: Herbert Xu Date: Wed Jun 7 16:38:47 2023 +0800 xfrm: Use xfrm_state selector for BEET input For BEET the inner address and therefore family is stored in the xfrm_state selector. Use that when decapsulating an input packet instead of incorrectly relying on a non-existent tunnel protocol. Fixes: 5f24f41e8ea6 ("xfrm: Remove inner/outer modes from input path") Reported-by: Steffen Klassert Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert commit 75e6def3b26736e7ff80639810098c9074229737 Author: Dan Carpenter Date: Fri Jun 9 14:05:19 2023 +0300 sctp: fix an error code in sctp_sf_eat_auth() The sctp_sf_eat_auth() function is supposed to enum sctp_disposition values and returning a kernel error code will cause issues in the caller. Change -ENOMEM to SCTP_DISPOSITION_NOMEM. Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.") Signed-off-by: Dan Carpenter Acked-by: Xin Long Signed-off-by: David S. Miller commit a0067dfcd9418fd3b0632bc59210d120d038a9c6 Author: Dan Carpenter Date: Fri Jun 9 14:04:43 2023 +0300 sctp: handle invalid error codes without calling BUG() The sctp_sf_eat_auth() function is supposed to return enum sctp_disposition values but if the call to sctp_ulpevent_make_authkey() fails, it returns -ENOMEM. This results in calling BUG() inside the sctp_side_effects() function. Calling BUG() is an over reaction and not helpful. Call WARN_ON_ONCE() instead. This code predates git. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit ce57adc222aba32431c42632b396e9213d0eb0b8 Author: Hangbin Liu Date: Fri Jun 9 17:15:02 2023 +0800 ipvlan: fix bound dev checking for IPv6 l3s mode The commit 59a0b022aa24 ("ipvlan: Make skb->skb_iif track skb->dev for l3s mode") fixed ipvlan bonded dev checking by updating skb skb_iif. This fix works for IPv4, as in raw_v4_input() the dif is from inet_iif(skb), which is skb->skb_iif when there is no route. But for IPv6, the fix is not enough, because in ipv6_raw_deliver() -> raw_v6_match(), the dif is inet6_iif(skb), which is returns IP6CB(skb)->iif instead of skb->skb_iif if it's not a l3_slave. To fix the IPv6 part issue. Let's set IP6CB(skb)->iif to correct ifindex. BTW, ipvlan handles NS/NA specifically. Since it works fine, I will not reset IP6CB(skb)->iif when addr->atype is IPVL_ICMPV6. Fixes: c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from other modes") Link: https://bugzilla.redhat.com/show_bug.cgi?id=2196710 Signed-off-by: Hangbin Liu Reviewed-by: Larysa Zaremba Signed-off-by: David S. Miller commit d094482c9974a543851a18a1c587a7d132a81659 Author: Benjamin Berg Date: Sun Jun 11 12:14:29 2023 +0300 wifi: mac80211: fragment per STA profile correctly When fragmenting the ML per STA profile, the element ID should be IEEE80211_MLE_SUBELEM_PER_STA_PROFILE rather than WLAN_EID_FRAGMENT. Change the helper function to take the to be used element ID and pass the appropriate value for each of the fragmentation levels. Fixes: 81151ce462e5 ("wifi: mac80211: support MLO authentication/association with one link") Signed-off-by: Benjamin Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230611121219.9b5c793d904b.I7dad952bea8e555e2f3139fbd415d0cd2b3a08c3@changeid Signed-off-by: Johannes Berg commit 52f79609c0c5b25fddb88e85f25ce08aa7e3fb42 Author: Jakub Kicinski Date: Thu Jun 8 09:23:44 2023 -0700 net: ethtool: correct MAX attribute value for stats When compiling YNL generated code compiler complains about array-initializer-out-of-bounds. Turns out the MAX value for STATS_GRP uses the value for STATS. This may lead to random corruptions in user space (kernel itself doesn't use this value as it never parses stats). Fixes: f09ea6fb1272 ("ethtool: add a new command for reading standard stats") Signed-off-by: Jakub Kicinski Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 5e90aa21eb1372736e08cee0c0bf47735c5c4b95 Author: Shyam Prasad N Date: Fri Jun 9 17:46:58 2023 +0000 cifs: fix max_credits implementation The current implementation of max_credits on the client does not work because the CreditRequest logic for several commands does not take max_credits into account. Still, we can end up asking the server for more credits, depending on the number of credits in flight. For this, we need to limit the credits while parsing the responses too. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 2991b77409891e14a10b96899755c004b0c07edb Author: Shyam Prasad N Date: Fri Jun 9 17:46:59 2023 +0000 cifs: fix sockaddr comparison in iface_cmp iface_cmp used to simply do a memcmp of the two provided struct sockaddrs. The comparison needs to do more based on the address family. Similar logic was already present in cifs_match_ipaddr. Doing something similar now. Signed-off-by: Shyam Prasad N Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Steve French commit 50e63d6db6fd30a6dd9a33c49aa5b0bba36e1a92 Author: Enzo Matsumiya Date: Fri Jun 9 18:29:59 2023 -0300 smb/client: print "Unknown" instead of bogus link speed value The virtio driver for Linux guests will not set a link speed to its paravirtualized NICs. This will be seen as -1 in the ethernet layer, and when some servers (e.g. samba) fetches it, it's converted to an unsigned value (and multiplied by 1000 * 1000), so in client side we end up with: 1) Speed: 4294967295000000 bps in DebugData. This patch introduces a helper that returns a speed string (in Mbps or Gbps) if interface speed is valid (>= SPEED_10 and <= SPEED_800000), or "Unknown" otherwise. The reason to not change the value in iface->speed is because we don't know the real speed of the HW backing the server NIC, so let's keep considering these as the fastest NICs available. Also print "Capabilities: None" when the interface doesn't support any. Signed-off-by: Enzo Matsumiya Reviewed-by: Shyam Prasad N Signed-off-by: Steve French commit 2a44b389664c193dc06cb37d9663d3c5a2a2b743 Author: Shyam Prasad N Date: Fri Jun 9 17:46:55 2023 +0000 cifs: print all credit counters in DebugData Output of /proc/fs/cifs/DebugData shows only the per-connection counter for the number of credits of regular type. i.e. the credits reserved for echo and oplocks are not displayed. There have been situations recently where having this info would have been useful. This change prints the credit counters of all three types: regular, echo, oplocks. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 91f4480c41f56f7c723323cf7f581f1d95d9ffbc Author: Shyam Prasad N Date: Fri Jun 9 17:46:54 2023 +0000 cifs: fix status checks in cifs_tree_connect The ordering of status checks at the beginning of cifs_tree_connect is wrong. As a result, a tcon which is good may stay marked as needing reconnect infinitely. Fixes: 2f0e4f034220 ("cifs: check only tcon status on tcon related functions") Cc: stable@vger.kernel.org # 6.3 Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit a5998a9ec3c03297a5b7f3df5c1979cd469a0da3 Author: 鑫华 Date: Tue Jun 6 23:34:56 2023 +0800 smb: remove obsolete comment Because do_gettimeofday has been removed and replaced by ktime_get_real_ts64, So just remove the comment as it's not needed now. Signed-off-by: 鑫华 Signed-off-by: Steve French commit 20cb1c2fb7568a6054c55defe044311397e01ddb Author: Ming Lei Date: Sat Jun 10 07:42:49 2023 +0800 blk-cgroup: Flush stats before releasing blkcg_gq As noted by Michal, the blkg_iostat_set's in the lockless list hold reference to blkg's to protect against their removal. Those blkg's hold reference to blkcg. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn() which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. It is less a problem if the cgroup to be destroyed also has other controllers like memory that will call cgroup_rstat_flush() which will clean up the reference count. If block is the only controller that uses rstat, these offline blkcg and blkgs may never be freed leaking more and more memory over time. To prevent this potential memory leak: - flush blkcg per-cpu stats list in __blkg_release(), when no new stat can be added - add global blkg_stat_lock for covering concurrent parent blkg stat update - don't grab bio->bi_blkg reference when adding the stats into blkcg's per-cpu stat list since all stats are guaranteed to be consumed before releasing blkg instance, and grabbing blkg reference for stats was the most fragile part of original patch Based on Waiman's patch: https://lore.kernel.org/linux-block/20221215033132.230023-3-longman@redhat.com/ Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") Cc: stable@vger.kernel.org Reported-by: Jay Shin Acked-by: Tejun Heo Cc: Waiman Long Cc: mkoutny@suse.com Cc: Yosry Ahmed Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230609234249.1412858-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 858fd168a95c5b9669aac8db6c14a9aeab446375 Author: Linus Torvalds Date: Sun Jun 11 14:35:30 2023 -0700 Linux 6.4-rc6 commit 699826f4e30ab76a62c238c86fbef7e826639c8d Author: Saravanan Vajravel Date: Tue Jun 6 03:25:31 2023 -0700 IB/isert: Fix incorrect release of isert connection The ib_isert module is releasing the isert connection both in isert_wait_conn() handler as well as isert_free_conn() handler. In isert_wait_conn() handler, it is expected to wait for iSCSI session logout operation to complete. It should free the isert connection only in isert_free_conn() handler. When a bunch of iSER target is cleared, this issue can lead to use-after-free memory issue as isert conn is twice released Fixes: b02efbfc9a05 ("iser-target: Fix implicit termination of connections") Reviewed-by: Sagi Grimberg Signed-off-by: Saravanan Vajravel Signed-off-by: Selvin Xavier Link: https://lore.kernel.org/r/20230606102531.162967-4-saravanan.vajravel@broadcom.com Signed-off-by: Leon Romanovsky commit 7651e2d6c5b359a28c2d4c904fec6608d1021ca8 Author: Saravanan Vajravel Date: Tue Jun 6 03:25:30 2023 -0700 IB/isert: Fix possible list corruption in CMA handler When ib_isert module receives connection error event, it is releasing the isert session and removes corresponding list node but it doesn't take appropriate mutex lock to remove the list node. This can lead to linked list corruption Fixes: bd3792205aae ("iser-target: Fix pending connections handling in target stack shutdown sequnce") Signed-off-by: Selvin Xavier Signed-off-by: Saravanan Vajravel Link: https://lore.kernel.org/r/20230606102531.162967-3-saravanan.vajravel@broadcom.com Signed-off-by: Leon Romanovsky commit 691b0480933f0ce88a81ed1d1a0aff340ff6293a Author: Saravanan Vajravel Date: Tue Jun 6 03:25:29 2023 -0700 IB/isert: Fix dead lock in ib_isert - When a iSER session is released, ib_isert module is taking a mutex lock and releasing all pending connections. As part of this, ib_isert is destroying rdma cm_id. To destroy cm_id, rdma_cm module is sending CM events to CMA handler of ib_isert. This handler is taking same mutex lock. Hence it leads to deadlock between ib_isert & rdma_cm modules. - For fix, created local list of pending connections and release the connection outside of mutex lock. Calltrace: --------- [ 1229.791410] INFO: task kworker/10:1:642 blocked for more than 120 seconds. [ 1229.791416] Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 [ 1229.791418] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1229.791419] task:kworker/10:1 state:D stack: 0 pid: 642 ppid: 2 flags:0x80004000 [ 1229.791424] Workqueue: ib_cm cm_work_handler [ib_cm] [ 1229.791436] Call Trace: [ 1229.791438] __schedule+0x2d1/0x830 [ 1229.791445] ? select_idle_sibling+0x23/0x6f0 [ 1229.791449] schedule+0x35/0xa0 [ 1229.791451] schedule_preempt_disabled+0xa/0x10 [ 1229.791453] __mutex_lock.isra.7+0x310/0x420 [ 1229.791456] ? select_task_rq_fair+0x351/0x990 [ 1229.791459] isert_cma_handler+0x224/0x330 [ib_isert] [ 1229.791463] ? ttwu_queue_wakelist+0x159/0x170 [ 1229.791466] cma_cm_event_handler+0x25/0xd0 [rdma_cm] [ 1229.791474] cma_ib_handler+0xa7/0x2e0 [rdma_cm] [ 1229.791478] cm_process_work+0x22/0xf0 [ib_cm] [ 1229.791483] cm_work_handler+0xf4/0xf30 [ib_cm] [ 1229.791487] ? move_linked_works+0x6e/0xa0 [ 1229.791490] process_one_work+0x1a7/0x360 [ 1229.791491] ? create_worker+0x1a0/0x1a0 [ 1229.791493] worker_thread+0x30/0x390 [ 1229.791494] ? create_worker+0x1a0/0x1a0 [ 1229.791495] kthread+0x10a/0x120 [ 1229.791497] ? set_kthread_struct+0x40/0x40 [ 1229.791499] ret_from_fork+0x1f/0x40 [ 1229.791739] INFO: task targetcli:28666 blocked for more than 120 seconds. [ 1229.791740] Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 [ 1229.791741] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1229.791742] task:targetcli state:D stack: 0 pid:28666 ppid: 5510 flags:0x00004080 [ 1229.791743] Call Trace: [ 1229.791744] __schedule+0x2d1/0x830 [ 1229.791746] schedule+0x35/0xa0 [ 1229.791748] schedule_preempt_disabled+0xa/0x10 [ 1229.791749] __mutex_lock.isra.7+0x310/0x420 [ 1229.791751] rdma_destroy_id+0x15/0x20 [rdma_cm] [ 1229.791755] isert_connect_release+0x115/0x130 [ib_isert] [ 1229.791757] isert_free_np+0x87/0x140 [ib_isert] [ 1229.791761] iscsit_del_np+0x74/0x120 [iscsi_target_mod] [ 1229.791776] lio_target_np_driver_store+0xe9/0x140 [iscsi_target_mod] [ 1229.791784] configfs_write_file+0xb2/0x110 [ 1229.791788] vfs_write+0xa5/0x1a0 [ 1229.791792] ksys_write+0x4f/0xb0 [ 1229.791794] do_syscall_64+0x5b/0x1a0 [ 1229.791798] entry_SYSCALL_64_after_hwframe+0x65/0xca Fixes: bd3792205aae ("iser-target: Fix pending connections handling in target stack shutdown sequnce") Reviewed-by: Sagi Grimberg Signed-off-by: Selvin Xavier Signed-off-by: Saravanan Vajravel Link: https://lore.kernel.org/r/20230606102531.162967-2-saravanan.vajravel@broadcom.com Signed-off-by: Leon Romanovsky commit 4c605260bc60347d3d5601900704cb22b0b2efec Merge: 65d7ca5987f29 a37f2699c36a7 Author: Linus Torvalds Date: Sun Jun 11 10:14:02 2023 -0700 Merge tag 'x86_urgent_for_v6.4_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: - Set up the kernel CS earlier in the boot process in case EFI boots the kernel after bypassing the decompressor and the CS descriptor used ends up being the EFI one which is not mapped in the identity page table, leading to early SEV/SNP guest communication exceptions resulting in the guest crashing * tag 'x86_urgent_for_v6.4_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed commit 65d7ca5987f29f4c3d5c0889d2f046bb246d18d4 Merge: 022ce8862dff8 1c1bcf2d3ea06 Author: Linus Torvalds Date: Sun Jun 11 10:07:35 2023 -0700 Merge tag '6.4-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: "Five smb3 server fixes, all also for stable: - Fix four slab out of bounds warnings: improve checks for protocol id, and for small packet length, and for create context parsing, and for negotiate context parsing - Fix for incorrect dereferencing POSIX ACLs" * tag '6.4-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: validate smb request protocol id ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR() ksmbd: fix out-of-bound read in parse_lease_state() ksmbd: fix out-of-bound read in deassemble_neg_contexts() commit 617f5db1a626f18d5cbb7c7faf7bf8f9ea12be78 Author: Mark Bloch Date: Mon Jun 5 13:33:26 2023 +0300 RDMA/mlx5: Fix affinity assignment The cited commit aimed to ensure that Virtual Functions (VFs) assign a queue affinity to a Queue Pair (QP) to distribute traffic when the LAG master creates a hardware LAG. If the affinity was set while the hardware was not in LAG, the firmware would ignore the affinity value. However, this commit unintentionally assigned an affinity to QPs on the LAG master's VPORT even if the RDMA device was not marked as LAG-enabled. In most cases, this was not an issue because when the hardware entered hardware LAG configuration, the RDMA device of the LAG master would be destroyed and a new one would be created, marked as LAG-enabled. The problem arises when a user configures Equal-Cost Multipath (ECMP). In ECMP mode, traffic can be directed to different physical ports based on the queue affinity, which is intended for use by VPORTS other than the E-Switch manager. ECMP mode is supported only if both E-Switch managers are in switchdev mode and the appropriate route is configured via IP. In this configuration, the RDMA device is not destroyed, and we retain the RDMA device that is not marked as LAG-enabled. To ensure correct behavior, Send Queues (SQs) opened by the E-Switch manager through verbs should be assigned strict affinity. This means they will only be able to communicate through the native physical port associated with the E-Switch manager. This will prevent the firmware from assigning affinity and will not allow the SQs to be remapped in case of failover. Fixes: 802dcc7fc5ec ("RDMA/mlx5: Support TX port affinity for VF drivers in LAG mode") Reviewed-by: Maor Gottlieb Signed-off-by: Mark Bloch Link: https://lore.kernel.org/r/425b05f4da840bc684b0f7e8ebf61aeb5cef09b0.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 62fab312fa1683e812e605db20d4f22de3e3fb2f Author: Yishai Hadas Date: Mon Jun 5 13:33:25 2023 +0300 IB/uverbs: Fix to consider event queue closing also upon non-blocking mode Fix ib_uverbs_event_read() to consider event queue closing also upon non-blocking mode. Once the queue is closed (e.g. hot-plug flow) all the existing events are cleaned-up as part of ib_uverbs_free_event_queue(). An application that uses the non-blocking FD mode should get -EIO in that case to let it knows that the device was removed already. Otherwise, it can loose the indication that the device was removed and won't recover. As part of that, refactor the code to have a single flow with regards to 'is_closed' for both blocking and non-blocking modes. Fixes: 14e23bd6d221 ("RDMA/core: Fix locking in ib_uverbs_event_read") Reviewed-by: Maor Gottlieb Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/97b00116a1e1e13f8dc4ec38a5ea81cf8c030210.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 0cadb4db79e1d9eea66711c4031e435c2191907e Author: Edward Srouji Date: Mon Jun 5 13:33:24 2023 +0300 RDMA/uverbs: Restrict usage of privileged QKEYs According to the IB specification rel-1.6, section 3.5.3: "QKEYs with the most significant bit set are considered controlled QKEYs, and a HCA does not allow a consumer to arbitrarily specify a controlled QKEY." Thus, block non-privileged users from setting such a QKEY. Cc: stable@vger.kernel.org Fixes: bc38a6abdd5a ("[PATCH] IB uverbs: core implementation") Signed-off-by: Edward Srouji Link: https://lore.kernel.org/r/c00c809ddafaaf87d6f6cb827978670989a511b3.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 58030c76cce473b6cfd630bbecb97215def0dff8 Author: Mark Zhang Date: Mon Jun 5 13:33:23 2023 +0300 RDMA/cma: Always set static rate to 0 for RoCE Set static rate to 0 as it should be discovered by path query and has no meaning for RoCE. This also avoid of using the rtnl lock and ethtool API, which is a bottleneck when try to setup many rdma-cm connections at the same time, especially with multiple processes. Fixes: 3c86aa70bf67 ("RDMA/cm: Add RDMA CM support for IBoE devices") Signed-off-by: Mark Zhang Link: https://lore.kernel.org/r/f72a4f8b667b803aee9fa794069f61afb5839ce4.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 2de43f5b5137e03ef64a2c3f064a01992830c67f Author: Patrisious Haddad Date: Mon Jun 5 13:33:21 2023 +0300 RDMA/mlx5: Fix Q-counters query in LAG mode Previously we used the core device associated to the IB device in order to do the Q-counters query to the FW, but in LAG mode it is possible that the core device isn't the one that created this VF. Hence instead of using the core device to query the Q-counters we use the ESW core device which is guaranteed to be that of the VF. Fixes: d22467a71ebe ("RDMA/mlx5: Expand switchdev Q-counters to expose representor statistics") Signed-off-by: Patrisious Haddad Reviewed-by: Mark Zhang Link: https://lore.kernel.org/r/778d7d7a24892348d0bdef17d2e5f9e044717e86.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit e80ef139488fb4f481c877a81f6ba54f1f0ee416 Author: Patrisious Haddad Date: Mon Jun 5 13:33:20 2023 +0300 RDMA/mlx5: Remove vport Q-counters dependency on normal Q-counters Previously the Q-counters initialization assumed that the vport Q-counters structures and the normal Q-counters structures are identical in size, and hence when a Q-counter was added to normal Q-counters structure but not to the vport Q-counters struct it would lead to that counter name being NULL in switchdev mode, which could cause the kernel crash below. Currently break the dependency between those two structure and always use the appropriate struct size, in order to remove the assumption that both structure sizes are equal. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 20c64a067 P4D 20c64a067 PUD 20152b067 PMD 0 Oops: 0000 [#1] SMP CPU: 19 PID: 11717 Comm: devlink Tainted: G OE 6.2.0_mlnx #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:strlen+0x0/0x20 Code: 66 2e 0f 1f 84 00 00 00 00 00 48 01 fe eb 0f 0f b6 07 38 d0 74 10 48 83 c7 01 84 c0 74 05 48 39 f7 75 ec 31 c0 c3 48 89 f8 c3 <80> 3f 00 48 89 f8 74 10 48 83 c7 01 80 3f 00 75 f7 48 29 c7 48 89 RSP: 0018:ffffc9000318b618 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000002c00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff888211918110 R09: ffff888211918000 R10: 000000000000001e R11: ffff888211918000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff8881038ec250 FS: 00007fa53342fe80(0000) GS:ffff88885fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000002042b2003 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: kernfs_name_hash+0x12/0x80 kernfs_find_ns+0x35/0xb0 kernfs_remove_by_name_ns+0x46/0xc0 remove_files.isra.1+0x30/0x70 internal_create_group+0x253/0x380 internal_create_groups.part.4+0x3e/0xa0 setup_port+0x27a/0x8c0 [ib_core] ib_setup_port_attrs+0x9d/0x300 [ib_core] ib_register_device+0x48e/0x550 [ib_core] __mlx5_ib_add+0x2b/0x80 [mlx5_ib] mlx5_ib_vport_rep_load+0x141/0x360 [mlx5_ib] mlx5_esw_offloads_rep_load+0x48/0xa0 [mlx5_core] esw_offloads_enable+0x41e/0xd10 [mlx5_core] mlx5_eswitch_enable_locked+0x1e3/0x340 [mlx5_core] ? __cond_resched+0x15/0x30 mlx5_devlink_eswitch_mode_set+0x204/0x3c0 [mlx5_core] devlink_nl_cmd_eswitch_set_doit+0x8d/0x100 genl_family_rcv_msg_doit.isra.19+0xea/0x110 genl_rcv_msg+0x19b/0x290 ? devlink_nl_cmd_region_read_dumpit+0x760/0x760 ? devlink_nl_cmd_port_param_get_doit+0x30/0x30 ? devlink_put+0x50/0x50 ? genl_get_cmd_both+0x60/0x60 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1be/0x2a0 netlink_sendmsg+0x361/0x4d0 sock_sendmsg+0x30/0x40 __sys_sendto+0x11a/0x150 ? handle_mm_fault+0x101/0x2b0 ? do_user_addr_fault+0x21d/0x720 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fa533611cba Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c RSP: 002b:00007ffdb6a898a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000daab00 RCX: 00007fa533611cba RDX: 0000000000000038 RSI: 0000000000daab00 RDI: 0000000000000003 RBP: 0000000000daa910 R08: 00007fa533822000 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) mlx_compat(OE) mlxfw(OE) memtrack(OE) pci_hyperv_intf nfsv3 nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_filter iptable_nat dns_resolver nf_nat br_netfilter nfs bridge stp llc lockd grace fscache netfs rfkill overlay iTCO_wdt iTCO_vendor_support kvm_intel kvm irqbypass crc32_pclmul ghash_clmulni_intel i2c_i801 sunrpc lpc_ich sha512_ssse3 pcspkr i2c_smbus mfd_core drm sch_fq_codel i2c_core ip_tables fuse crc32c_intel serio_raw virtio_net net_failover failover [last unloaded: mlxfw] CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x0/0x20 Code: 66 2e 0f 1f 84 00 00 00 00 00 48 01 fe eb 0f 0f b6 07 38 d0 74 10 48 83 c7 01 84 c0 74 05 48 39 f7 75 ec 31 c0 c3 48 89 f8 c3 <80> 3f 00 48 89 f8 74 10 48 83 c7 01 80 3f 00 75 f7 48 29 c7 48 89 RSP: 0018:ffffc9000318b618 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000002c00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff888211918110 R09: ffff888211918000 R10: 000000000000001e R11: ffff888211918000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff8881038ec250 FS: 00007fa53342fe80(0000) GS:ffff88885fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000002042b2003 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Kernel panic - not syncing: Fatal exception Kernel Offset: disabled ---[ end Kernel panic - not syncing: Fatal exception ]--- Fixes: d22467a71ebe ("RDMA/mlx5: Expand switchdev Q-counters to expose representor statistics") Signed-off-by: Patrisious Haddad Reviewed-by: Mark Zhang Link: https://lore.kernel.org/r/016777b7f16eb6bb178999ff59097d0c0f91f68a.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit c2ea687e5e0e29802714a981a1ccdc17c2c4b2be Author: Patrisious Haddad Date: Mon Jun 5 13:33:19 2023 +0300 RDMA/mlx5: Fix Q-counters per vport allocation Previously Q-counters data was being allocated over the PF for all of the available vports, however that isn't necessary. Since each VF or SF has a Q-counter allocated for itself. So we only need to allocate two counters data structures, one for the device counters, and one for all the other vports to expose the representors, since they only need to read from it in order to determine mainly counters numbers and names, so they can all share. This in turn also solves a bug we previously had where we couldn't switch the device to switchdev mode when there were more than 128 SF/VFs configured, since that is the maximum amount of Q-counters available for a single port Fixes: d22467a71ebe ("RDMA/mlx5: Expand switchdev Q-counters to expose representor statistics") Signed-off-by: Patrisious Haddad Reviewed-by: Mark Zhang Link: https://lore.kernel.org/r/f54671df16e2227a069b229b33b62cd9ee24c475.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit e1f4a52ac171dd863fe89055e749ef5e0a0bc5ce Author: Mark Bloch Date: Mon Jun 5 13:33:18 2023 +0300 RDMA/mlx5: Create an indirect flow table for steering anchor A misbehaved user can create a steering anchor that points to a kernel flow table and then destroy the anchor without freeing the associated STC. This creates a problem as the kernel can't destroy the flow table since there is still a reference to it. As a result, this can exhaust all available flow table resources, preventing other users from using the RDMA device. To prevent this problem, a solution is implemented where a special flow table with two steering rules is created when a user creates a steering anchor for the first time. The rules include one that drops all traffic and another that points to the kernel flow table. If the steering anchor is destroyed, only the rule pointing to the kernel's flow table is removed. Any traffic reaching the special flow table after that is dropped. Since the special flow table is not destroyed when the steering anchor is destroyed, any issues are prevented from occurring. The remaining resources are only destroyed when the RDMA device is destroyed, which happens after all DEVX objects are freed, including the STCs, thus mitigating the issue. Fixes: 0c6ab0ca9a66 ("RDMA/mlx5: Expose steering anchor to userspace") Signed-off-by: Mark Bloch Reviewed-by: Maor Gottlieb Link: https://lore.kernel.org/r/b4a88a871d651fa4e8f98d552553c1cfe9ba2cd6.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit ee4d269eccfea6c17b18281bef482700d898e86f Author: Maher Sanalla Date: Mon Jun 5 13:33:17 2023 +0300 RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions Delay drop data is initiated for PFs that have the capability of rq_delay_drop and are in roce profile. However, PFs with RAW ethernet profile do not initiate delay drop data on function load, causing kernel panic if delay drop struct members are accessed later on in case a dropless RQ is created. Thus, stage the delay drop initialization as part of RAW ethernet PF loading process. Fixes: b5ca15ad7e61 ("IB/mlx5: Add proper representors support") Signed-off-by: Maher Sanalla Reviewed-by: Maor Gottlieb Link: https://lore.kernel.org/r/2e9d386785043d48c38711826eb910315c1de141.1685960567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 022ce8862dff83c859089cd14bc4dca0733e2f90 Merge: 6be5e47b69d8b 33f36147be36c Author: Linus Torvalds Date: Sat Jun 10 13:36:07 2023 -0700 Merge tag 'i2c-for-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Biggest news is that Andi Shyti steps in for maintaining the controller drivers. Thank you very much! Other than that, one new driver maintainer and the rest is usual driver bugfixes. at24 has a Kconfig dependecy fix" * tag 'i2c-for-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: MAINTAINERS: Add entries for Renesas RZ/V2M I2C driver eeprom: at24: also select REGMAP i2c: sprd: Delete i2c adapter in .remove's error path i2c: mv64xxx: Fix reading invalid status value in atomic mode i2c: designware: fix idx_write_cnt in read loop i2c: mchp-pci1xxxx: Avoid cast to incompatible function type i2c: img-scb: Fix spelling mistake "innacurate" -> "inaccurate" MAINTAINERS: Add myself as I2C host drivers maintainer commit 6be5e47b69d8bb7c3dba8d84807624954243c23a Merge: 859c74595156f 58d95889f3c20 Author: Linus Torvalds Date: Sat Jun 10 13:21:04 2023 -0700 Merge tag 'soundwire-6.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire fixes from Vinod Koul: "Core fix for missing flag clear, error patch handling in qcom driver and BIOS quirk for HP Spectre x360: - HP Spectre x360 soundwire DMI quirk - Error path handling for qcom driver - Core fix for missing clear of alloc_slave_rt" * tag 'soundwire-6.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: stream: Add missing clear of alloc_slave_rt soundwire: qcom: add proper error paths in qcom_swrm_startup() soundwire: dmi-quirks: add new mapping for HP Spectre x360 commit 859c74595156f894c4e8edd523c6d1c4a1899127 Merge: 64569520920a3 5cdd5ec176544 Author: Linus Torvalds Date: Sat Jun 10 13:01:09 2023 -0700 Merge tag 'arm-fixes-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "Most of the changes this time are for the Qualcomm Snapdragon platforms. There are bug fixes for error handling in Qualcomm icc-bwmon, rpmh-rsc, ramp_controller and rmtfs driver as well as the AMD tee firmware driver and a missing initialization in the Arm ff-a firmware driver. The Qualcomm RPMh and EDAC drivers need some rework to work correctly on all supported chips. The DT fixes include: - i.MX8 fixes for gpio, pinmux and clock settings - ADS touchscreen gpio polarity settings in several machines - Address dtb warnings for caches, panel and input-enable properties on Qualcomm platforms - Incorrect data on qualcomm platforms fir SA8155P power domains, SM8550 LLCC, SC7180-lite SDRAM frequencies and SM8550 soundwire - Remoteproc firmware paths are corrected for Sony Xperia 10 IV" * tag 'arm-fixes-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (36 commits) firmware: arm_ffa: Set handle field to zero in memory descriptor ARM: dts: Fix erroneous ADS touchscreen polarities arm64: dts: imx8mn-beacon: Fix SPI CS pinmux arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals EDAC/qcom: Get rid of hardcoded register offsets EDAC/qcom: Remove superfluous return variable assignment in qcom_llcc_core_setup() arm64: dts: qcom: sm8550: Use the correct LLCC register scheme dt-bindings: cache: qcom,llcc: Fix SM8550 description arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards arm64: dts: qcom: sm8550: use uint16 for Soundwire interval soc: qcom: rpmhpd: Add SA8155P power domains arm64: dts: qcom: Split out SA8155P and use correct RPMh power domains dt-bindings: power: qcom,rpmpd: Add SA8155P soc: qcom: Rename ice to qcom_ice to avoid module name conflict soc: qcom: rmtfs: Fix error code in probe() soc: qcom: ramp_controller: Fix an error handling path in qcom_ramp_controller_probe() ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc ARM: at91: pm: fix imbalanced reference counter for ethernet devices arm64: dts: qcom: sm6375-pdx225: Fix remoteproc firmware paths ... commit 7ebe4eda4265642859507d1b3ca330d8c196cfe5 Author: David Christensen Date: Thu Jun 8 16:01:43 2023 -0400 bnx2x: fix page fault following EEH recovery In the last step of the EEH recovery process, the EEH driver calls into bnx2x_io_resume() to re-initialize the NIC hardware via the function bnx2x_nic_load(). If an error occurs during bnx2x_nic_load(), OS and hardware resources are released and an error code is returned to the caller. When called from bnx2x_io_resume(), the return code is ignored and the network interface is brought up unconditionally. Later attempts to send a packet via this interface result in a page fault due to a null pointer reference. This patch checks the return code of bnx2x_nic_load(), prints an error message if necessary, and does not enable the interface. Signed-off-by: David Christensen Reviewed-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 65d8bd81aa15c36d9703f4393651d10edf1f030c Merge: b403643d154d1 1240eb93f0616 Author: David S. Miller Date: Sat Jun 10 19:57:03 2023 +0100 Merge tag 'nf-23-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf netfilter pull request 23-06-08 Pablo Neira Ayuso says: ==================== The following patchset contains Netfilter fixes for net: 1) Add commit and abort set operation to pipapo set abort path. 2) Bail out immediately in case of ENOMEM in nfnetlink batch. 3) Incorrect error path handling when creating a new rule leads to dangling pointer in set transaction list. ==================== Signed-off-by: David S. Miller commit b403643d154d15176b060b82f7fc605210033edd Author: Dmitry Mastykin Date: Thu Jun 8 16:57:54 2023 +0300 netlabel: fix shift wrapping bug in netlbl_catmap_setlong() There is a shift wrapping bug in this code on 32-bit architectures. NETLBL_CATMAP_MAPTYPE is u64, bitmap is unsigned long. Every second 32-bit word of catmap becomes corrupted. Signed-off-by: Dmitry Mastykin Acked-by: Paul Moore Signed-off-by: David S. Miller commit 14df9526046d2a6d2b3e002e952714ce04fc9bd7 Merge: 1b8975f30abff 87e12a17eef47 Author: David S. Miller Date: Sat Jun 10 19:53:02 2023 +0100 Merge branch 'octeontx2-af-fixes' Naveen Mamindlapalli says: ==================== RVU NIX AF driver fixes This patch series contains few fixes to the RVU NIX AF driver. The first patch modifies the driver check to validate whether the req count for contiguous and non-contiguous arrays is less than the maximum limit. The second patch fixes HW lbk interface link credit programming. ==================== Signed-off-by: David S. Miller commit 87e12a17eef476bbf768dc3a74419ad461f36fbc Author: Nithin Dabilpuram Date: Thu Jun 8 17:12:01 2023 +0530 octeontx2-af: fix lbk link credits on cn10k Fix LBK link credits on CN10K to be same as CN9K i.e 16 * MAX_LBK_DATA_RATE instead of current scheme of calculation based on LBK buf length / FIFO size. Fixes: 6e54e1c5399a ("octeontx2-af: cn10K: Add MTU configuration") Signed-off-by: Nithin Dabilpuram Signed-off-by: Naveen Mamindlapalli Reviewed-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 4e635f9d86165e47f5440196f2ebdb258efb8341 Author: Satha Rao Date: Thu Jun 8 17:12:00 2023 +0530 octeontx2-af: fixed resource availability check txschq_alloc response have two different arrays to store continuous and non-continuous schedulers of each level. Requested count should be checked for each array separately. Fixes: 5d9b976d4480 ("octeontx2-af: Support fixed transmit scheduler topology") Signed-off-by: Satha Rao Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Naveen Mamindlapalli Reviewed-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 1b8975f30abffc4f74f1ba049f9042e7d8f646cc Merge: c37cf54c12cfa 78c50d6961fc0 Author: Jakub Kicinski Date: Sat Jun 10 00:11:18 2023 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-06-08 (ice) This series contains updates to ice driver only. Simon Horman stops null pointer dereference for GNSS error path. Kamil fixes memory leak when downing interface when XDP is enabled. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix XDP memory leak when NIC is brought up and down ice: Don't dereference NULL in ice_gnss_read error path ==================== Link: https://lore.kernel.org/r/20230608200051.451752-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit c37cf54c12cfaa51e7aaf88708167b0d3259e64e Author: Ahmed Zaki Date: Thu Jun 8 13:02:26 2023 -0700 iavf: remove mask from iavf_irq_enable_queues() Enable more than 32 IRQs by removing the u32 bit mask in iavf_irq_enable_queues(). There is no need for the mask as there are no callers that select individual IRQs through the bitmask. Also, if the PF allocates more than 32 IRQs, this mask will prevent us from using all of them. Modify the comment in iavf_register.h to show that the maximum number allowed for the IRQ index is 63 as per the iAVF standard 1.0 [1]. link: [1] https://www.intel.com/content/dam/www/public/us/en/documents/product-specifications/ethernet-adaptive-virtual-function-hardware-spec.pdf Fixes: 5eae00c57f5e ("i40evf: main driver core") Signed-off-by: Ahmed Zaki Tested-by: Rafal Romanowski Reviewed-by: Simon Horman Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230608200226.451861-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit bc51d371bc9ab7f153e387b7d63a13cc7d8c5ac0 Merge: 04c55383fa568 626cb7a5f6b89 Author: Jakub Kicinski Date: Sat Jun 10 00:02:17 2023 -0700 Merge branch 'selftests-mptcp-skip-tests-not-supported-by-old-kernels-part-2' Matthieu Baerts says: ==================== selftests: mptcp: skip tests not supported by old kernels (part 2) After a few years of increasing test coverage in the MPTCP selftests, we realised [1] the last version of the selftests is supposed to run on old kernels without issues. Supporting older versions is not that easy for this MPTCP case: these selftests are often validating the internals by checking packets that are exchanged, when some MIB counters are incremented after some actions, how connections are getting opened and closed in some cases, etc. In other words, it is not limited to the socket interface between the userspace and the kernelspace. In addition to that, the current MPTCP selftests run a lot of different sub-tests but the TAP13 protocol used in the selftests don't support sub-tests: one failure in sub-tests implies that the whole selftest is seen as failed at the end because sub-tests are not tracked. It is then important to skip sub-tests not supported by old kernels. To minimise the modifications and reduce the complexity to support old versions, the idea is to look at external signs and skip the whole selftests or just some sub-tests before starting them. This cannot be applied in all cases. This second part focuses on marking different sub-tests as skipped if some MPTCP features are not supported. A few techniques are used here: - Before starting some tests: - Check if a file (sysctl knob) is present: that's what patch 13/14 is doing for the userspace PM feature. - Check if a symbol is present in /proc/kallsyms: patch 1/14 adds some helpers in mptcp_lib.sh to ease its use. Then these helpers are used in patches 2, 3, 4, 10, 11 and 14/14. - Set a flag and get the status to check if a feature is supported: patch 8/14 is doing that with the 'fullmesh' flag. - After having launched the tests: - Retrieve the counters after a test and check if they are different than 0. Similar to the check with the flag, that's not ideal but in this case, the counters were already present before the introduction of MPTCP but they have been supported by MPTCP sockets only later. Patches 5 and 6/14 are using this technique. Before skipping tests, SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var value is checked: if it is set to 1, the test is marked as "failed" instead of "skipped". MPTCP public CI expects to have all features supported and it sets this env var to 1 to catch regressions in these new checks. Patches 7/14 and 9/14 are a bit different because they don't skip tests: - Patch 7/14 retrieves the default values instead of using hardcoded ones because these default values have been modified at some points. Then the comparisons are done with the default values. - patch 9/14 relaxes the expected returned size from MPTCP's getsockopt because the different structures gathering various info can get new fields and get bigger over time. We cannot expect that the userspace is using the same structure as the kernel. Patch 12/14 marks the test as "skipped" instead of "failed" if the "ip" tool is not available. In this second part, the "mptcp_join" selftest is not modified yet. This will come soon after in the third part with quite a few patches. Link: https://lore.kernel.org/stable/CA+G9fYtDGpgT4dckXD-y-N92nqUxuvue_7AtDdBcHrbOMsDZLg@mail.gmail.com/ [1] Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 ==================== Link: https://lore.kernel.org/r/20230608-upstream-net-20230608-mptcp-selftests-support-old-kernels-part-2-v1-0-20997a6fd841@tessares.net Signed-off-by: Jakub Kicinski commit 626cb7a5f6b892e48f27a76d11af040c538e03dc Author: Matthieu Baerts Date: Thu Jun 8 18:38:56 2023 +0200 selftests: mptcp: userspace pm: skip PM listener events tests if unavailable Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the new listener events linked to the path-manager introduced by commit f8c9dfbd875b ("mptcp: add pm listener events"). It is possible to look for "mptcp_event_pm_listener" in kallsyms to know in advance if the kernel supports this feature and skip these sub-tests if the feature is not supported. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 6c73008aa301 ("selftests: mptcp: listener test for userspace PM") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit f90adb033891d418c5dafef34a9aa49f3c860991 Author: Matthieu Baerts Date: Thu Jun 8 18:38:55 2023 +0200 selftests: mptcp: userspace pm: skip if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the MPTCP Userspace PM introduced by commit 4638de5aefe5 ("mptcp: handle local addrs announced by userspace PMs"). We can skip all these tests if the feature is not supported simply by looking for the MPTCP pm_type's sysctl knob. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 259a834fadda ("selftests: mptcp: functional tests for the userspace PM type") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 723d6b9b12338c1caf06bf6fe269962ef04e2c71 Author: Matthieu Baerts Date: Thu Jun 8 18:38:54 2023 +0200 selftests: mptcp: userspace pm: skip if 'ip' tool is unavailable When a required tool is missing, the return code 4 (SKIP) should be returned instead of 1 (FAIL). Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 259a834fadda ("selftests: mptcp: functional tests for the userspace PM type") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit b631e3a4e94c77c9007d60b577a069c203ce9594 Author: Matthieu Baerts Date: Thu Jun 8 18:38:53 2023 +0200 selftests: mptcp: sockopt: skip TCP_INQ checks if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is TCP_INQ cmsg support introduced in commit 2c9e77659a0c ("mptcp: add TCP_INQ cmsg support"). It is possible to look for "mptcp_ioctl" in kallsyms because it was needed to introduce the mentioned feature. We can skip these tests and not set TCPINQ option if the feature is not supported. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 5cbd886ce2a9 ("selftests: mptcp: add TCP_INQ support") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit c6f7eccc519837ebde1d099d9610c4f1d5bd975e Author: Matthieu Baerts Date: Thu Jun 8 18:38:52 2023 +0200 selftests: mptcp: sockopt: skip getsockopt checks if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the getsockopt(SOL_MPTCP) to get info about the MPTCP connections introduced by commit 55c42fa7fa33 ("mptcp: add MPTCP_INFO getsockopt") and the following ones. It is possible to look for "mptcp_diag_fill_info" in kallsyms because it is introduced by the mentioned feature. So we can know in advance if the feature is supported and skip the sub-test if not. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: ce9979129a0b ("selftests: mptcp: add mptcp getsockopt test cases") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 8dee6ca2ac1e5630a7bb6a98bc0b686916fc2000 Author: Matthieu Baerts Date: Thu Jun 8 18:38:51 2023 +0200 selftests: mptcp: sockopt: relax expected returned size Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the getsockopt(SOL_MPTCP) to get info about the MPTCP connections introduced by commit 55c42fa7fa33 ("mptcp: add MPTCP_INFO getsockopt") and the following ones. We cannot guess in advance which sizes the kernel will returned: older kernel can returned smaller sizes, e.g. recently the tcp_info structure has been modified in commit 71fc704768f6 ("tcp: add rcv_wnd and plb_rehash to TCP_INFO") where a new field has been added. The userspace can also expect a smaller size if it is compiled with old uAPI kernel headers. So for these sizes, we can only check if they are above a certain threshold, 0 for the moment. We can also only compared sizes with the ones set by the kernel. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: ce9979129a0b ("selftests: mptcp: add mptcp getsockopt test cases") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit f3761b50b8e4cb4807b5d41e02144c8c8a0f2512 Author: Matthieu Baerts Date: Thu Jun 8 18:38:50 2023 +0200 selftests: mptcp: pm nl: skip fullmesh flag checks if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the fullmesh flag that can be given to the MPTCP in-kernel path-manager and introduced in commit 2843ff6f36db ("mptcp: remote addresses fullmesh"). If the flag is not visible in the dump after having set it, we don't check the content. Note that if we expect to have this feature and SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var is set to 1, we always check the content to avoid regressions. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 6da1dfdd037e ("selftests: mptcp: add set_flags tests in pm_netlink.sh") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 2177d0b08e421971e035672b70f3228d9485c650 Author: Matthieu Baerts Date: Thu Jun 8 18:38:49 2023 +0200 selftests: mptcp: pm nl: remove hardcoded default limits Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the checks of the default limits returned by the MPTCP in-kernel path-manager. The default values have been modified by commit 72bcbc46a5c3 ("mptcp: increase default max additional subflows to 2"). Instead of comparing with hardcoded values, we can get the default one and compare with them. Note that if we expect to have the latest version, we continue to check the hardcoded values to avoid unexpected behaviour changes. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: eedbc685321b ("selftests: add PM netlink functional tests") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit dc93086aff040349b5b2a4608c71ea01286dc2cc Author: Matthieu Baerts Date: Thu Jun 8 18:38:48 2023 +0200 selftests: mptcp: diag: skip inuse tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the reporting of the MPTCP sockets being used, introduced by commit c558246ee73e ("mptcp: add statistics for mptcp socket in use"). Similar to the parent commit, it looks like there is no good pre-check to do here, i.e. dedicated function available in kallsyms. Instead, we try to get info and if nothing is returned, the test is marked as skipped. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: e04a30f78809 ("selftest: mptcp: add test for mptcp socket in use") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit dc97251bf0b70549c76ba261516c01b8096771c5 Author: Matthieu Baerts Date: Thu Jun 8 18:38:47 2023 +0200 selftests: mptcp: diag: skip listen tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the listen diag dump support introduced by commit 4fa39b701ce9 ("mptcp: listen diag dump support"). It looks like there is no good pre-check to do here, i.e. dedicated function available in kallsyms. Instead, we try to get info if nothing is returned, the test is marked as skipped. That's not ideal because something could be wrong with the feature and instead of reporting an error, the test could be marked as skipped. If we know in advanced that the feature is supposed to be supported, the tester can set SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var to 1: in this case the test will report an error instead of marking the test as skipped if nothing is returned. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: f2ae0fa68e28 ("selftests/mptcp: add diag listen tests") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 06b03083158e90d57866fa220de92c8dd8b9598b Author: Matthieu Baerts Date: Thu Jun 8 18:38:46 2023 +0200 selftests: mptcp: connect: skip TFO tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of TCP_FASTOPEN socket option with MPTCP connections introduced by commit 4ffb0a02346c ("mptcp: add TCP_FASTOPEN sock option"). It is possible to look for "mptcp_fastopen_" in kallsyms to know if the feature is supported or not. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: ca7ae8916043 ("selftests: mptcp: mptfo Initiator/Listener") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 4ad39a42da2e9770c8e4c37fe632ed8898419129 Author: Matthieu Baerts Date: Thu Jun 8 18:38:45 2023 +0200 selftests: mptcp: connect: skip disconnect tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the full support of disconnections from the userspace introduced by commit b29fcfb54cd7 ("mptcp: full disconnect implementation"). It is possible to look for "mptcp_pm_data_reset" in kallsyms because a preparation patch added it to ease the introduction of the mentioned feature. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 07bf49401909264a38fa3427c3cce43e8304436a Author: Matthieu Baerts Date: Thu Jun 8 18:38:44 2023 +0200 selftests: mptcp: connect: skip transp tests if not supported Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the support of IP(V6)_TRANSPARENT socket option with MPTCP connections introduced by commit c9406a23c116 ("mptcp: sockopt: add SOL_IP freebind & transparent options"). It is possible to look for "__ip_sock_set_tos" in kallsyms because IP(V6)_TRANSPARENT socket option support has been added after TOS support which came with the required infrastructure in MPTCP sockopt code. To support TOS, the following function has been exported (T). Not great but better than checking for a specific kernel version. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 5fb62e9cd3ad ("selftests: mptcp: add tproxy test case") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 673004821ab98c6645bd21af56a290854e88f533 Author: Matthieu Baerts Date: Thu Jun 8 18:38:43 2023 +0200 selftests: mptcp: lib: skip if missing symbol Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. New functions are now available to easily detect if a certain feature is missing by looking at kallsyms. These new helpers are going to be used in the following commits. In order to ease the backport of such future patches, it would be good if this patch is backported up to the introduction of MPTCP selftests, hence the Fixes tag below: this type of check was supposed to be done from the beginning. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit a2a871483161014f1bcc4e9a04354b01aa77cedb Author: Edson Juliano Drosdeck Date: Fri Jun 9 17:10:58 2023 -0300 ALSA: hda/realtek: Add a quirk for Compaq N14JP6 Add a quirk for Compaq N14JP6 to fixup ALC897 headset MIC no sound. Signed-off-by: Edson Juliano Drosdeck Cc: Link: https://lore.kernel.org/r/20230609201058.523499-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai commit 5b47f56b6a0fe5752f0827d26037a809ec0080bc Author: Krzysztof Kozlowski Date: Fri Jun 9 16:11:07 2023 +0200 dt-bindings: i3c: silvaco,i3c-master: fix missing schema restriction Each device schema must end with unevaluatedProperties: false, if it references other common schema. Otherwise it would allow any properties to be listed. Fixes: b8b0446f1f1a ("dt-bindings: i3c: Describe Silvaco master binding") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230609141107.66128-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 39affd1fdf65983904fafc07cf607cff737eaf30 Author: Kunihiko Hayashi Date: Fri Jun 2 11:05:02 2023 +0900 of: overlay: Fix missing of_node_put() in error case of init_overlay_changeset() In init_overlay_changeset(), the variable "node" is from of_get_child_by_name(), and the "node" should be discarded in error case. Fixes: d1651b03c2df ("of: overlay: add overlay symbols to live device tree") Signed-off-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/20230602020502.11693-1-hayashi.kunihiko@socionext.com Signed-off-by: Rob Herring commit 64569520920a3ca5d456ddd9f4f95fc6ea9b8b45 Merge: dbfa18c5d7695 ccc45cb4e7271 Author: Linus Torvalds Date: Fri Jun 9 14:21:20 2023 -0700 Merge tag 'block-6.4-2023-06-09' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Fix an issue with the hardware queue nr_active, causing it to become imbalanced (Tian) - Fix an issue with null_blk not releasing pages if configured as memory backed (Nitesh) - Fix a locking issue in dasd (Jan) * tag 'block-6.4-2023-06-09' of git://git.kernel.dk/linux: s390/dasd: Use correct lock while counting channel queue length null_blk: Fix: memory release when memory_backed=1 blk-mq: fix blk_mq_hw_ctx active request accounting commit dbfa18c5d7695766f24c0c140204e1f8c921fb95 Merge: 7e8c948b3f09b 07496eeab577e Author: Linus Torvalds Date: Fri Jun 9 11:04:08 2023 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio bug fixes from Michael Tsirkin: "A bunch of fixes all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: tools/virtio: use canonical ftrace path vhost_vdpa: support PACKED when setting-getting vring_base vhost: support PACKED when setting-getting vring_base vhost: Fix worker hangs due to missed wake up calls vhost: Fix crash during early vhost_transport_send_pkt calls vhost_net: revert upend_idx only on retriable error vhost_vdpa: tell vqs about the negotiated vdpa/mlx5: Fix hang when cvq commands are triggered during device unregister tools/virtio: Add .gitignore for ringtest tools/virtio: Fix arm64 ringtest compilation error vduse: avoid empty string for dev name vhost: use kzalloc() instead of kmalloc() followed by memset() commit 7e8c948b3f09b19e3883517e10a3d5ffa9899f84 Merge: 0f506c7f7d3d8 409e873ea3c1f Author: Linus Torvalds Date: Fri Jun 9 10:53:58 2023 -0700 Merge tag 'ceph-for-6.4-rc6' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A fix for a potential data corruption in differential backup and snapshot-based mirroring scenarios in RBD and a reference counting fixup to avoid use-after-free in CephFS, all marked for stable" * tag 'ceph-for-6.4-rc6' of https://github.com/ceph/ceph-client: ceph: fix use-after-free bug for inodes when flushing capsnaps rbd: get snapshot context after exclusive lock is ensured to be held rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting commit ccc45cb4e7271c74dbb27776ae8f73d84557f5c6 Author: Jan Höppner Date: Fri Jun 9 17:37:50 2023 +0200 s390/dasd: Use correct lock while counting channel queue length The lock around counting the channel queue length in the BIODASDINFO ioctl was incorrectly changed to the dasd_block->queue_lock with commit 583d6535cb9d ("dasd: remove dead code"). This can lead to endless list iterations and a subsequent crash. The queue_lock is supposed to be used only for queue lists belonging to dasd_block. For dasd_device related queue lists the ccwdev lock must be used. Fix the mentioned issues by correctly using the ccwdev lock instead of the queue lock. Fixes: 583d6535cb9d ("dasd: remove dead code") Cc: stable@vger.kernel.org # v5.0+ Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20230609153750.1258763-2-sth@linux.ibm.com Signed-off-by: Jens Axboe commit 61d8cdb7872c82d8a4d5e5251b0010332c316a67 Author: Jeffrey Hugo Date: Fri Jun 2 15:04:40 2023 -0600 accel/qaic: Fix NULL pointer deref in qaic_destroy_drm_device() If qaic_destroy_drm_device() is called before the device has fully initialized it will cause a NULL pointer dereference as the drm device has not yet been created. Fix this with a NULL check. Fixes: c501ca23a6a3 ("accel/qaic: Add uapi and core driver file") Signed-off-by: Jeffrey Hugo Reviewed-by: Carl Vanderlip Reviewed-by: Pranjal Ramajor Asha Kanojiya Link: https://patchwork.freedesktop.org/patch/msgid/20230602210440.8411-3-quic_jhugo@quicinc.com commit 3e1b9b2d81901b3ceeb5ec1f1b4c41cd1cff53ba Author: Carl Vanderlip Date: Fri Jun 2 15:04:39 2023 -0600 accel/qaic: Free user handle on interrupted mutex After user handle is allocated, if mutex is interrupted, we do not free the user handle and return an error. Kref had been initialized, but not added to users list, so device teardown would also not call free_usr. Fixes: c501ca23a6a3 ("accel/qaic: Add uapi and core driver file") Signed-off-by: Carl Vanderlip Reviewed-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/20230602210440.8411-2-quic_jhugo@quicinc.com commit 0f506c7f7d3d8d68a1a020c3d914390b3ffc30d0 Merge: 87aceaa7f083c 99a670b2069c7 Author: Linus Torvalds Date: Fri Jun 9 09:36:17 2023 -0700 Merge tag 'riscv-for-linus-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A fix to avoid ISA-disallowed privilege mappings that can result from WRITE+EXEC mmap requests from userspace. - A fix for kfence to handle the huge pages. - A fix to avoid converting misaligned VAs to huge pages. - ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE has been selected so kprobe can understand user pointers. * tag 'riscv-for-linus-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: fix kprobe __user string arg print fault issue riscv: Check the virtual alignment before choosing a map size riscv: Fix kfence now that the linear mapping can be backed by PUD/P4D/PGD riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable commit 87aceaa7f083cd4e77e28943bc5535ef34ead498 Merge: 92d22212c090b 03c5c83b70dca Author: Linus Torvalds Date: Fri Jun 9 09:29:51 2023 -0700 Merge tag 's390-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Avoid linker error for randomly generated config file that has CONFIG_BRANCH_PROFILE_NONE enabled and make it similar to riscv, x86 and also to commit 4bf3ec384edf ("s390: disable branch profiling for vdso"). - Currently, if the device is offline and all the channel paths are either configured or varied offline, the associated subchannel gets unregistered. Don't unregister the subchannel, instead unregister offline device. * tag 's390-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/purgatory: disable branch profiling s390/cio: unregister device when the only path is gone commit 2a62b6210ce876c596086ab8fd4c8a0c3d10611a Author: Zhu Yanjun Date: Fri Jun 2 11:54:08 2023 +0800 RDMA/rxe: Fix the use-before-initialization error of resp_pkts In the following: Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 assign_lock_key kernel/locking/lockdep.c:982 [inline] register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295 __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951 lock_acquire kernel/locking/lockdep.c:5691 [inline] lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162 skb_dequeue+0x20/0x180 net/core/skbuff.c:3639 drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline] rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652 rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761 execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473 __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233 rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583 This is a use-before-initialization problem. It happens because rxe_qp_do_cleanup is called during error unwind before the struct has been fully initialized. Move the initialization of the skb earlier. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20230602035408.741534-1-yanjun.zhu@intel.com Reported-by: syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com Signed-off-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe commit 92d22212c090b4afbb7d7e8f91d72988c7586aa6 Merge: 333a396d71ce4 d1f11f41eb746 Author: Linus Torvalds Date: Fri Jun 9 09:17:25 2023 -0700 Merge tag 'gpio-fixes-for-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Two fixes for the GPIO testing module and one commit making Andy a reviewer for the GPIO subsystem: - fix a memory corruption bug in gpio-sim - fix inconsistencies in user-space configuration of gpio-sim - make Andy Shevchenko a reviewer for the GPIO subsystem" * tag 'gpio-fixes-for-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: MAINTAINERS: add Andy Shevchenko as reviewer for the GPIO subsystem gpio: sim: quietly ignore configured lines outside the bank gpio: sim: fix memory corruption when adding named lines and unnamed hogs commit 07496eeab577eef1d4912b3e1b502a2b52002ac3 Author: Ross Zwisler Date: Wed Feb 15 15:33:49 2023 -0700 tools/virtio: use canonical ftrace path The canonical location for the tracefs filesystem is at /sys/kernel/tracing. But, from Documentation/trace/ftrace.rst: Before 4.1, all ftrace tracing control files were within the debugfs file system, which is typically located at /sys/kernel/debug/tracing. For backward compatibility, when mounting the debugfs file system, the tracefs file system will be automatically mounted at: /sys/kernel/debug/tracing A few spots in tools/virtio still refer to this older debugfs path, so let's update them to avoid confusion. Signed-off-by: Ross Zwisler Message-Id: <20230215223350.2658616-6-zwisler@google.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Mukesh Ojha commit beee7fdb5b56a46415a4992d28dd4c2d06eb52df Author: Shannon Nelson Date: Mon Apr 24 15:50:31 2023 -0700 vhost_vdpa: support PACKED when setting-getting vring_base Use the right structs for PACKED or split vqs when setting and getting the vring base. Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") Signed-off-by: Shannon Nelson Message-Id: <20230424225031.18947-4-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 55d8122f5cd62d5aaa225d7167dcd14a44c850b9 Author: Shannon Nelson Date: Mon Apr 24 15:50:30 2023 -0700 vhost: support PACKED when setting-getting vring_base Use the right structs for PACKED or split vqs when setting and getting the vring base. Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") Signed-off-by: Shannon Nelson Message-Id: <20230424225031.18947-3-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 333a396d71ce4083da31ccbf30772bf2da1509b4 Merge: 697fa9b586ef3 5b10ff013e8a5 Author: Linus Torvalds Date: Fri Jun 9 09:02:56 2023 -0700 Merge tag 'pinctrl-v6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fix from Linus Walleij: "A single fix for the Meson driver, nothing else has surfaced so far this cycle" * tag 'pinctrl-v6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: meson-axg: add missing GPIOA_18 gpio group commit 697fa9b586ef3032b5e09b33cbfba9035d1466f1 Merge: 8fc1c596c2ccd b752a385b584d Author: Linus Torvalds Date: Fri Jun 9 08:38:22 2023 -0700 Merge tag 'sound-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Lots of small fixes, and almost all are device-specific. A few of them are the fixes for the old regressions by the fast kctl lookups (introduced around 5.19). Others are ASoC simple-card fixes, selftest compile warning fixes, ASoC AMD quirks, various ASoC codec fixes as well as usual HD-audio quirks" * tag 'sound-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (26 commits) ALSA: hda/realtek: Enable 4 amplifiers instead of 2 on a HP platform ALSA: hda: Fix kctl->id initialization ALSA: gus: Fix kctl->id initialization ALSA: cmipci: Fix kctl->id initialization ALSA: ymfpci: Fix kctl->id initialization ALSA: ice1712,ice1724: fix the kcontrol->id initialization ALSA: hda/realtek: Add quirk for Clevo NS50AU ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41 ALSA: hda/realtek: Add "Intel Reference board" and "NUC 13" SSID in the ALC256 ALSA: hda/realtek: Add Lenovo P3 Tower platform ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 selftests: alsa: pcm-test: Fix compiler warnings about the format ASoC: fsl_sai: Enable BCI bit if SAI works on synchronous mode with BYP asserted ASoC: simple-card-utils: fix PCM constraint error check ASoC: cs35l56: Remove NULL check from cs35l56_sdw_dai_set_stream() ASoC: max98363: limit the number of channel to 1 ASoC: max98363: Removed 32bit support ASoC: mediatek: mt8195: fix use-after-free in driver remove path ASoC: mediatek: mt8188: fix use-after-free in driver remove path ASoC: amd: yc: Add Thinkpad Neo14 to quirks list for acp6x ... commit 8fc1c596c2ccd951b089b6b6d54c58a74a137764 Merge: 33f2b5785a2b6 dea9d8f7643fa Author: Linus Torvalds Date: Fri Jun 9 08:23:01 2023 -0700 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fix from Ted Ts'o: "Fix an ext4 regression which breaks remounting r/w file systems that have the quota feature enabled" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: only check dquot_initialize_needed() when debugging Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled" commit 33f36147be36c5fa0919d32d20d501ca97981d9a Merge: 8d38800a762c8 7f3c782b3914e Author: Wolfram Sang Date: Fri Jun 9 17:14:33 2023 +0200 Merge tag 'at24-fixes-for-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-current at24 fixes for v6.4-rc6 - fix a Kconfig issue (we need to select REGMAP, not only REGMAP_I2C) commit 5cdd5ec176544a3f5b18591577cfab2fcdc13c79 Merge: abd649fdf91ad 9bf2e534313fc Author: Arnd Bergmann Date: Fri Jun 9 14:15:18 2023 +0200 Merge tag 'imx-fixes-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.4, round 2: - Fix SPI CS pinmux for the final production version of imx8mn-beacon board. - Fix GPIOs for USDHC2 CD and WP signals on imx8qm-mek board. - Assign default clock rate for i.MX8 LPUARTs to fix UART failure. * tag 'imx-fixes-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mn-beacon: Fix SPI CS pinmux arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals Link: https://lore.kernel.org/r/20230607141312.GU4199@dragon Signed-off-by: Arnd Bergmann commit 7b3b9ac899b54f53f7c9fc07e1c562f56b2187fa Author: Ilan Peer Date: Thu Jun 8 16:36:07 2023 +0300 wifi: mac80211: Use active_links instead of valid_links in Tx Fix few places on the Tx path where the valid_links were used instead of active links. Signed-off-by: Ilan Peer Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230608163202.e24832691fc8.I9ac10dc246d7798a8d26b1a94933df5668df63fc@changeid Signed-off-by: Johannes Berg commit 34d4e3eb67fed9c19719bedb748e5a8b6ccc97a5 Author: Johannes Berg Date: Thu Jun 8 16:36:04 2023 +0300 wifi: cfg80211: remove links only on AP Since links are only controlled by userspace via cfg80211 in AP mode, also only remove them from the driver in that case. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230608163202.ed65b94916fa.I2458c46888284cc5ce30715fe642bc5fc4340c8f@changeid Signed-off-by: Johannes Berg commit 15846f95ab01b71fdb1cef8df73680aad41edf70 Author: Benjamin Berg Date: Thu Jun 8 16:36:02 2023 +0300 wifi: mac80211: take lock before setting vif links ieee80211_vif_set_links requires the sdata->local->mtx lock to be held. Add the appropriate locking around the calls in both the link add and remove handlers. This causes a warning when e.g. ieee80211_link_release_channel is called via ieee80211_link_stop from ieee80211_vif_update_links. Fixes: 0d8c4a3c8688 ("wifi: mac80211: implement add/del interface link callbacks") Signed-off-by: Benjamin Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230608163202.fa0c6597fdad.I83dd70359f6cda30f86df8418d929c2064cf4995@changeid Signed-off-by: Johannes Berg commit 1ff56684fa8682bdfbbce4e12cf67ab23cb1db05 Author: Benjamin Berg Date: Thu Jun 8 16:36:01 2023 +0300 wifi: cfg80211: fix link del callback to call correct handler The wrapper function was incorrectly calling the add handler instead of the del handler. This had no negative side effect as the default handlers are essentially identical. Fixes: f2a0290b2df2 ("wifi: cfg80211: add optional link add/remove callbacks") Signed-off-by: Benjamin Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230608163202.ebd00e000459.Iaff7dc8d1cdecf77f53ea47a0e5080caa36ea02a@changeid Signed-off-by: Johannes Berg commit 01605ad6c3e8608d7e147c9b75d67eb8a3d27d88 Author: Johannes Berg Date: Thu Jun 8 16:35:59 2023 +0300 wifi: mac80211: fix link activation settings order In the normal MLME code we always call ieee80211_mgd_set_link_qos_params() before ieee80211_link_info_change_notify() and some drivers, notably iwlwifi, rely on that as they don't do anything (but store the data) in their conf_tx. Fix the order here to be the same as in the normal code paths, so this isn't broken. Fixes: 3d9011029227 ("wifi: mac80211: implement link switching") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230608163202.a2a86bba2f80.Iac97e04827966d22161e63bb6e201b4061e9651b@changeid Signed-off-by: Johannes Berg commit 996c3117dae4c02b38a3cb68e5c2aec9d907ec15 Author: Dan Carpenter Date: Fri Jun 9 13:48:44 2023 +0300 wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid() The locking was changed recently so now the caller holds the wiphy_lock() lock. Taking the lock inside the reg_wdev_chan_valid() function will lead to a deadlock. Fixes: f7e60032c661 ("wifi: cfg80211: fix locking in regulatory disconnect") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/40c4114a-6cb4-4abf-b013-300b598aba65@moroto.mountain Signed-off-by: Johannes Berg commit 04c55383fa5689357bcdd2c8036725a55ed632bc Author: Lee Jones Date: Thu Jun 8 08:29:03 2023 +0100 net/sched: cls_u32: Fix reference counter leak leading to overflow In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet Signed-off-by: Lee Jones Reviewed-by: Eric Dumazet Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit be3618d9651002cd5ff190dbfc6cf78f03e34e27 Author: Zhengchao Shao Date: Thu Jun 8 14:27:56 2023 +0800 net/sched: taprio: fix slab-out-of-bounds Read in taprio_dequeue_from_txq As shown in [1], out-of-bounds access occurs in two cases: 1)when the qdisc of the taprio type is used to replace the previously configured taprio, count and offset in tc_to_txq can be set to 0. In this case, the value of *txq in taprio_next_tc_txq() will increases continuously. When the number of accessed queues exceeds the number of queues on the device, out-of-bounds access occurs. 2)When packets are dequeued, taprio can be deleted. In this case, the tc rule of dev is cleared. The count and offset values are also set to 0. In this case, out-of-bounds access is also caused. Now the restriction on the queue number is added. [1] https://groups.google.com/g/syzkaller-bugs/c/_lYOKgkBVMg Fixes: 2f530df76c8c ("net/sched: taprio: give higher priority to higher TCs in software dequeue mode") Reported-by: syzbot+04afcb3d2c840447559a@syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao Tested-by: Pedro Tammela Signed-off-by: David S. Miller commit c0e489372a294044feea650b38f38c888eff57a4 Author: Ratheesh Kannoth Date: Thu Jun 8 10:46:25 2023 +0530 octeontx2-af: Fix promiscuous mode CN10KB silicon introduced a new exact match feature, which is used for DMAC filtering. The state of installed DMAC filters in this exact match table is getting corrupted when promiscuous mode is toggled. Fix this by not touching Exact match related config when promiscuous mode is toggled. Fixes: 2dba9459d2c9 ("octeontx2-af: Wrapper functions for MAC addr add/del/update/reset") Signed-off-by: Ratheesh Kannoth Signed-off-by: David S. Miller commit 0ad4982c520ed87ea7ebfc9381ea1f617ed75364 Author: Yoshihiro Shimoda Date: Thu Jun 8 10:57:27 2023 +0900 net: renesas: rswitch: Fix timestamp feature after all descriptors are used The timestamp descriptors were intended to act cyclically. Descriptors from index 0 through gq->ring_size - 1 contain actual information, and the last index (gq->ring_size) should have LINKFIX to indicate the first index 0 descriptor. However, the LINKFIX value is missing, causing the timestamp feature to stop after all descriptors are used. To resolve this issue, set the LINKFIX to the timestamp descritors. Reported-by: Phong Hoang Fixes: 33f5d733b589 ("net: renesas: rswitch: Improve TX timestamp accuracy") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 6c02568fd1ae53099b4ab86365c5be1ff15f586b Author: Max Tottenham Date: Wed Jun 7 12:23:54 2023 -0400 net/sched: act_pedit: Parse L3 Header for L4 offset Instead of relying on skb->transport_header being set correctly, opt instead to parse the L3 header length out of the L3 headers for both IPv4/IPv6 when the Extended Layer Op for tcp/udp is used. This fixes a bug if GRO is disabled, when GRO is disabled skb->transport_header is set by __netif_receive_skb_core() to point to the L3 header, it's later fixed by the upper protocol layers, but act_pedit will receive the SKB before the fixups are completed. The existing behavior causes the following to edit the L3 header if GRO is disabled instead of the UDP header: tc filter add dev eth0 ingress protocol ip flower ip_proto udp \ dst_ip 192.168.1.3 action pedit ex munge udp set dport 18053 Also re-introduce a rate-limited warning if we were unable to extract the header offset when using the 'ex' interface. Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") Signed-off-by: Max Tottenham Reviewed-by: Josh Hunt Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202305261541.N165u9TZ-lkp@intel.com/ Reviewed-by: Pedro Tammela Signed-off-by: David S. Miller commit 4b0a5014ee2b0984f2410d657dc582a8387585ae Merge: 899e373ef0b0d 9561de3a55bed Author: Mauro Carvalho Chehab Date: Fri Jun 9 09:24:21 2023 +0100 Merge tag 'v6.4-rc5' into v4l_for_linus Linux 6.4-rc5 * tag 'v6.4-rc5': (303 commits) Linux 6.4-rc5 leds: qcom-lpg: Fix PWM period limits selftests/ftrace: Choose target function for filter test from samples KVM: selftests: Add test for race in kvm_recalculate_apic_map() KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds KVM: x86: Account fastpath-only VM-Exits in vCPU stats KVM: SVM: vNMI pending bit is V_NMI_PENDING_MASK not V_NMI_BLOCKING_MASK KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker tpm, tpm_tis: correct tpm_tis_flags enumeration values Revert "ext4: remove ac->ac_found > sbi->s_mb_min_to_scan dead check in ext4_mb_check_limits" riscv: Implement missing huge_ptep_get riscv: Fix huge_ptep_set_wrprotect when PTE is a NAPOT module/decompress: Fix error checking on zstd decompression fork, vhost: Use CLONE_THREAD to fix freezer/ps regression dt-bindings: serial: 8250_omap: add rs485-rts-active-high selinux: don't use make's grouped targets feature yet riscv: perf: Fix callchain parse error with kernel tracepoint events mptcp: fix active subflow finalization mptcp: add annotations around sk->sk_shutdown accesses mptcp: fix data race around msk->first access ... commit dfaed3e1fa7099de8de4e89cbe7eb9c1bca27dfe Author: Nicholas Piggin Date: Wed Jun 7 10:56:00 2023 +1000 powerpc/64s/radix: Fix exit lazy tlb mm switch with irqs enabled Switching mm and tinkering with current->active_mm should be done with irqs disabled. There is a path where exit_lazy_flush_tlb can be called with irqs enabled: exit_lazy_flush_tlb flush_type_needed __flush_all_mm tlb_finish_mmu exit_mmap Which results in the switching being done with irqs enabled, which is incorrect. Fixes: a665eec0a22e ("powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm") Cc: stable@vger.kernel.org # v5.10+ Reported-by: Sachin Sant Link: https://lore.kernel.org/linuxppc-dev/A9A5D83D-BA70-47A4-BCB4-30C1AE19BC22@linux.ibm.com/ Tested-by: Sachin Sant Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230607005601.583293-1-npiggin@gmail.com commit 1166a530a84758bb9e6b448fc8c195ed413f5ded Author: Maciej Żenczykowski Date: Mon Jun 5 04:06:54 2023 -0700 xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets Before Linux v5.8 an AF_INET6 SOCK_DGRAM (udp/udplite) socket with SOL_UDP, UDP_ENCAP, UDP_ENCAP_ESPINUDP{,_NON_IKE} enabled would just unconditionally use xfrm4_udp_encap_rcv(), afterwards such a socket would use the newly added xfrm6_udp_encap_rcv() which only handles IPv6 packets. Cc: Sabrina Dubroca Cc: Steffen Klassert Cc: Jakub Kicinski Cc: Benedict Wong Cc: Yan Yan Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP") Signed-off-by: Maciej Żenczykowski Reviewed-by: Simon Horman Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 863199199713908afaa47ba09332b87621c12496 Author: Wes Huang Date: Thu Jun 8 11:01:42 2023 +0800 net: usb: qmi_wwan: add support for Compal RXM-G1 Add support for Compal RXM-G1 which is based on Qualcomm SDX55 chip. This patch adds support for two compositions: 0x9091: DIAG + MODEM + QMI_RMNET + ADB 0x90db: DIAG + DUN + RMNET + DPL + QDSS(Trace) + ADB T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=05c6 ProdID=9091 Rev= 4.14 S: Manufacturer=QCOM S: Product=SDXPRAIRIE-MTP _SN:719AB680 S: SerialNumber=719ab680 C:* #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=84(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=05c6 ProdID=90db Rev= 4.14 S: Manufacturer=QCOM S: Product=SDXPRAIRIE-MTP _SN:719AB680 S: SerialNumber=719ab680 C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=84(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=8f(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms Cc: stable@vger.kernel.org Signed-off-by: Wes Huang Acked-by: Bjørn Mork Link: https://lore.kernel.org/r/20230608030141.3546-1-wes.huang@moxa.com Signed-off-by: Jakub Kicinski commit 33f2b5785a2b6b0ed1948aafee60d3abb12f1e3a Merge: 9cd6357f100b3 986c34b495810 Author: Linus Torvalds Date: Thu Jun 8 19:14:10 2023 -0700 Merge tag 'drm-fixes-2023-06-09' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Bit busier and a bit more scattered than usual. amdgpu is the main one, with ivpu and msm having a few fixes, then i915, exynos, ast, lima, radeon with some misc bits, but overall nothing standing out. fb-helper: - Fill in fb-helper vars more correctly amdgpu: - S0ix fixes - GPU reset fixes - SMU13 fixes - SMU11 fixes - Misc Display fixes - Revert RV/RV2/PCO clock counter changes - Fix Stoney xclk value - Fix reserved vram debug info radeon: - Fix a potential use after free i915: - CDCLK voltage fix for ADL-P - eDP wake sync pulse fix - Two error handling fixes to selftests exynos: - Fix wrong return in Exynos vidi driver - Fix use-after-free issue to Exynos g2d driver ast: - resume and modeset fixes for ast ivpu: - Assorted ivpu fixes lima: - lima context destroy fix msm: - Fix max segment size to address splat on newer a6xx - Disable PSR by default w/ modparam to re-enable, since there still seems to be a lingering issue - Fix HPD issue - Fix issue with unitialized GMU mutex" * tag 'drm-fixes-2023-06-09' of git://anongit.freedesktop.org/drm/drm: (32 commits) drm/msm/a6xx: initialize GMU mutex earlier drm/msm/dp: enable HDP plugin/unplugged interrupts at hpd_enable/disable accel/ivpu: Fix sporadic VPU boot failure accel/ivpu: Do not use mutex_lock_interruptible accel/ivpu: Do not trigger extra VPU reset if the VPU is idle drm/amd/display: Reduce sdp bw after urgent to 90% drm/amdgpu: change reserved vram info print drm/amdgpu: fix xclk freq on CHIP_STONEY drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl Revert "drm/amdgpu: switch to golden tsc registers for raven/raven2" Revert "drm/amdgpu: Differentiate between Raven2 and Raven/Picasso according to revision id" Revert "drm/amdgpu: change the reference clock for raven/raven2" drm/amd/display: add ODM case when looking for first split pipe drm/amd: Make lack of `ACPI_FADT_LOW_POWER_S0` or `CONFIG_AMD_PMC` louder during suspend path drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs drm/amd/pm: Fix power context allocation in SMU13 drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram drm/amd: Disallow s0ix without BIOS support again drm/i915/selftests: Add some missing error propagation drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl ... commit 6292d7436cf2f0a2ea8800a1d2cbb155d237818a Author: Yuezhen Luan Date: Wed Jun 7 09:41:16 2023 -0700 igb: Fix extts capture value format for 82580/i354/i350 82580/i354/i350 features circle-counter-like timestamp registers that are different with newer i210. The EXTTS capture value in AUXTSMPx should be converted from raw circle counter value to timestamp value in resolution of 1 nanosec by the driver. This issue can be reproduced on i350 nics, connecting an 1PPS signal to a SDP pin, and run 'ts2phc' command to read external 1PPS timestamp value. On i210 this works fine, but on i350 the extts is not correctly converted. The i350/i354/82580's SYSTIM and other timestamp registers are 40bit counters, presenting time range of 2^40 ns, that means these registers overflows every about 1099s. This causes all these regs can't be used directly in contrast to the newer i210/i211s. The igb driver needs to convert these raw register values to valid time stamp format by using kernel timecounter apis for i350s families. Here the igb_extts() just forgot to do the convert. Fixes: 38970eac41db ("igb: support EXTTS on 82580/i354/i350") Signed-off-by: Yuezhen Luan Reviewed-by: Jacob Keller Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230607164116.3768175-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 91ffd1bae1dafbb9e34b46813f5b058581d9144d Author: Guillaume Nault Date: Wed Jun 7 18:05:02 2023 +0200 ping6: Fix send to link-local addresses with VRF. Ping sockets can't send packets when they're bound to a VRF master device and the output interface is set to a slave device. For example, when net.ipv4.ping_group_range is properly set, so that ping6 can use ping sockets, the following kind of commands fails: $ ip vrf exec red ping6 fe80::854:e7ff:fe88:4bf1%eth1 What happens is that sk->sk_bound_dev_if is set to the VRF master device, but 'oif' is set to the real output device. Since both are set but different, ping_v6_sendmsg() sees their value as inconsistent and fails. Fix this by allowing 'oif' to be a slave device of ->sk_bound_dev_if. This fixes the following kselftest failure: $ ./fcnal-test.sh -t ipv6_ping [...] TEST: ping out, vrf device+address bind - ns-B IPv6 LLA [FAIL] Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/b6191f90-ffca-dbca-7d06-88a9788def9c@alu.unizg.hr/ Tested-by: Mirsad Todorovac Fixes: 5e457896986e ("net: ipv6: Fix ping to link-local addresses.") Signed-off-by: Guillaume Nault Reviewed-by: David Ahern Link: https://lore.kernel.org/r/6c8b53108816a8d0d5705ae37bdc5a8322b5e3d9.1686153846.git.gnault@redhat.com Signed-off-by: Jakub Kicinski commit 9cd6357f100b3eb0f5027b1ff1a5eebb9f785145 Merge: 8d15d5e1851b1 5647e53f7856b Author: Linus Torvalds Date: Thu Jun 8 18:52:54 2023 -0700 Merge tag 'cgroup-for-6.4-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Fix css_set reference leaks on fork failures - Fix CPU hotplug locking in cgroup_transfer_tasks() which is used by cgroup1 cpuset - Doc update * tag 'cgroup-for-6.4-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Documentation: Clarify usage of memory limits cgroup: always put cset in cgroup_css_set_put_fork cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks() commit 986c34b495810b38f365bb71665b77de60f15b2c Merge: bcd84301a33b7 12abd735f0300 Author: Dave Airlie Date: Fri Jun 9 11:20:22 2023 +1000 Merge tag 'drm-msm-fixes-2023-06-08' of https://gitlab.freedesktop.org/drm/msm into drm-fixes A few more late fixes for v6.4-rc6 + Fix max segment size to address splat on newer a6xx + Disable PSR by default w/ modparam to re-enable, since there still seems to be a lingering issue + Fix HPD issue + Fix issue with unitialized GMU mutex Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGufjVZRNT6YfQ7YUXFC7Cz95wdLF7QHAYkiGfp+3Xc3DQ@mail.gmail.com commit 12abd735f0300600bfc01b2a3832b966312df205 Author: Dmitry Baryshkov Date: Mon Apr 10 19:59:08 2023 +0300 drm/msm/a6xx: initialize GMU mutex earlier Move GMU mutex initialization earlier to make sure that it is always initialized. a6xx_destroy can be called from ther failure path before GMU initialization. This fixes the following backtrace: ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 0 PID: 58 at kernel/locking/mutex.c:582 __mutex_lock+0x1ec/0x3d0 Modules linked in: CPU: 0 PID: 58 Comm: kworker/u16:1 Not tainted 6.3.0-rc5-00155-g187c06436519 #565 Hardware name: Qualcomm Technologies, Inc. SM8350 HDK (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock+0x1ec/0x3d0 lr : __mutex_lock+0x1ec/0x3d0 sp : ffff800008993620 x29: ffff800008993620 x28: 0000000000000002 x27: ffff47b253c52800 x26: 0000000001000606 x25: ffff47b240bb2810 x24: fffffffffffffff4 x23: 0000000000000000 x22: ffffc38bba15ac14 x21: 0000000000000002 x20: ffff800008993690 x19: ffff47b2430cc668 x18: fffffffffffe98f0 x17: 6f74616c75676572 x16: 20796d6d75642067 x15: 0000000000000038 x14: 0000000000000000 x13: ffffc38bbba050b8 x12: 0000000000000666 x11: 0000000000000222 x10: ffffc38bbba603e8 x9 : ffffc38bbba050b8 x8 : 00000000ffffefff x7 : ffffc38bbba5d0b8 x6 : 0000000000000222 x5 : 000000000000bff4 x4 : 40000000fffff222 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff47b240cb1880 Call trace: __mutex_lock+0x1ec/0x3d0 mutex_lock_nested+0x2c/0x38 a6xx_destroy+0xa0/0x138 a6xx_gpu_init+0x41c/0x618 adreno_bind+0x188/0x290 component_bind_all+0x118/0x248 msm_drm_bind+0x1c0/0x670 try_to_bring_up_aggregate_device+0x164/0x1d0 __component_add+0xa8/0x16c component_add+0x14/0x20 dsi_dev_attach+0x20/0x2c dsi_host_attach+0x9c/0x144 devm_mipi_dsi_attach+0x34/0xac lt9611uxc_attach_dsi.isra.0+0x84/0xfc lt9611uxc_probe+0x5b8/0x67c i2c_device_probe+0x1ac/0x358 really_probe+0x148/0x2ac __driver_probe_device+0x78/0xe0 driver_probe_device+0x3c/0x160 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x84/0xe0 __device_attach+0x9c/0x188 device_initial_probe+0x14/0x20 bus_probe_device+0xac/0xb0 deferred_probe_work_func+0x8c/0xc8 process_one_work+0x2bc/0x594 worker_thread+0x228/0x438 kthread+0x108/0x10c ret_from_fork+0x10/0x20 irq event stamp: 299345 hardirqs last enabled at (299345): [] put_cpu_partial+0x1c8/0x22c hardirqs last disabled at (299344): [] put_cpu_partial+0x1c0/0x22c softirqs last enabled at (296752): [] _stext+0x434/0x4e8 softirqs last disabled at (296741): [] ____do_softirq+0x10/0x1c ---[ end trace 0000000000000000 ]--- Fixes: 4cd15a3e8b36 ("drm/msm/a6xx: Make GPU destroy a bit safer") Cc: Douglas Anderson Signed-off-by: Dmitry Baryshkov Reviewed-by: Douglas Anderson Patchwork: https://patchwork.freedesktop.org/patch/531540/ Signed-off-by: Rob Clark commit a8e981ac2d0eb9dd53a4c173e29ca0c99c88abe2 Author: Kuogee Hsieh Date: Tue May 23 14:52:36 2023 -0700 drm/msm/dp: enable HDP plugin/unplugged interrupts at hpd_enable/disable The internal_hpd flag is set to true by dp_bridge_hpd_enable() and set to false by dp_bridge_hpd_disable() to handle GPIO pinmuxed into DP controller case. HDP related interrupts can not be enabled until internal_hpd is set to true. At current implementation dp_display_config_hpd() will initialize DP host controller first followed by enabling HDP related interrupts if internal_hpd was true at that time. Enable HDP related interrupts depends on internal_hpd status may leave system with DP driver host is in running state but without HDP related interrupts being enabled. This will prevent external display from being detected. Eliminated this dependency by moving HDP related interrupts enable/disable be done at dp_bridge_hpd_enable/disable() directly regardless of internal_hpd status. Changes in V3: -- dp_catalog_ctrl_hpd_enable() and dp_catalog_ctrl_hpd_disable() -- rewording ocmmit text Changes in V4: -- replace dp_display_config_hpd() with dp_display_host_start() -- move enable_irq() at dp_display_host_start(); Changes in V5: -- replace dp_display_host_start() with dp_display_host_init() Changes in V6: -- squash remove enable_irq() and disable_irq() Fixes: cd198caddea7 ("drm/msm/dp: Rely on hpd_enable/disable callbacks") Signed-off-by: Kuogee Hsieh Tested-by: Leonard Lausen # on sc7180 lazor Reviewed-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Tested-by: Bjorn Andersson Reviewed-by: Abhinav Kumar Link: https://lore.kernel.org/r/1684878756-17830-1-git-send-email-quic_khsieh@quicinc.com Signed-off-by: Rob Clark commit bcd84301a33b7434a506fdb1a9076b7a234817a7 Merge: 02b8f0b75518b a3efabee5878b Author: Dave Airlie Date: Fri Jun 9 11:10:09 2023 +1000 Merge tag 'drm-misc-fixes-2023-06-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v6.4-rc6: - resume and modeset fixes for ast. - Fill in fb-helper vars more correctly. - Assorted ivpu fixes. - lima context destroy fix. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/ea6b88ec-b653-3781-0b68-cd0275c27923@linux.intel.com commit 02b8f0b75518b9a20a9142eec31588509c8da030 Merge: d6d4f0a118931 48bfd02569f5d Author: Dave Airlie Date: Fri Jun 9 11:02:04 2023 +1000 Merge tag 'exynos-drm-fixes-for-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Two fixups - Fix wrong return in Exynos vidi driver. - Fix use-after-free issue to Exynos g2d driver. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/20230607043148.43303-1-inki.dae@samsung.com commit d6d4f0a1189313310d77f1d5a2bb6277f3afa13f Merge: b1913ff4d86b8 79d0150d2d983 Author: Dave Airlie Date: Fri Jun 9 10:57:26 2023 +1000 Merge tag 'drm-intel-fixes-2023-06-08' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes CDCLK voltage fix for ADL-P and eDP wake sync pulse fix. Two error handling fixes to selftests (to appease static checkers) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZIGUHBz7+LsqN2nm@jlahtine-mobl.ger.corp.intel.com commit b1913ff4d86b811758a788a3301032731ce41db4 Merge: 9561de3a55bed e1a600208286c Author: Dave Airlie Date: Fri Jun 9 09:19:56 2023 +1000 Merge tag 'amd-drm-fixes-6.4-2023-06-07' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.4-2023-06-07: amdgpu: - S0ix fixes - GPU reset fixes - SMU13 fixes - SMU11 fixes - Misc Display fixes - Revert RV/RV2/PCO clock counter changes - Fix Stoney xclk value - Fix reserved vram debug info radeon: - Fix a potential use after free Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230607213740.7723-1-alexander.deucher@amd.com commit 8d15d5e1851b1bbb9cd3289b84c7f32399e06ac5 Merge: 25041a4c02c7c 0e2aba694866b Author: Linus Torvalds Date: Thu Jun 8 13:54:26 2023 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Two tiny arm64 fixes for -rc6. One fixes a build breakage when MAX_ORDER can be nonsensical if CONFIG_EXPERT=y and the other fixes the address masking for perf's page fault software events so that it is consistent amongst them: - Fix build breakage due to bogus MAX_ORDER definitions on !4k pages - Avoid masking fault address for perf software events" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mm: pass original fault address to handle_mm_fault() in PER_VMA_LOCK block arm64: Remove the ARCH_FORCE_MAX_ORDER config input prompt commit 21225873be1472b7c59ed3650396af0e40578112 Author: Wei Fang Date: Wed Jun 7 17:10:48 2023 +0800 net: enetc: correct the indexes of highest and 2nd highest TCs For ENETC hardware, the TCs are numbered from 0 to N-1, where N is the number of TCs. Numerically higher TC has higher priority. It's obvious that the highest priority TC index should be N-1 and the 2nd highest priority TC index should be N-2. However, the previous logic uses netdev_get_prio_tc_map() to get the indexes of highest priority and 2nd highest priority TCs, it does not make sense and is incorrect to give a "tc" argument to netdev_get_prio_tc_map(). So the driver may get the wrong indexes of the two highest priotiry TCs which would lead to failed to set the CBS for the two highest priotiry TCs. e.g. $ tc qdisc add dev eno0 parent root handle 100: mqprio num_tc 6 \ map 0 0 1 1 2 3 4 5 queues 1@0 1@1 1@2 1@3 2@4 2@6 hw 1 $ tc qdisc replace dev eno0 parent 100:6 cbs idleslope 100000 \ sendslope -900000 hicredit 12 locredit -113 offload 1 $ Error: Specified device failed to setup cbs hardware offload. ^^^^^ In this example, the previous logic deems the indexes of the two highest priotiry TCs should be 3 and 2. Actually, the indexes are 5 and 4, because the number of TCs is 6. So it would be failed to configure the CBS for the two highest priority TCs. Fixes: c431047c4efe ("enetc: add support Credit Based Shaper(CBS) for hardware offload") Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Reviewed-by: Maciej Fijalkowski Signed-off-by: David S. Miller commit 1240eb93f0616b21c675416516ff3d74798fdc97 Author: Pablo Neira Ayuso Date: Thu Jun 8 02:32:02 2023 +0200 netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE In case of error when adding a new rule that refers to an anonymous set, deactivate expressions via NFT_TRANS_PREPARE state, not NFT_TRANS_RELEASE. Thus, the lookup expression marks anonymous sets as inactive in the next generation to ensure it is not reachable in this transaction anymore and decrement the set refcount as introduced by c1592a89942e ("netfilter: nf_tables: deactivate anonymous set from preparation phase"). The abort step takes care of undoing the anonymous set. This is also consistent with rule deletion, where NFT_TRANS_PREPARE is used. Note that this error path is exercised in the preparation step of the commit protocol. This patch replaces nf_tables_rule_release() by the deactivate and destroy calls, this time with NFT_TRANS_PREPARE. Due to this incorrect error handling, it is possible to access a dangling pointer to the anonymous set that remains in the transaction list. [1009.379054] BUG: KASAN: use-after-free in nft_set_lookup_global+0x147/0x1a0 [nf_tables] [1009.379106] Read of size 8 at addr ffff88816c4c8020 by task nft-rule-add/137110 [1009.379116] CPU: 7 PID: 137110 Comm: nft-rule-add Not tainted 6.4.0-rc4+ #256 [1009.379128] Call Trace: [1009.379132] [1009.379135] dump_stack_lvl+0x33/0x50 [1009.379146] ? nft_set_lookup_global+0x147/0x1a0 [nf_tables] [1009.379191] print_address_description.constprop.0+0x27/0x300 [1009.379201] kasan_report+0x107/0x120 [1009.379210] ? nft_set_lookup_global+0x147/0x1a0 [nf_tables] [1009.379255] nft_set_lookup_global+0x147/0x1a0 [nf_tables] [1009.379302] nft_lookup_init+0xa5/0x270 [nf_tables] [1009.379350] nf_tables_newrule+0x698/0xe50 [nf_tables] [1009.379397] ? nf_tables_rule_release+0xe0/0xe0 [nf_tables] [1009.379441] ? kasan_unpoison+0x23/0x50 [1009.379450] nfnetlink_rcv_batch+0x97c/0xd90 [nfnetlink] [1009.379470] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink] [1009.379485] ? __alloc_skb+0xb8/0x1e0 [1009.379493] ? __alloc_skb+0xb8/0x1e0 [1009.379502] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [1009.379509] ? unwind_get_return_address+0x2a/0x40 [1009.379517] ? write_profile+0xc0/0xc0 [1009.379524] ? avc_lookup+0x8f/0xc0 [1009.379532] ? __rcu_read_unlock+0x43/0x60 Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Pablo Neira Ayuso commit 4b13cbef797048fbb525f8c635a5279e9d209d93 Author: Mike Christie Date: Wed Jun 7 14:23:38 2023 -0500 vhost: Fix worker hangs due to missed wake up calls We can race where we have added work to the work_list, but vhost_task_fn has passed that check but not yet set us into TASK_INTERRUPTIBLE. wake_up_process will see us in TASK_RUNNING and just return. This bug was intoduced in commit f9010dbdce91 ("fork, vhost: Use CLONE_THREAD to fix freezer/ps regression") when I moved the setting of TASK_INTERRUPTIBLE to simplfy the code and avoid get_signal from logging warnings about being in the wrong state. This moves the setting of TASK_INTERRUPTIBLE back to before we test if we need to stop the task to avoid a possible race there as well. We then have vhost_worker set TASK_RUNNING if it finds work similar to before. Fixes: f9010dbdce91 ("fork, vhost: Use CLONE_THREAD to fix freezer/ps regression") Signed-off-by: Mike Christie Message-Id: <20230607192338.6041-3-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit a284f09effea1908db7985dbfb5458c9100038d8 Author: Mike Christie Date: Wed Jun 7 14:23:37 2023 -0500 vhost: Fix crash during early vhost_transport_send_pkt calls If userspace does VHOST_VSOCK_SET_GUEST_CID before VHOST_SET_OWNER we can race where: 1. thread0 calls vhost_transport_send_pkt -> vhost_work_queue 2. thread1 does VHOST_SET_OWNER which calls vhost_worker_create. 3. vhost_worker_create will set the dev->worker pointer before setting the worker->vtsk pointer. 4. thread0's vhost_work_queue will see the dev->worker pointer is set and try to call vhost_task_wake using not yet set worker->vtsk pointer. 5. We then crash since vtsk is NULL. Before commit 6e890c5d5021 ("vhost: use vhost_tasks for worker threads"), we only had the worker pointer so we could just check it to see if VHOST_SET_OWNER has been done. After that commit we have the vhost_worker and vhost_task pointer, so we can now hit the bug above. This patch embeds the vhost_worker in the vhost_dev and moves the work list initialization back to vhost_dev_init, so we can just check the worker.vtsk pointer to check if VHOST_SET_OWNER has been done like before. Fixes: 6e890c5d5021 ("vhost: use vhost_tasks for worker threads") Signed-off-by: Mike Christie Message-Id: <20230607192338.6041-2-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin Reported-by: syzbot+d0d442c22fa8db45ff0e@syzkaller.appspotmail.com Reviewed-by: Stefano Garzarella commit 1f5d2e3bab16369d5d4b4020a25db4ab1f4f082c Author: Andrey Smetanin Date: Mon Apr 24 23:44:11 2023 +0300 vhost_net: revert upend_idx only on retriable error Fix possible virtqueue used buffers leak and corresponding stuck in case of temporary -EIO from sendmsg() which is produced by tun driver while backend device is not up. In case of no-retriable error and zcopy do not revert upend_idx to pass packet data (that is update used_idx in corresponding vhost_zerocopy_signal_used()) as if packet data has been transferred successfully. v2: set vq->heads[ubuf->desc].len equal to VHOST_DMA_DONE_LEN in case of fake successful transmit. Signed-off-by: Andrey Smetanin Message-Id: <20230424204411.24888-1-asmetanin@yandex-team.ru> Signed-off-by: Michael S. Tsirkin Signed-off-by: Andrey Smetanin Acked-by: Jason Wang commit 376daf317753ccb6b1ecbdece66018f7f6313a7f Author: Shannon Nelson Date: Mon Apr 24 15:50:29 2023 -0700 vhost_vdpa: tell vqs about the negotiated As is done in the net, iscsi, and vsock vhost support, let the vdpa vqs know about the features that have been negotiated. This allows vhost to more safely make decisions based on the features, such as when using PACKED vs split queues. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230424225031.18947-2-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit 73790bdfba076c0886f0f14fd46ff2c70ee31ce9 Author: Dragos Tatulea Date: Tue May 16 12:58:01 2023 +0300 vdpa/mlx5: Fix hang when cvq commands are triggered during device unregister Currently the vdpa device is unregistered after the workqueue that processes vq commands is disabled. However, the device unregister process can still send commands to the cvq (a vlan delete for example) which leads to a hang because the handing workqueue has been disabled and the command never finishes: [ 2263.095764] rcu: INFO: rcu_sched self-detected stall on CPU [ 2263.096307] rcu: 9-....: (5250 ticks this GP) idle=dac4/1/0x4000000000000000 softirq=111009/111009 fqs=2544 [ 2263.097154] rcu: (t=5251 jiffies g=393549 q=347 ncpus=10) [ 2263.097648] CPU: 9 PID: 94300 Comm: kworker/u20:2 Not tainted 6.3.0-rc6_for_upstream_min_debug_2023_04_14_00_02 #1 [ 2263.098535] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 2263.099481] Workqueue: mlx5_events mlx5_vhca_state_work_handler [mlx5_core] [ 2263.100143] RIP: 0010:virtnet_send_command+0x109/0x170 [ 2263.100621] Code: 1d df f5 ff 85 c0 78 5c 48 8b 7b 08 e8 d0 c5 f5 ff 84 c0 75 11 eb 22 48 8b 7b 08 e8 01 b7 f5 ff 84 c0 75 15 f3 90 48 8b 7b 08 <48> 8d 74 24 04 e8 8d c5 f5 ff 48 85 c0 74 de 48 8b 83 f8 00 00 00 [ 2263.102148] RSP: 0018:ffff888139cf36e8 EFLAGS: 00000246 [ 2263.102624] RAX: 0000000000000000 RBX: ffff888166bea940 RCX: 0000000000000001 [ 2263.103244] RDX: 0000000000000000 RSI: ffff888139cf36ec RDI: ffff888146763800 [ 2263.103864] RBP: ffff888139cf3710 R08: ffff88810d201000 R09: 0000000000000000 [ 2263.104473] R10: 0000000000000002 R11: 0000000000000003 R12: 0000000000000002 [ 2263.105082] R13: 0000000000000002 R14: ffff888114528400 R15: ffff888166bea000 [ 2263.105689] FS: 0000000000000000(0000) GS:ffff88852cc80000(0000) knlGS:0000000000000000 [ 2263.106404] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2263.106925] CR2: 00007f31f394b000 CR3: 000000010615b006 CR4: 0000000000370ea0 [ 2263.107542] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2263.108163] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2263.108769] Call Trace: [ 2263.109059] [ 2263.109320] ? check_preempt_wakeup+0x11f/0x230 [ 2263.109750] virtnet_vlan_rx_kill_vid+0x5a/0xa0 [ 2263.110180] vlan_vid_del+0x9c/0x170 [ 2263.110546] vlan_device_event+0x351/0x760 [8021q] [ 2263.111004] raw_notifier_call_chain+0x41/0x60 [ 2263.111426] dev_close_many+0xcb/0x120 [ 2263.111808] unregister_netdevice_many_notify+0x130/0x770 [ 2263.112297] ? wq_worker_running+0xa/0x30 [ 2263.112688] unregister_netdevice_queue+0x89/0xc0 [ 2263.113128] unregister_netdev+0x18/0x20 [ 2263.113512] virtnet_remove+0x4f/0x230 [ 2263.113885] virtio_dev_remove+0x31/0x70 [ 2263.114273] device_release_driver_internal+0x18f/0x1f0 [ 2263.114746] bus_remove_device+0xc6/0x130 [ 2263.115146] device_del+0x173/0x3c0 [ 2263.115502] ? kernfs_find_ns+0x35/0xd0 [ 2263.115895] device_unregister+0x1a/0x60 [ 2263.116279] unregister_virtio_device+0x11/0x20 [ 2263.116706] device_release_driver_internal+0x18f/0x1f0 [ 2263.117182] bus_remove_device+0xc6/0x130 [ 2263.117576] device_del+0x173/0x3c0 [ 2263.117929] ? vdpa_dev_remove+0x20/0x20 [vdpa] [ 2263.118364] device_unregister+0x1a/0x60 [ 2263.118752] mlx5_vdpa_dev_del+0x4c/0x80 [mlx5_vdpa] [ 2263.119232] vdpa_match_remove+0x21/0x30 [vdpa] [ 2263.119663] bus_for_each_dev+0x71/0xc0 [ 2263.120054] vdpa_mgmtdev_unregister+0x57/0x70 [vdpa] [ 2263.120520] mlx5v_remove+0x12/0x20 [mlx5_vdpa] [ 2263.120953] auxiliary_bus_remove+0x18/0x30 [ 2263.121356] device_release_driver_internal+0x18f/0x1f0 [ 2263.121830] bus_remove_device+0xc6/0x130 [ 2263.122223] device_del+0x173/0x3c0 [ 2263.122581] ? devl_param_driverinit_value_get+0x29/0x90 [ 2263.123070] mlx5_rescan_drivers_locked+0xc4/0x2d0 [mlx5_core] [ 2263.123633] mlx5_unregister_device+0x54/0x80 [mlx5_core] [ 2263.124169] mlx5_uninit_one+0x54/0x150 [mlx5_core] [ 2263.124656] mlx5_sf_dev_remove+0x45/0x90 [mlx5_core] [ 2263.125153] auxiliary_bus_remove+0x18/0x30 [ 2263.125560] device_release_driver_internal+0x18f/0x1f0 [ 2263.126052] bus_remove_device+0xc6/0x130 [ 2263.126451] device_del+0x173/0x3c0 [ 2263.126815] mlx5_sf_dev_remove+0x39/0xf0 [mlx5_core] [ 2263.127318] mlx5_sf_dev_state_change_handler+0x178/0x270 [mlx5_core] [ 2263.127920] blocking_notifier_call_chain+0x5a/0x80 [ 2263.128379] mlx5_vhca_state_work_handler+0x151/0x200 [mlx5_core] [ 2263.128951] process_one_work+0x1bb/0x3c0 [ 2263.129355] ? process_one_work+0x3c0/0x3c0 [ 2263.129766] worker_thread+0x4d/0x3c0 [ 2263.130140] ? process_one_work+0x3c0/0x3c0 [ 2263.130548] kthread+0xb9/0xe0 [ 2263.130895] ? kthread_complete_and_exit+0x20/0x20 [ 2263.131349] ret_from_fork+0x1f/0x30 [ 2263.131717] The fix is to disable and destroy the workqueue after the device unregister. It is expected that vhost will not trigger kicks after the unregister. But even if it would, the wq is disabled already by setting the pointer to NULL (done so in the referenced commit). Fixes: ad6dc1daaf29 ("vdpa/mlx5: Avoid processing works if workqueue was destroyed") Signed-off-by: Dragos Tatulea Message-Id: <20230516095800.3549932-1-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Tariq Toukan Acked-by: Jason Wang commit c66dbc39a7104c5a9f033c0450dfa6f697a71f94 Author: Rong Tao Date: Thu May 25 16:37:28 2023 +0800 tools/virtio: Add .gitignore for ringtest Ignore executables for ringtest. Signed-off-by: Rong Tao Message-Id: Signed-off-by: Michael S. Tsirkin commit 57380fd1249b20ef772549af2c58ef57b21faba7 Author: Rong Tao Date: Wed May 24 20:31:24 2023 +0800 tools/virtio: Fix arm64 ringtest compilation error Add cpu_relax() for arm64 instead of directly assert(), and add assert.h header file. Also, add smp_wmb and smp_mb for arm64. Compilation error as follows, avoid __always_inline undefined. $ make cc -Wall -pthread -O2 -ggdb -flto -fwhole-program -c -o ring.o ring.c In file included from ring.c:10: main.h: In function ‘busy_wait’: main.h:99:21: warning: implicit declaration of function ‘assert’ [-Wimplicit-function-declaration] 99 | #define cpu_relax() assert(0) | ^~~~~~ main.h:107:17: note: in expansion of macro ‘cpu_relax’ 107 | cpu_relax(); | ^~~~~~~~~ main.h:12:1: note: ‘assert’ is defined in header ‘’; did you forget to ‘#include ’? 11 | #include +++ |+#include 12 | main.h: At top level: main.h:143:23: error: expected ‘;’ before ‘void’ 143 | static __always_inline | ^ | ; 144 | void __read_once_size(const volatile void *p, void *res, int size) | ~~~~ main.h:158:23: error: expected ‘;’ before ‘void’ 158 | static __always_inline void __write_once_size(volatile void *p, void *res, int size) | ^~~~~ | ; make: *** [: ring.o] Error 1 Signed-off-by: Rong Tao Message-Id: Signed-off-by: Michael S. Tsirkin commit a90e8608eb0ed93d31ac0feb055f77ce59512542 Author: Sheng Zhao Date: Tue May 30 11:36:26 2023 +0800 vduse: avoid empty string for dev name Syzkaller hits a kernel WARN when the first character of the dev name provided is NULL. Solution is to add a NULL check before calling cdev_device_add() in vduse_create_dev(). kobject: (0000000072042169): attempted to be registered with empty name! WARNING: CPU: 0 PID: 112695 at lib/kobject.c:236 Call Trace: kobject_add_varg linux/src/lib/kobject.c:390 [inline] kobject_add+0xf6/0x150 linux/src/lib/kobject.c:442 device_add+0x28f/0xc20 linux/src/drivers/base/core.c:2167 cdev_device_add+0x83/0xc0 linux/src/fs/char_dev.c:546 vduse_create_dev linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2254 [inline] vduse_ioctl+0x7b5/0xf30 linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2316 vfs_ioctl linux/src/fs/ioctl.c:47 [inline] file_ioctl linux/src/fs/ioctl.c:510 [inline] do_vfs_ioctl+0x14b/0xa80 linux/src/fs/ioctl.c:697 ksys_ioctl+0x7c/0xa0 linux/src/fs/ioctl.c:714 __do_sys_ioctl linux/src/fs/ioctl.c:721 [inline] __se_sys_ioctl linux/src/fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x42/0x50 linux/src/fs/ioctl.c:719 do_syscall_64+0x94/0x330 linux/src/arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") Cc: "Xie Yongji" Reported-by: Xianjun Zeng Signed-off-by: Sheng Zhao Message-Id: <20230530033626.1266794-1-sheng.zhao@bytedance.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Xie Yongji Cc: "Michael S. Tsirkin", "Jason Wang", Reviewed-by: Xie Yongji commit 8d38800a762c880244f3df87abbc9f34e276e955 Author: Biju Das Date: Wed Jun 7 18:07:29 2023 +0100 MAINTAINERS: Add entries for Renesas RZ/V2M I2C driver Add the MAINTAINERS entries for the Renesas RZ/V2M I2C driver. Signed-off-by: Biju Das Acked-by: Fabrizio Castro Signed-off-by: Wolfram Sang commit 78c50d6961fc05491ebbc71c35d87324b1a4f49a Author: Kamil Maziarz Date: Tue Jun 6 12:33:58 2023 +0200 ice: Fix XDP memory leak when NIC is brought up and down Fix the buffer leak that occurs while switching the port up and down with traffic and XDP by checking for an active XDP program and freeing all empty TX buffers. Fixes: efc2214b6047 ("ice: Add support for XDP") Signed-off-by: Kamil Maziarz Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Acked-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen commit 99a670b2069c725a7b50318aa681d9cae8f89325 Author: Ruan Jinjie Date: Thu May 4 15:29:10 2023 +0800 riscv: fix kprobe __user string arg print fault issue On riscv qemu platform, when add kprobe event on do_sys_open() to show filename string arg, it just print fault as follow: echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3 mode=$arg4' > kprobe_events bash-166 [000] ...1. 360.195367: myprobe: (do_sys_open+0x0/0x84) dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6 bash-166 [000] ...1. 360.219369: myprobe: (do_sys_open+0x0/0x84) dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6 bash-191 [000] ...1. 360.378827: myprobe: (do_sys_open+0x0/0x84) dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0 As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, the +0($arg2) addr is processed as a kernel address though it is a userspace address, cause the above filename=(fault) print. So select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the kprobe trace is ok as below: bash-166 [000] ...1. 96.767641: myprobe: (do_sys_open+0x0/0x84) dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6 bash-166 [000] ...1. 96.793751: myprobe: (do_sys_open+0x0/0x84) dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6 bash-177 [000] ...1. 96.962354: myprobe: (do_sys_open+0x0/0x84) dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/" flags=0x98800 mode=0x0 Signed-off-by: Ruan Jinjie Acked-by: Björn Töpel Fixes: 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}() only to archs where they work") Link: https://lore.kernel.org/r/20230504072910.3742842-1-ruanjinjie@huawei.com Signed-off-by: Palmer Dabbelt commit 25041a4c02c7cf774d8b6ed60586fd64f1cdaa81 Merge: 79b6fad54683c 6c0ec7ab5aaff Author: Linus Torvalds Date: Thu Jun 8 09:27:19 2023 -0700 Merge tag 'net-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from can, wifi, netfilter, bluetooth and ebpf. Current release - regressions: - bpf: sockmap: avoid potential NULL dereference in sk_psock_verdict_data_ready() - wifi: iwlwifi: fix -Warray-bounds bug in iwl_mvm_wait_d3_notif() - phylink: actually fix ksettings_set() ethtool call - eth: dwmac-qcom-ethqos: fix a regression on EMAC < 3 Current release - new code bugs: - wifi: mt76: fix possible NULL pointer dereference in mt7996_mac_write_txwi() Previous releases - regressions: - netfilter: fix NULL pointer dereference in nf_confirm_cthelper - wifi: rtw88/rtw89: correct PS calculation for SUPPORTS_DYNAMIC_PS - openvswitch: fix upcall counter access before allocation - bluetooth: - fix use-after-free in hci_remove_ltk/hci_remove_irk - fix l2cap_disconnect_req deadlock - nic: bnxt_en: prevent kernel panic when receiving unexpected PHC_UPDATE event Previous releases - always broken: - core: annotate rfs lockless accesses - sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values - netfilter: add null check for nla_nest_start_noflag() in nft_dump_basechain_hook() - bpf: fix UAF in task local storage - ipv4: ping_group_range: allow GID from 2147483648 to 4294967294 - ipv6: rpl: fix route of death. - tcp: gso: really support BIG TCP - mptcp: fixes for user-space PM address advertisement - smc: avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT - can: avoid possible use-after-free when j1939_can_rx_register fails - batman-adv: fix UaF while rescheduling delayed work - eth: qede: fix scheduling while atomic - eth: ice: make writes to /dev/gnssX synchronous" * tag 'net-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits) bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks bnxt_en: Prevent kernel panic when receiving unexpected PHC_UPDATE event bnxt_en: Skip firmware fatal error recovery if chip is not accessible bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Don't issue AP reset during ethtool's reset operation bnxt_en: Fix bnxt_hwrm_update_rss_hash_cfg() net: bcmgenet: Fix EEE implementation eth: ixgbe: fix the wake condition eth: bnxt: fix the wake condition lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() bpf: Add extra path pointer check to d_path helper net: sched: fix possible refcount leak in tc_chain_tmplt_add() net: sched: act_police: fix sparse errors in tcf_police_dump() net: openvswitch: fix upcall counter access before allocation net: sched: move rtm_tca_policy declaration to include file ice: make writes to /dev/gnssX synchronous net: sched: add rcu annotations around qdisc->qdisc_sleeping rfs: annotate lockless accesses to RFS sock flow table rfs: annotate lockless accesses to sk->sk_rxhash virtio_net: use control_buf for coalesce params ... commit 79b6fad54683c28cc7e40d806e409abd65ed241a Merge: 5f63595ebd82f d4d12c02bf5f7 Author: Linus Torvalds Date: Thu Jun 8 08:46:58 2023 -0700 Merge tag 'xfs-6.4-rc5-fixes' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Dave Chinner: "These are a set of regression fixes discovered on recent kernels. I was hoping to send this to you a week and half ago, but events out of my control delayed finalising the changes until early this week. Whilst the diffstat looks large for this stage of the merge window, a large chunk of it comes from moving the guts of one function from one file to another i.e. it's the same code, it is just run in a different context where it is safe to hold a specific lock. Otherwise the individual changes are relatively small and straigtht forward. Summary: - Propagate unlinked inode list corruption back up to log recovery (regression fix) - improve corruption detection for AGFL entries, AGFL indexes and XEFI extents (syzkaller fuzzer oops report) - Avoid double perag reference release (regression fix) - Improve extent merging detection in scrub (regression fix) - Fix a new undefined high bit shift (regression fix) - Fix for AGF vs inode cluster buffer deadlock (regression fix)" * tag 'xfs-6.4-rc5-fixes' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: collect errors from inodegc for unlinked inode recovery xfs: validate block number being freed before adding to xefi xfs: validity check agbnos on the AGFL xfs: fix agf/agfl verification on v4 filesystems xfs: fix double xfs_perag_rele() in xfs_filestream_pick_ag() xfs: fix broken logic when detecting mergeable bmap records xfs: Fix undefined behavior of shift into sign bit xfs: fix AGF vs inode cluster buffer deadlock xfs: defered work could create precommits xfs: restore allocation trylock iteration xfs: buffer pins need to hold a buffer reference commit 05a1308a2e08e4a375bf60eb4c6c057a201d81fc Author: Simon Horman Date: Thu May 25 12:52:58 2023 +0200 ice: Don't dereference NULL in ice_gnss_read error path If pf is NULL in ice_gnss_read() then it will be dereferenced in the error path by a call to dev_dbg(ice_pf_to_dev(pf), ...). Avoid this by simply returning in this case. If logging is desired an alternate approach might be to use pr_err() before returning. Flagged by Smatch as: .../ice_gnss.c:196 ice_gnss_read() error: we previously assumed 'pf' could be null (see line 131) Fixes: 43113ff73453 ("ice: add TTY for GNSS module for E810T device") Signed-off-by: Simon Horman Reviewed-by: Tariq Toukan Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit dea9d8f7643fab07bf89a1155f1f94f37d096a5e Author: Theodore Ts'o Date: Thu Jun 8 10:06:40 2023 -0400 ext4: only check dquot_initialize_needed() when debugging ext4_xattr_block_set() relies on its caller to call dquot_initialize() on the inode. To assure that this has happened there are WARN_ON checks. Unfortunately, this is subject to false positives if there is an antagonist thread which is flipping the file system at high rates between r/o and rw. So only do the check if EXT4_XATTR_DEBUG is enabled. Link: https://lore.kernel.org/r/20230608044056.GA1418535@mit.edu Signed-off-by: Theodore Ts'o commit 1b29243933098cdbc31b579b5616e183b4275e2f Author: Theodore Ts'o Date: Thu Jun 8 09:57:04 2023 -0400 Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled" This reverts commit a44be64bbecb15a452496f60db6eacfee2b59c79. Link: https://lore.kernel.org/r/653b3359-2005-21b1-039d-c55ca4cffdcc@gmail.com Signed-off-by: Theodore Ts'o commit b0b4a63f38d7cae3c57588592556481aedcae8b1 Author: Baruch Siach Date: Mon Apr 24 13:52:54 2023 +0300 docs: zh_CN/devicetree: sync usage-model fix Sync compatibly string fix from the English document. Signed-off-by: Baruch Siach Reviewed-by: Yanteng Si Link: https://lore.kernel.org/r/b39560250cb58f8cdcfe95791ce5af7455c6e8e3.1682333574.git.baruch@tkos.co.il Signed-off-by: Rob Herring commit c44e0503e5fd90c5ccbf81bcff7b6b70e9e2655b Author: Baruch Siach Date: Mon Apr 24 13:52:53 2023 +0300 docs: dt: fix documented Primecell compatible string Only arm,primecell is documented as compatible string for Primecell peripherals. Current code agrees with that. Signed-off-by: Baruch Siach Link: https://lore.kernel.org/r/9e137548c4e76e0d8deef6d49460cb37897934ca.1682333574.git.baruch@tkos.co.il Signed-off-by: Rob Herring commit f7efdf5e4dc10756ad632b1863b54b1b42a07530 Author: Damien Le Moal Date: Mon May 15 07:26:14 2023 +0900 dt-bindings: Change Damien Le Moal's contact email Change my email address to dlemoal@kernel.org. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20230514222614.115299-1-dlemoal@kernel.org Signed-off-by: Rob Herring commit 79b8ee702c918f1936e17cc53e14bec388ce1045 Author: Qu Wenruo Date: Tue Jun 6 15:08:28 2023 +0800 btrfs: scrub: also report errors hit during the initial read [BUG] After the recent scrub rework introduced in commit e02ee89baa66 ("btrfs: scrub: switch scrub_simple_mirror() to scrub_stripe infrastructure"), btrfs scrub no longer reports repaired errors any more: # mkfs.btrfs -f $dev -d DUP # mount $dev $mnt # xfs_io -f -d -c "pwrite -b 64K -S 0xaa 0 64" $mnt/file # umount $dev # xfs_io -f -c "pwrite -S 0xff $phy1 64K" $dev # Corrupt the first mirror # mount $dev $mnt # btrfs scrub start -BR $mnt scrub done for 725e7cb7-8a4a-4c77-9f2a-86943619e218 Scrub started: Tue Jun 6 14:56:50 2023 Status: finished Duration: 0:00:00 data_extents_scrubbed: 2 tree_extents_scrubbed: 18 data_bytes_scrubbed: 131072 tree_bytes_scrubbed: 294912 read_errors: 0 csum_errors: 0 <<< No errors here verify_errors: 0 [...] uncorrectable_errors: 0 unverified_errors: 0 corrected_errors: 16 <<< Only corrected errors last_physical: 2723151872 This can confuse btrfs-progs, as it relies on the csum_errors to determine if there is anything wrong. While on v6.3.x kernels, the report is different: csum_errors: 16 <<< verify_errors: 0 [...] uncorrectable_errors: 0 unverified_errors: 0 corrected_errors: 16 <<< [CAUSE] In the reworked scrub, we update the scrub progress inside scrub_stripe_report_errors(), using various bitmaps to update the result. For example for csum_errors, we use bitmap_weight() of stripe->csum_error_bitmap. Unfortunately at that stage, all error bitmaps (except init_error_bitmap) are the result of the latest repair attempt, thus if the stripe is fully repaired, those error bitmaps will all be empty, resulting the above output mismatch. To fix this, record the number of errors into stripe->init_nr_*_errors. Since we don't really care about where those errors are, we only need to record the number of errors. Then in scrub_stripe_report_errors(), use those initial numbers to update the progress other than using the latest error bitmaps. Fixes: e02ee89baa66 ("btrfs: scrub: switch scrub_simple_mirror() to scrub_stripe infrastructure") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1f2030ff6e4958780af9e65a22c39fa8082f292b Author: Qu Wenruo Date: Tue Jun 6 10:05:04 2023 +0800 btrfs: scrub: respect the read-only flag during repair [BUG] With recent scrub rework, the scrub operation no longer respects the read-only flag passed by "-r" option of "btrfs scrub start" command. # mkfs.btrfs -f -d raid1 $dev1 $dev2 # mount $dev1 $mnt # xfs_io -f -d -c "pwrite -b 128K -S 0xaa 0 128k" $mnt/file # sync # xfs_io -c "pwrite -S 0xff $phy1 64k" $dev1 # xfs_io -c "pwrite -S 0xff $((phy2 + 65536)) 64k" $dev2 # mount $dev1 $mnt -o ro # btrfs scrub start -BrRd $mnt Scrub device $dev1 (id 1) done Scrub started: Tue Jun 6 09:59:14 2023 Status: finished Duration: 0:00:00 [...] corrected_errors: 16 <<< Still has corrupted sectors last_physical: 1372585984 Scrub device $dev2 (id 2) done Scrub started: Tue Jun 6 09:59:14 2023 Status: finished Duration: 0:00:00 [...] corrected_errors: 16 <<< Still has corrupted sectors last_physical: 1351614464 # btrfs scrub start -BrRd $mnt Scrub device $dev1 (id 1) done Scrub started: Tue Jun 6 10:00:17 2023 Status: finished Duration: 0:00:00 [...] corrected_errors: 0 <<< No more errors last_physical: 1372585984 Scrub device $dev2 (id 2) done [...] corrected_errors: 0 <<< No more errors last_physical: 1372585984 [CAUSE] In the newly reworked scrub code, repair is always submitted no matter if we're doing a read-only scrub. [FIX] Fix it by skipping the write submission if the scrub is a read-only one. Unfortunately for the report part, even for a read-only scrub we will still report it as corrected errors, as we know it's repairable, even we won't really submit the write. Fixes: e02ee89baa66 ("btrfs: scrub: switch scrub_simple_mirror() to scrub_stripe infrastructure") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 58d95889f3c2064c6139ee94bb0e4d86e1ad4eab Author: Charles Keepax Date: Fri Jun 2 11:11:36 2023 +0100 soundwire: stream: Add missing clear of alloc_slave_rt The current path that skips allocating the slave runtime does not clear the alloc_slave_rt flag, this is clearly incorrect. Add the missing clear, so the runtime won't be erroneously cleaned up. Fixes: f3016b891c8c ("soundwire: stream: sdw_stream_add_ functions can be called multiple times") Reviewed-by: Pierre-Louis Bossart Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20230602101140.2040141-1-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul commit 7b672f282cf4712cb392ef798f0305cc4de32454 Merge: 592295e61b5c5 f1832e2b5e498 Author: Greg Kroah-Hartman Date: Thu Jun 8 11:06:30 2023 +0200 Merge tag 'usb-serial-6.4-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial device ids for 6.4-rc6 Here are some new modem device ids. Everything has been in linux-next with no reported issues. * tag 'usb-serial-6.4-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Quectel EM061KGL series commit 6c0ec7ab5aaff3706657dd4946798aed483b9471 Merge: 182620ab3660c 1eb4ef1259134 Author: Paolo Abeni Date: Thu Jun 8 10:52:48 2023 +0200 Merge branch 'bnxt_en-bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes This patchset has the following fixes for bnxt_en: 1. Add missing VNIC ID parameter in the FW message when getting an updated RSS configuration from the FW. 2. Fix a warning when doing ethtool reset on newer chips. 3. Fix VLAN issue on a VF when a default VLAN is assigned. 4. Fix a problem during DPC (Downstream Port containment) scenario. 5. Fix a NULL pointer dereference when receiving a PTP event from FW. 6. Fix VXLAN/Geneve UDP port delete/add with newer FW. ==================== Link: https://lore.kernel.org/r/20230607075409.228450-1-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 1eb4ef12591348c440ac9d6efcf7521e73cf2b10 Author: Somnath Kotur Date: Wed Jun 7 00:54:09 2023 -0700 bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks As per the new udp tunnel framework, drivers which need to know the details of a port entry (i.e. port type) when it gets deleted should use the .set_port / .unset_port callbacks. Implementing the current .udp_tunnel_sync callback would mean that the deleted tunnel port entry would be all zeros. This used to work on older firmware because it would not check the input when deleting a tunnel port. With newer firmware, the delete will now fail and subsequent tunnel port allocation will fail as a result. Fixes: 442a35a5a7aa ("bnxt: convert to new udp_tunnel_nic infra") Reviewed-by: Kalesh Anakkur Purayil Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan Signed-off-by: Paolo Abeni commit 319a7827df9784048abe072afe6b4fb4501d8de4 Author: Pavan Chebbi Date: Wed Jun 7 00:54:08 2023 -0700 bnxt_en: Prevent kernel panic when receiving unexpected PHC_UPDATE event The firmware can send PHC_RTC_UPDATE async event on a PF that may not have PTP registered. In such a case, there will be a null pointer deference for bp->ptp_cfg when we try to handle the event. Fix it by not registering for this event with the firmware if !bp->ptp_cfg. Also, check that bp->ptp_cfg is valid before proceeding when we receive the event. Fixes: 8bcf6f04d4a5 ("bnxt_en: Handle async event when the PHC is updated in RTC mode") Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: Paolo Abeni commit 83474a9b252ab23e6003865c2775024344cb9c09 Author: Vikas Gupta Date: Wed Jun 7 00:54:07 2023 -0700 bnxt_en: Skip firmware fatal error recovery if chip is not accessible Driver starts firmware fatal error recovery by detecting heartbeat failure or fw reset count register changing. But these checks are not reliable if the device is not accessible. This can happen while DPC (Downstream Port containment) is in progress. Skip firmware fatal recovery if pci_device_is_present() returns false. Fixes: acfb50e4e773 ("bnxt_en: Add FW fatal devlink_health_reporter.") Reviewed-by: Somnath Kotur Reviewed-by: Pavan Chebbi Signed-off-by: Vikas Gupta Signed-off-by: Michael Chan Signed-off-by: Paolo Abeni commit 1a9e4f501bc6ff1b6ecb60df54fbf2b54db43bfe Author: Somnath Kotur Date: Wed Jun 7 00:54:06 2023 -0700 bnxt_en: Query default VLAN before VNIC setup on a VF We need to call bnxt_hwrm_func_qcfg() on a VF to query the default VLAN that may be setup by the PF. If a default VLAN is enabled, the VF cannot support VLAN acceleration on the receive side and the VNIC must be setup to strip out the default VLAN tag. If a default VLAN is not enabled, the VF can support VLAN acceleration on the receive side. The VNIC should be set up to strip or not strip the VLAN based on the RX VLAN acceleration setting. Without this call to determine the default VLAN before calling bnxt_setup_vnic(), the VNIC may not be set up correctly. For example, bnxt_setup_vnic() may set up to strip the VLAN tag based on stale default VLAN information. If RX VLAN acceleration is not enabled, the VLAN tag will be incorrectly stripped and the RX data path will not work correctly. Fixes: cf6645f8ebc6 ("bnxt_en: Add function for VF driver to query default VLAN.") Reviewed-by: Pavan Chebbi Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan Signed-off-by: Paolo Abeni commit 1d997801c7cc6a7f542e46d5a6bf16f893ad3fe9 Author: Sreekanth Reddy Date: Wed Jun 7 00:54:05 2023 -0700 bnxt_en: Don't issue AP reset during ethtool's reset operation Only older NIC controller's firmware uses the PROC AP reset type. Firmware on 5731X/5741X and newer chips does not support this reset type. When bnxt_reset() issues a series of resets, this PROC AP reset may actually fail on these newer chips because the firmware is not ready to accept this unsupported command yet. Avoid this unnecessary error by skipping this reset type on chips that don't support it. Fixes: 7a13240e3718 ("bnxt_en: fix ethtool_reset_flags ABI violations") Reviewed-by: Pavan Chebbi Signed-off-by: Sreekanth Reddy Signed-off-by: Michael Chan Signed-off-by: Paolo Abeni commit 095d5dc0c1d9f3284e3c575ccf4c0e8b04b548f8 Author: Pavan Chebbi Date: Wed Jun 7 00:54:04 2023 -0700 bnxt_en: Fix bnxt_hwrm_update_rss_hash_cfg() We must specify the vnic id of the vnic in the input structure of this firmware message. Otherwise we will get an error from the firmware. Fixes: 98a4322b70e8 ("bnxt_en: update RSS config using difference algorithm") Reviewed-by: Kalesh Anakkur Purayil Reviewed-by: Somnath Kotur Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: Paolo Abeni commit f57ade27fc3eae16eab0f1edba1248ced429b2f0 Author: Maxim Mikityanskiy Date: Wed Jun 7 15:39:51 2023 +0300 selftests/bpf: Add test cases to assert proper ID tracking on spill The previous commit fixed a verifier bypass by ensuring that ID is not preserved on narrowing spills. Add the test cases to check the problematic patterns. Signed-off-by: Maxim Mikityanskiy Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20230607123951.558971-3-maxtram95@gmail.com commit 713274f1f2c896d37017efee333fd44149710119 Author: Maxim Mikityanskiy Date: Wed Jun 7 15:39:50 2023 +0300 bpf: Fix verifier id tracking of scalars on spill The following scenario describes a bug in the verifier where it incorrectly concludes about equivalent scalar IDs which could lead to verifier bypass in privileged mode: 1. Prepare a 32-bit rogue number. 2. Put the rogue number into the upper half of a 64-bit register, and roll a random (unknown to the verifier) bit in the lower half. The rest of the bits should be zero (although variations are possible). 3. Assign an ID to the register by MOVing it to another arbitrary register. 4. Perform a 32-bit spill of the register, then perform a 32-bit fill to another register. Due to a bug in the verifier, the ID will be preserved, although the new register will contain only the lower 32 bits, i.e. all zeros except one random bit. At this point there are two registers with different values but the same ID, which means the integrity of the verifier state has been corrupted. 5. Compare the new 32-bit register with 0. In the branch where it's equal to 0, the verifier will believe that the original 64-bit register is also 0, because it has the same ID, but its actual value still contains the rogue number in the upper half. Some optimizations of the verifier prevent the actual bypass, so extra care is needed: the comparison must be between two registers, and both branches must be reachable (this is why one random bit is needed). Both branches are still suitable for the bypass. 6. Right shift the original register by 32 bits to pop the rogue number. 7. Use the rogue number as an offset with any pointer. The verifier will believe that the offset is 0, while in reality it's the given number. The fix is similar to the 32-bit BPF_MOV handling in check_alu_op for SCALAR_VALUE. If the spill is narrowing the actual register value, don't keep the ID, make sure it's reset to 0. Fixes: 354e8f1970f8 ("bpf: Support <8-byte scalar spill and refill") Signed-off-by: Maxim Mikityanskiy Signed-off-by: Daniel Borkmann Tested-by: Andrii Nakryiko # Checked veristat delta Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20230607123951.558971-2-maxtram95@gmail.com commit 7f3c782b3914e510b646a77aedc3adeac2e4a63b Author: Randy Dunlap Date: Wed Jun 7 19:54:24 2023 -0700 eeprom: at24: also select REGMAP Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, so also select REGMAP to prevent the build errors. ../drivers/misc/eeprom/at24.c:540:42: warning: 'struct regmap_config' declared inside parameter list will not be visible outside of this definition or declaration 540 | struct regmap_config *regmap_config) ../drivers/misc/eeprom/at24.c: In function 'at24_make_dummy_client': ../drivers/misc/eeprom/at24.c:552:18: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration] 552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config); ../drivers/misc/eeprom/at24.c:552:16: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config); ../drivers/misc/eeprom/at24.c: In function 'at24_probe': ../drivers/misc/eeprom/at24.c:586:16: error: variable 'regmap_config' has initializer but incomplete type 586 | struct regmap_config regmap_config = { }; ../drivers/misc/eeprom/at24.c:586:30: error: storage size of 'regmap_config' isn't known 586 | struct regmap_config regmap_config = { }; ../drivers/misc/eeprom/at24.c:586:30: warning: unused variable 'regmap_config' [-Wunused-variable] Fixes: 5c015258478e ("eeprom: at24: add basic regmap_i2c support") Signed-off-by: Randy Dunlap Signed-off-by: Bartosz Golaszewski commit 409e873ea3c1fd3079909718bbeb06ac1ec7f38b Author: Xiubo Li Date: Thu Jun 1 08:59:31 2023 +0800 ceph: fix use-after-free bug for inodes when flushing capsnaps There is a race between capsnaps flush and removing the inode from 'mdsc->snap_flush_list' list: == Thread A == == Thread B == ceph_queue_cap_snap() -> allocate 'capsnapA' ->ihold('&ci->vfs_inode') ->add 'capsnapA' to 'ci->i_cap_snaps' ->add 'ci' to 'mdsc->snap_flush_list' ... == Thread C == ceph_flush_snaps() ->__ceph_flush_snaps() ->__send_flush_snap() handle_cap_flushsnap_ack() ->iput('&ci->vfs_inode') this also will release 'ci' ... == Thread D == ceph_handle_snap() ->flush_snaps() ->iterate 'mdsc->snap_flush_list' ->get the stale 'ci' ->remove 'ci' from ->ihold(&ci->vfs_inode) this 'mdsc->snap_flush_list' will WARNING To fix this we will increase the inode's i_count ref when adding 'ci' to the 'mdsc->snap_flush_list' list. [ idryomov: need_put int -> bool ] Cc: stable@vger.kernel.org Link: https://bugzilla.redhat.com/show_bug.cgi?id=2209299 Signed-off-by: Xiubo Li Reviewed-by: Milind Changire Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit a3efabee5878b8d7b1863debb78cb7129d07a346 Author: Andrzej Kacprowski Date: Wed Jun 7 11:45:02 2023 +0200 accel/ivpu: Fix sporadic VPU boot failure Wait for AON bit in HOST_SS_CPR_RST_CLR to return 0 before starting VPUIP power up sequence, otherwise the VPU device may sporadically fail to boot. An error in power up sequence is propagated to the runtime power management - the device will be in an error state until the VPU driver is reloaded. Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Cc: stable@vger.kernel.org # 6.3.x Signed-off-by: Andrzej Kacprowski Reviewed-by: Krystian Pradzynski Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20230607094502.388489-1-stanislaw.gruszka@linux.intel.com commit b563e47957af4ff71736c5cc4120a59b055ab583 Author: Stanislaw Gruszka Date: Thu May 25 12:38:18 2023 +0200 accel/ivpu: Do not use mutex_lock_interruptible If we get signal when waiting for the mmu->lock we do not invalidate current MMU configuration that might result in undefined behavior. Additionally there is little or no benefit on break waiting for ipc->lock. In current code base, we keep this lock for short periods. Fixes: 263b2ba5fc93 ("accel/ivpu: Add Intel VPU MMU support") Reviewed-by: Krystian Pradzynski Reviewed-by: Jeffrey Hugo Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20230525103818.877590-2-stanislaw.gruszka@linux.intel.com commit 9f7e3611f6c828fcb6001c39d8e7a523a4f31525 Author: Andrzej Kacprowski Date: Thu May 25 12:38:17 2023 +0200 accel/ivpu: Do not trigger extra VPU reset if the VPU is idle Turning off the PLL and entering D0i3 will reset the VPU so an explicit IP reset is redundant. But if the VPU is active, it may interfere with PLL disabling and to avoid that, we have to issue an additional IP reset to silence the VPU before turning off the PLL. Fixes: a8fed6d1e0b9 ("accel/ivpu: Fix power down sequence") Cc: stable@vger.kernel.org # 6.3.x Signed-off-by: Andrzej Kacprowski Reviewed-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20230525103818.877590-1-stanislaw.gruszka@linux.intel.com commit 182620ab3660c5a9098ffaa0e8a898e41b164987 Merge: a9f31047baca5 abac3ac97fe87 Author: Jakub Kicinski Date: Wed Jun 7 21:56:01 2023 -0700 Merge tag 'batadv-net-pullrequest-20230607' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - fix a broken sync while rescheduling delayed work, by Vladislav Efanov * tag 'batadv-net-pullrequest-20230607' of git://git.open-mesh.org/linux-merge: batman-adv: Broken sync while rescheduling delayed work ==================== Link: https://lore.kernel.org/r/20230607155515.548120-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit a9f31047baca57d47440c879cf259b86f900260c Author: Florian Fainelli Date: Tue Jun 6 14:43:47 2023 -0700 net: bcmgenet: Fix EEE implementation We had a number of short comings: - EEE must be re-evaluated whenever the state machine detects a link change as wight be switching from a link partner with EEE enabled/disabled - tx_lpi_enabled controls whether EEE should be enabled/disabled for the transmit path, which applies to the TBUF block - We do not need to forcibly enable EEE upon system resume, as the PHY state machine will trigger a link event that will do that, too Fixes: 6ef398ea60d9 ("net: bcmgenet: add EEE support") Signed-off-by: Florian Fainelli Reviewed-by: Russell King (Oracle) Link: https://lore.kernel.org/r/20230606214348.2408018-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit f0d751973f739feb3742d4e5f4c0914e8b84e7c7 Author: Jakub Kicinski Date: Tue Jun 6 18:08:26 2023 -0700 eth: ixgbe: fix the wake condition Flip the netif_carrier_ok() condition in queue wake logic. When I moved it to inside __netif_txq_completed_wake() I missed negating it. This made the condition ineffective and could probably lead to crashes. Fixes: 301f227fc860 ("net: piggy back on the memory barrier in bql when waking queues") Reviewed-by: Tony Nguyen Link: https://lore.kernel.org/r/20230607010826.960226-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 649c3fed36730a53447d8f479c14e431363563b6 Author: Jakub Kicinski Date: Tue Jun 6 18:08:25 2023 -0700 eth: bnxt: fix the wake condition The down condition should be the negation of the wake condition, IOW when I moved it from: if (cond && wake()) to if (__netif_txq_completed_wake(cond)) Cond should have been negated. Flip it now. This bug leads to occasional crashes with netconsole. It may also lead to queue never waking up in case BQL is not enabled. Reported-by: David Wei Fixes: 08a096780d92 ("bnxt: use new queue try_stop/try_wake macros") Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20230607010826.960226-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c9d99cfa66dfff4350e064adb98367cb922accf8 Merge: 7c5d4801ecf05 f46fab0e36e61 Author: Jakub Kicinski Date: Wed Jun 7 21:47:11 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-06-07 We've added 7 non-merge commits during the last 7 day(s) which contain a total of 12 files changed, 112 insertions(+), 7 deletions(-). The main changes are: 1) Fix a use-after-free in BPF's task local storage, from KP Singh. 2) Make struct path handling more robust in bpf_d_path, from Jiri Olsa. 3) Fix a syzbot NULL-pointer dereference in sockmap, from Eric Dumazet. 4) UAPI fix for BPF_NETFILTER before final kernel ships, from Florian Westphal. 5) Fix map-in-map array_map_gen_lookup code generation where elem_size was not being set for inner maps, from Rhys Rustad-Elliott. 6) Fix sockopt_sk selftest's NETLINK_LIST_MEMBERSHIPS assertion, from Yonghong Song. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Add extra path pointer check to d_path helper selftests/bpf: Fix sockopt_sk selftest bpf: netfilter: Add BPF_NETFILTER bpf_attach_type selftests/bpf: Add access_inner_map selftest bpf: Fix elem_size not being set for inner maps bpf: Fix UAF in task local storage bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready() ==================== Link: https://lore.kernel.org/r/20230607220514.29698-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 7c5d4801ecf0564c860033d89726b99723c55146 Author: Ben Hutchings Date: Fri Jun 2 20:28:15 2023 +0200 lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap. So we need to clear the pointer to our glue structure in rmap before doing that, not after. Fixes: 4e0473f1060a ("lib: cpu_rmap: Avoid use after free on rmap->obj array entries") Signed-off-by: Ben Hutchings Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/ZHo0vwquhOy3FaXc@decadent.org.uk Signed-off-by: Jakub Kicinski commit a1a64a151dae8ac3581c1cbde44b672045cb658b Author: Pablo Neira Ayuso Date: Thu Jun 8 00:19:12 2023 +0200 netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM If caller reports ENOMEM, then stop iterating over the batch and send a single netlink message to userspace to report OOM. Fixes: cbb8125eb40b ("netfilter: nfnetlink: deliver netlink errors on batch completion") Signed-off-by: Pablo Neira Ayuso commit 212ed75dc5fb9d1423b3942c8f872a868cda3466 Author: Pablo Neira Ayuso Date: Wed Jun 7 11:55:42 2023 +0200 netfilter: nf_tables: integrate pipapo into commit protocol The pipapo set backend follows copy-on-update approach, maintaining one clone of the existing datastructure that is being updated. The clone and current datastructures are swapped via rcu from the commit step. The existing integration with the commit protocol is flawed because there is no operation to clean up the clone if the transaction is aborted. Moreover, the datastructure swap happens on set element activation. This patch adds two new operations for sets: commit and abort, these new operations are invoked from the commit and abort steps, after the transactions have been digested, and it updates the pipapo set backend to use it. This patch adds a new ->pending_update field to sets to maintain a list of sets that require this new commit and abort operations. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Pablo Neira Ayuso commit e1a600208286c197c2696e51fc313e49889315bd Author: Alvin Lee Date: Fri May 19 11:38:15 2023 -0400 drm/amd/display: Reduce sdp bw after urgent to 90% [Description] Reduce expected SDP bandwidth due to poor QoS and arbitration issues on high bandwidth configs Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Acked-by: Stylon Wang Signed-off-by: Alvin Lee Reviewed-by: Nevenko Stupar Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit dac652220ba0e5a2ef2da2a47a60b60aea333fdb Author: YiPeng Chai Date: Wed May 24 17:14:15 2023 +0800 drm/amdgpu: change reserved vram info print The link object of mgr->reserved_pages is the blocks variable in struct amdgpu_vram_reservation, not the link variable in struct drm_buddy_block. Signed-off-by: YiPeng Chai Reviewed-by: Arunpravin Paneer Selvam Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit b447b079cf3a9971ea4d31301e673f49612ccc18 Author: Chia-I Wu Date: Thu Jun 1 14:48:08 2023 -0700 drm/amdgpu: fix xclk freq on CHIP_STONEY According to Alex, most APUs from that time seem to have the same issue (vbios says 48Mhz, actual is 100Mhz). I only have a CHIP_STONEY so I limit the fixup to CHIP_STONEY Signed-off-by: Chia-I Wu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 982b173a6c6d9472730c3116051977e05d17c8c5 Author: Min Li Date: Sat Jun 3 15:43:45 2023 +0800 drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl Userspace can race to free the gobj(robj converted from), robj should not be accessed again after drm_gem_object_put, otherwith it will result in use-after-free. Reviewed-by: Christian König Signed-off-by: Min Li Signed-off-by: Alex Deucher commit 73c12de8bee258b51bd418f33dc59f2c6e5fb5f6 Author: Alex Deucher Date: Fri Jun 2 14:37:13 2023 -0400 Revert "drm/amdgpu: switch to golden tsc registers for raven/raven2" This reverts commit f03eb1d26c2739b75580f58bbab4ab2d5d3eba46. This results in inconsistent timing reported via asynchronous GPU queries. Link: https://lists.freedesktop.org/archives/amd-gfx/2023-May/093731.html Cc: Jesse.Zhang@amd.com Cc: michel@daenzer.net Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher commit d511f95938bf9e75ab73ace0ab1cebbe9a13df4b Author: Alex Deucher Date: Fri Jun 2 14:34:12 2023 -0400 Revert "drm/amdgpu: Differentiate between Raven2 and Raven/Picasso according to revision id" This reverts commit 9d2d1827af295fd6971786672c41c4dba3657154. This results in inconsistent timing reported via asynchronous GPU queries. Link: https://lists.freedesktop.org/archives/amd-gfx/2023-May/093731.html Cc: Jesse.Zhang@amd.com Cc: michel@daenzer.net Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher commit 3b3ffd729e7e3ad706ddba4bb84358df5d43a647 Author: Alex Deucher Date: Fri Jun 2 14:32:55 2023 -0400 Revert "drm/amdgpu: change the reference clock for raven/raven2" This reverts commit fbc24293ca16b3b9ef891fe32ccd04735a6f8dc1. This results in inconsistent timing reported via asynchronous GPU queries. Link: https://lists.freedesktop.org/archives/amd-gfx/2023-May/093731.html Cc: Jesse.Zhang@amd.com Cc: michel@daenzer.net Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher commit 59de751e3845d699e02dc4da47322b92d83a41e2 Author: Samson Tam Date: Tue May 9 16:40:19 2023 -0400 drm/amd/display: add ODM case when looking for first split pipe [Why] When going from ODM 2:1 single display case to max displays, second odm pipe needs to be repurposed for one of the new single displays. However, acquire_first_split_pipe() only handles MPC case and not ODM case [How] Add ODM conditions in acquire_first_split_pipe() Add commit_minimal_transition_state() in commit_streams() to handle odm 2:1 exit first, and then process new streams Handle ODM condition in commit_minimal_transition_state() Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Acked-by: Stylon Wang Signed-off-by: Samson Tam Reviewed-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 99b3886f8674502e967b1d050e40aa669c9098c1 Author: Mario Limonciello Date: Tue May 30 12:44:30 2023 -0500 drm/amd: Make lack of `ACPI_FADT_LOW_POWER_S0` or `CONFIG_AMD_PMC` louder during suspend path Users have reported that s2idle wasn't working on OEM Phoenix systems, but it was root caused to be because `CONFIG_AMD_PMC` wasn't set in the distribution kernel config. To make this more apparent, raise the messaging to err instead of warn. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217497 Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 38e4ced804796c5725e2a52ec3601951552c4a97 Author: Evan Quan Date: Thu Apr 6 12:08:21 2023 +0800 drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs Disable the pcie lane switching for some sienna_cichlid SKUs since it might not work well on some platforms. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 1d13c49cf4e246b218d71873f1bb1bbd376aa10e Author: Lijo Lazar Date: Fri Mar 31 16:30:01 2023 +0530 drm/amd/pm: Fix power context allocation in SMU13 Use the right data structure for allocation. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 2a1eb1a343208ce7d6839b73d62aece343e693ff Author: Horatio Zhang Date: Mon May 29 14:23:37 2023 -0400 drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram Use the function of amdgpu_bo_vm_destroy to handle the resource release of shadow bo. During the amdgpu_mes_self_test, shadow bo released, but vmbo->shadow_list was not, which caused a null pointer reference error in amdgpu_device_recover_vram when GPU reset. Fixes: 6c032c37ac3e ("drm/amdgpu: Fix vram recover doesn't work after whole GPU reset (v2)") Signed-off-by: xinhui pan Signed-off-by: Horatio Zhang Acked-by: Feifei Xu Signed-off-by: Alex Deucher commit 30c3d3b70aba2464ee8c91025e91428f92464077 Author: Mario Limonciello Date: Tue May 30 11:57:59 2023 -0500 drm/amd: Disallow s0ix without BIOS support again commit cf488dcd0ab7 ("drm/amd: Allow s0ix without BIOS support") showed improvements to power consumption over suspend when s0ix wasn't enabled in BIOS and the system didn't support S3. This patch however was misguided because the reason the system didn't support S3 was because SMT was disabled in OEM BIOS setup. This prevented the BIOS from allowing S3. Also allowing GPUs to use the s2idle path actually causes problems if they're invoked on systems that may not support s2idle in the platform firmware. `systemd` has a tendency to try to use `s2idle` if `deep` fails for any reason, which could lead to unexpected flows. The original commit also fixed a problem during resume from suspend to idle without hardware support, but this is no longer necessary with commit ca4751866397 ("drm/amd: Don't allow s0ix on APUs older than Raven") Revert commit cf488dcd0ab7 ("drm/amd: Allow s0ix without BIOS support") to make it match the expected behavior again. Cc: Rafael Ávila de Espíndola Link: https://github.com/torvalds/linux/blob/v6.1/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c#L1060 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2599 Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5f63595ebd82f56a2dd36ca013dd7f5ff2e2416a Merge: 25bda386c3d52 feee70f456865 Author: Linus Torvalds Date: Wed Jun 7 13:49:42 2023 -0700 Merge tag 'input-for-v6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a fix for unbalanced open count for inhibited input devices - fixups in Elantech PS/2 and Cyppress TTSP v5 drivers - a quirk to soc_button_array driver to make it work with Lenovo Yoga Book X90F / X90L - a removal of erroneous entry from xpad driver * tag 'input-for-v6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - delete a Razer DeathAdder mouse VID/PID entry Input: psmouse - fix OOB access in Elantech protocol Input: soc_button_array - add invalid acpi_index DMI quirk handling Input: fix open count when closing inhibited device Input: cyttsp5 - fix array length commit de29a96acceae732c68a4094d08dc49079eefa02 Author: Chen-Yu Tsai Date: Fri May 26 15:35:37 2023 +0800 notifier: Initialize new struct srcu_usage field In commit 95433f726301 ("srcu: Begin offloading srcu_struct fields to srcu_update"), a new struct srcu_usage field was added, but was not properly initialized. This led to a "spinlock bad magic" BUG when the SRCU notifier was ever used. This was observed in the MediaTek CCI devfreq driver on next-20230525. The trimmed stack trace is as follows: BUG: spinlock bad magic on CPU#4, swapper/0/1 lock: 0xffffff80ff529ac0, .magic: 00000000, .owner: /-1, .owner_cpu: 0 Call trace: spin_bug+0xa4/0xe8 do_raw_spin_lock+0xec/0x120 _raw_spin_lock_irqsave+0x78/0xb8 synchronize_srcu+0x3c/0x168 srcu_notifier_chain_unregister+0x5c/0xa0 cpufreq_unregister_notifier+0x94/0xe0 devfreq_passive_event_handler+0x7c/0x3e0 devfreq_remove_device+0x48/0xe8 Add __SRCU_USAGE_INIT() to SRCU_NOTIFIER_INIT() so that srcu_usage gets initialized properly. Reported-by: Jon Hunter Fixes: 95433f726301 ("srcu: Begin offloading srcu_struct fields to srcu_update") Signed-off-by: Chen-Yu Tsai Tested-by: AngeloGioacchino Del Regno Cc: Matthias Brugger Cc: "Rafael J. Wysocki" Cc: "Michał Mirosław" Cc: Dmitry Osipenko Cc: Sachin Sant Cc: Joel Fernandes (Google) Acked-by: Zqiang Signed-off-by: Paul E. McKenney commit 4d8df0f5f79f747d75a7d356d9b9ea40a4e4c8a9 Author: Prathu Baronia Date: Mon May 22 14:20:19 2023 +0530 vhost: use kzalloc() instead of kmalloc() followed by memset() Use kzalloc() to allocate new zeroed out msg node instead of memsetting a node allocated with kmalloc(). Signed-off-by: Prathu Baronia Message-Id: <20230522085019.42914-1-prathubaronia2011@gmail.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 25bda386c3d526b48dd22186324570fc8e191a52 Author: Thomas Gleixner Date: Wed Jun 7 01:14:05 2023 +0200 MAINTAINERS: Add entry for debug objects This is overdue and an oversight. Add myself to this file deespite the fact that I'm trying to reduce the number of entries in this file which have my name attached, but in the hope that patches wont get picked up elsewhere completely unreviewed and unnoticed. Signed-off-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 2a567c1e29301495affa220543f156dd6dad50a9 Author: Diederik de Haas Date: Tue May 9 16:15:01 2023 +0200 dt-bindings: net: realtek-bluetooth: Fix double RTL8723CS in desc The description says 'RTL8723CS/RTL8723CS/...' whereas the title and other places reference 'RTL8723BS/RTL8723CS/...'. Signed-off-by: Diederik de Haas Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230509141500.275887-1-didi.debian@cknow.org Signed-off-by: Rob Herring commit 44b902e935be111fc98eb2a2d8e3d08196fd52ac Author: Chris Morgan Date: Mon May 8 11:08:10 2023 -0500 dt-bindings: net: realtek-bluetooth: Fix RTL8821CS binding Update the fallback string for the RTL8821CS from realtek,rtl8822cs-bt to realtek,rtl8723bs-bt. The difference between these two strings is that the 8822cs enables power saving features that the 8723bs does not, and in testing the 8821cs seems to have issues with these power saving modes enabled. Fixes: 95ee3a93239e ("dt-bindings: net: realtek-bluetooth: Add RTL8821CS") Signed-off-by: Chris Morgan Acked-by: Krzysztof Kozlowski Acked-by: Heiko Stuebner Link: https://lore.kernel.org/r/20230508160811.3568213-2-macroalpha82@gmail.com Signed-off-by: Rob Herring commit a27648c742104a833a01c54becc24429898d85bf Author: David Howells Date: Wed Jun 7 09:47:13 2023 +0100 afs: Fix setting of mtime when creating a file/dir/symlink kafs incorrectly passes a zero mtime (ie. 1st Jan 1970) to the server when creating a file, dir or symlink because the mtime recorded in the afs_operation struct gets passed to the server by the marshalling routines, but the afs_mkdir(), afs_create() and afs_symlink() functions don't set it. This gets masked if a file or directory is subsequently modified. Fix this by filling in op->mtime before calling the create op. Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept") Signed-off-by: David Howells Reviewed-by: Jeffrey Altman Reviewed-by: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Linus Torvalds commit 30c60dda219ddda0bc6ff6ac55d493d9db8be4fa Author: Oliver Upton Date: Tue Jun 6 18:48:14 2023 +0000 KVM: arm64: Use raw_smp_processor_id() in kvm_pmu_probe_armpmu() Sebastian reports that commit 1c913a1c35aa ("KVM: arm64: Iterate arm_pmus list to probe for default PMU") introduced the following splat with CONFIG_DEBUG_PREEMPT enabled: [70506.110187] BUG: using smp_processor_id() in preemptible [00000000] code: qemu-system-aar/3078242 [70506.119077] caller is debug_smp_processor_id+0x20/0x30 [70506.124229] CPU: 129 PID: 3078242 Comm: qemu-system-aar Tainted: G W 6.4.0-rc5 #25 [70506.133176] Hardware name: GIGABYTE R181-T92-00/MT91-FS4-00, BIOS F34 08/13/2020 [70506.140559] Call trace: [70506.142993] dump_backtrace+0xa4/0x130 [70506.146737] show_stack+0x20/0x38 [70506.150040] dump_stack_lvl+0x48/0x60 [70506.153704] dump_stack+0x18/0x28 [70506.157007] check_preemption_disabled+0xe4/0x108 [70506.161701] debug_smp_processor_id+0x20/0x30 [70506.166046] kvm_arm_pmu_v3_set_attr+0x460/0x628 [70506.170662] kvm_arm_vcpu_arch_set_attr+0x88/0xd8 [70506.175363] kvm_arch_vcpu_ioctl+0x258/0x4a8 [70506.179632] kvm_vcpu_ioctl+0x32c/0x6b8 [70506.183465] __arm64_sys_ioctl+0xb4/0x100 [70506.187467] invoke_syscall+0x78/0x108 [70506.191205] el0_svc_common.constprop.0+0x4c/0x100 [70506.195984] do_el0_svc+0x34/0x50 [70506.199287] el0_svc+0x34/0x108 [70506.202416] el0t_64_sync_handler+0xf4/0x120 [70506.206674] el0t_64_sync+0x194/0x198 Fix the issue by using the raw variant that bypasses the debug assertion. While at it, stick all of the nuance and UAPI baggage into a comment for posterity. Fixes: 1c913a1c35aa ("KVM: arm64: Iterate arm_pmus list to probe for default PMU") Reported-by: Sebastian Ott Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230606184814.456743-1-oliver.upton@linux.dev commit 1caa71a7a600f7781ce05ef1e84701c459653663 Author: Marc Zyngier Date: Wed Jun 7 15:38:44 2023 +0100 KVM: arm64: Restore GICv2-on-GICv3 functionality When reworking the vgic locking, the vgic distributor registration got simplified, which was a very good cleanup. But just a tad too radical, as we now register the *native* vgic only, ignoring the GICv2-on-GICv3 that allows pre-historic VMs (or so I thought) to run. As it turns out, QEMU still defaults to GICv2 in some cases, and this breaks Nathan's setup! Fix it by propagating the *requested* vgic type rather than the host's version. Fixes: 59112e9c390b ("KVM: arm64: vgic: Fix a circular locking issue") Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Marc Zyngier link: https://lore.kernel.org/r/20230606221525.GA2269598@dev-arch.thelio-3990X commit 49a0a3731596fc004db6eec3fc674d92a09ef383 Author: Alexandre Ghiti Date: Wed Jun 7 14:58:51 2023 +0200 riscv: Check the virtual alignment before choosing a map size We used to only check the alignment of the physical address to decide which mapping would fit for a certain region of the linear mapping, but it is not enough since the virtual address must also be aligned, so check that too. Fixes: 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") Reported-by: Song Shuai Link: https://lore.kernel.org/linux-riscv/tencent_7C3B580B47C1B17C16488EC1@qq.com/ Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230607125851.63370-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 25abe0db92437fde463204c3e4eb5a71b62d6e5d Author: Alexandre Ghiti Date: Tue Jun 6 15:04:44 2023 +0200 riscv: Fix kfence now that the linear mapping can be backed by PUD/P4D/PGD RISC-V Kfence implementation used to rely on the fact the linear mapping was backed by at most PMD hugepages, which is not true anymore since commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping"). Instead of splitting PUD/P4D/PGD mappings afterwards, directly map the kfence pool region using PTE mappings by allocating this region before setup_vm_final(). Reported-by: syzbot+a74d57bddabbedd75135@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a74d57bddabbedd75135 Fixes: 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230606130444.25090-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 6569fc12e442ea973d96db39e542aa19a7bc3a79 Author: Hsieh-Tseng Shen Date: Tue Apr 25 18:28:28 2023 +0800 riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable Commit 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ") allows riscv to use mmap with PROT_WRITE only, and meanwhile mmap with w+x is also permitted. However, when userspace tries to access this page with PROT_WRITE|PROT_EXEC, which causes infinite loop at load page fault as well as it triggers soft lockup. According to riscv privileged spec, "Writable pages must also be marked readable". The fix to drop the `PAGE_COPY_READ_EXEC` and then `PAGE_COPY_EXEC` would be just used instead. This aligns the other arches (i.e arm64) for protection_map. Fixes: 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ") Signed-off-by: Hsieh-Tseng Shen Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230425102828.1616812-1-woodrow.shen@sifive.com Signed-off-by: Palmer Dabbelt commit b00de0000a69579f4d730077fe3ea8ca31404255 Author: Abel Vesa Date: Mon Jun 5 14:56:07 2023 +0300 regulator: qcom-rpmh: Fix regulators for PM8550 The PM8550 uses only NLDOs 515 and the LDO 6 through 8 are low voltage type, so fix accordingly. Fixes: e6e3776d682d ("regulator: qcom-rpmh: Add support for PM8550 regulators") Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20230605115607.921308-1-abel.vesa@linaro.org Signed-off-by: Mark Brown commit f46fab0e36e611a2389d3843f34658c849b6bd60 Author: Jiri Olsa Date: Tue Jun 6 11:17:14 2023 -0700 bpf: Add extra path pointer check to d_path helper Anastasios reported crash on stable 5.15 kernel with following BPF attached to lsm hook: SEC("lsm.s/bprm_creds_for_exec") int BPF_PROG(bprm_creds_for_exec, struct linux_binprm *bprm) { struct path *path = &bprm->executable->f_path; char p[128] = { 0 }; bpf_d_path(path, p, 128); return 0; } But bprm->executable can be NULL, so bpf_d_path call will crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI ... RIP: 0010:d_path+0x22/0x280 ... Call Trace: bpf_d_path+0x21/0x60 bpf_prog_db9cf176e84498d9_bprm_creds_for_exec+0x94/0x99 bpf_trampoline_6442506293_0+0x55/0x1000 bpf_lsm_bprm_creds_for_exec+0x5/0x10 security_bprm_creds_for_exec+0x29/0x40 bprm_execve+0x1c1/0x900 do_execveat_common.isra.0+0x1af/0x260 __x64_sys_execve+0x32/0x40 It's problem for all stable trees with bpf_d_path helper, which was added in 5.9. This issue is fixed in current bpf code, where we identify and mark trusted pointers, so the above code would fail even to load. For the sake of the stable trees and to workaround potentially broken verifier in the future, adding the code that reads the path object from the passed pointer and verifies it's valid in kernel space. Fixes: 6e22ab9da793 ("bpf: Add d_path helper") Reported-by: Anastasios Papagiannis Suggested-by: Alexei Starovoitov Signed-off-by: Jiri Olsa Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20230606181714.532998-1-jolsa@kernel.org commit d1f11f41eb746a33816695f1b6b6719826cc532c Author: Bartosz Golaszewski Date: Mon Jun 5 16:53:08 2023 +0200 MAINTAINERS: add Andy Shevchenko as reviewer for the GPIO subsystem Andy has been a de-facto reviewer for all things GPIO for a long time so let's make it official. Signed-off-by: Bartosz Golaszewski Acked-by: Andy Shevchenko Reviewed-by: Linus Walleij commit d7459efc9276a715fe9def401bc30045aeb9668a Author: Kent Gibson Date: Wed Jun 7 14:50:04 2023 +0800 gpio: sim: quietly ignore configured lines outside the bank The user-space policy of the gpio-sim is that configuration for lines with offsets outside the bounds of the corresponding bank is ignored, but gpio-sim is still using that configuration when constructing the sim. In the case of named lines this results in temporarily allocating space for names that are not used, and for hogs results in errors being logged when the gpio-sim attempts to register the out of range hog with gpiolib: gpiochip_machine_hog: unable to get GPIO desc: -22 Add checks to filter out any line configuration outside the bounds of the bank when constructing the sim. Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit 44f8baaf230c655c249467ca415b570deca8df77 Author: Hangyu Hua Date: Wed Jun 7 10:23:01 2023 +0800 net: sched: fix possible refcount leak in tc_chain_tmplt_add() try_module_get will be called in tcf_proto_lookup_ops. So module_put needs to be called to drop the refcount if ops don't implement the required function. Fixes: 9f407f1768d3 ("net: sched: introduce chain templates") Signed-off-by: Hangyu Hua Reviewed-by: Larysa Zaremba Signed-off-by: David S. Miller commit 682881ee45c81daa883dcd4fe613b0b0d988bb22 Author: Eric Dumazet Date: Tue Jun 6 13:13:04 2023 +0000 net: sched: act_police: fix sparse errors in tcf_police_dump() Fixes following sparse errors: net/sched/act_police.c:360:28: warning: dereference of noderef expression net/sched/act_police.c:362:45: warning: dereference of noderef expression net/sched/act_police.c:362:45: warning: dereference of noderef expression net/sched/act_police.c:368:28: warning: dereference of noderef expression net/sched/act_police.c:370:45: warning: dereference of noderef expression net/sched/act_police.c:370:45: warning: dereference of noderef expression net/sched/act_police.c:376:45: warning: dereference of noderef expression net/sched/act_police.c:376:45: warning: dereference of noderef expression Fixes: d1967e495a8d ("net_sched: act_police: add 2 new attributes to support police 64bit rate and peakrate") Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit de9df6c6b27e22d7bdd20107947ef3a20e687de5 Author: Eelco Chaudron Date: Tue Jun 6 13:56:35 2023 +0200 net: openvswitch: fix upcall counter access before allocation Currently, the per cpu upcall counters are allocated after the vport is created and inserted into the system. This could lead to the datapath accessing the counters before they are allocated resulting in a kernel Oops. Here is an example: PID: 59693 TASK: ffff0005f4f51500 CPU: 0 COMMAND: "ovs-vswitchd" #0 [ffff80000a39b5b0] __switch_to at ffffb70f0629f2f4 #1 [ffff80000a39b5d0] __schedule at ffffb70f0629f5cc #2 [ffff80000a39b650] preempt_schedule_common at ffffb70f0629fa60 #3 [ffff80000a39b670] dynamic_might_resched at ffffb70f0629fb58 #4 [ffff80000a39b680] mutex_lock_killable at ffffb70f062a1388 #5 [ffff80000a39b6a0] pcpu_alloc at ffffb70f0594460c #6 [ffff80000a39b750] __alloc_percpu_gfp at ffffb70f05944e68 #7 [ffff80000a39b760] ovs_vport_cmd_new at ffffb70ee6961b90 [openvswitch] ... PID: 58682 TASK: ffff0005b2f0bf00 CPU: 0 COMMAND: "kworker/0:3" #0 [ffff80000a5d2f40] machine_kexec at ffffb70f056a0758 #1 [ffff80000a5d2f70] __crash_kexec at ffffb70f057e2994 #2 [ffff80000a5d3100] crash_kexec at ffffb70f057e2ad8 #3 [ffff80000a5d3120] die at ffffb70f0628234c #4 [ffff80000a5d31e0] die_kernel_fault at ffffb70f062828a8 #5 [ffff80000a5d3210] __do_kernel_fault at ffffb70f056a31f4 #6 [ffff80000a5d3240] do_bad_area at ffffb70f056a32a4 #7 [ffff80000a5d3260] do_translation_fault at ffffb70f062a9710 #8 [ffff80000a5d3270] do_mem_abort at ffffb70f056a2f74 #9 [ffff80000a5d32a0] el1_abort at ffffb70f06297dac #10 [ffff80000a5d32d0] el1h_64_sync_handler at ffffb70f06299b24 #11 [ffff80000a5d3410] el1h_64_sync at ffffb70f056812dc #12 [ffff80000a5d3430] ovs_dp_upcall at ffffb70ee6963c84 [openvswitch] #13 [ffff80000a5d3470] ovs_dp_process_packet at ffffb70ee6963fdc [openvswitch] #14 [ffff80000a5d34f0] ovs_vport_receive at ffffb70ee6972c78 [openvswitch] #15 [ffff80000a5d36f0] netdev_port_receive at ffffb70ee6973948 [openvswitch] #16 [ffff80000a5d3720] netdev_frame_hook at ffffb70ee6973a28 [openvswitch] #17 [ffff80000a5d3730] __netif_receive_skb_core.constprop.0 at ffffb70f06079f90 We moved the per cpu upcall counter allocation to the existing vport alloc and free functions to solve this. Fixes: 95637d91fefd ("net: openvswitch: release vport resources on failure") Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets") Signed-off-by: Eelco Chaudron Reviewed-by: Simon Horman Acked-by: Aaron Conole Signed-off-by: David S. Miller commit 886bc7d6ed3357975c5f1d3c784da96000d4bbb4 Author: Eric Dumazet Date: Tue Jun 6 11:42:33 2023 +0000 net: sched: move rtm_tca_policy declaration to include file rtm_tca_policy is used from net/sched/sch_api.c and net/sched/cls_api.c, thus should be declared in an include file. This fixes the following sparse warning: net/sched/sch_api.c:1434:25: warning: symbol 'rtm_tca_policy' was not declared. Should it be static? Fixes: e331473fee3d ("net/sched: cls_api: add missing validation of netlink attributes") Signed-off-by: Eric Dumazet Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit abd649fdf91adf44c5bb46891b6d8741a14f90a5 Merge: 08425abbab998 436eeae0411ac Author: Arnd Bergmann Date: Wed Jun 7 12:58:22 2023 +0200 Merge tag 'amdtee-fix-for-v6.5' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes AMDTEE add return origin to load TA command * tag 'amdtee-fix-for-v6.5' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta' Link: https://lore.kernel.org/r/20230606075843.GA2792442@rayden Signed-off-by: Arnd Bergmann commit ca0aa17f2db3468fd017038d23a78e17388e2f67 Author: Uwe Kleine-König Date: Thu Mar 9 10:58:19 2023 +0100 i2c: sprd: Delete i2c adapter in .remove's error path If pm runtime resume fails the .remove callback used to exit early. This resulted in an error message by the driver core but the device gets removed anyhow. This lets the registered i2c adapter stay around with an unbound parent device. So only skip clk disabling if resume failed, but do delete the adapter. Fixes: 8b9ec0719834 ("i2c: Add Spreadtrum I2C controller driver") Signed-off-by: Uwe Kleine-König Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit bf15bb38ec7f4ff522da5c20e1673dbda7159938 Author: Michal Schmidt Date: Tue Jun 6 10:12:53 2023 -0700 ice: make writes to /dev/gnssX synchronous The current ice driver's GNSS write implementation buffers writes and works through them asynchronously in a kthread. That's bad because: - The GNSS write_raw operation is supposed to be synchronous[1][2]. - There is no upper bound on the number of pending writes. Userspace can submit writes much faster than the driver can process, consuming unlimited amounts of kernel memory. A patch that's currently on review[3] ("[v3,net] ice: Write all GNSS buffers instead of first one") would add one more problem: - The possibility of waiting for a very long time to flush the write work when doing rmmod, softlockups. To fix these issues, simplify the implementation: Drop the buffering, the write_work, and make the writes synchronous. I tested this with gpsd and ubxtool. [1] https://events19.linuxfoundation.org/wp-content/uploads/2017/12/The-GNSS-Subsystem-Johan-Hovold-Hovold-Consulting-AB.pdf "User interface" slide. [2] A comment in drivers/gnss/core.c:gnss_write(): /* Ignoring O_NONBLOCK, write_raw() is synchronous. */ [3] https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230217120541.16745-1-karol.kolacinski@intel.com/ Fixes: d6b98c8d242a ("ice: add write functionality for GNSS TTY") Signed-off-by: Michal Schmidt Reviewed-by: Simon Horman Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit 79d0150d2d983a4f6efee676cea06027f586fcd0 Author: Tvrtko Ursulin Date: Mon Jun 5 14:11:35 2023 +0100 drm/i915/selftests: Add some missing error propagation Add some missing error propagation in live_parallel_switch. To avoid needlessly burdening the various backport processes, note I am not marking it as a fix against any patches and not copying stable since it is debug/selftests only code. Signed-off-by: Tvrtko Ursulin Reported-by: Dan Carpenter Cc: Andi Shyti Reviewed-by: Andi Shyti Fixes: 50d16d44cce4 ("drm/i915/selftests: Exercise context switching in parallel") Fixes: 6407cf533217 ("drm/i915/selftests: Stop using kthread_stop()") Link: https://patchwork.freedesktop.org/patch/msgid/20230605131135.396854-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 412fa1f097f48c8c1321806dd25e46618e0da147) Signed-off-by: Joonas Lahtinen commit d636fc5dd692c8f4e00ae6e0359c0eceeb5d9bdb Author: Eric Dumazet Date: Tue Jun 6 11:19:29 2023 +0000 net: sched: add rcu annotations around qdisc->qdisc_sleeping syzbot reported a race around qdisc->qdisc_sleeping [1] It is time we add proper annotations to reads and writes to/from qdisc->qdisc_sleeping. [1] BUG: KCSAN: data-race in dev_graft_qdisc / qdisc_lookup_rcu read to 0xffff8881286fc618 of 8 bytes by task 6928 on cpu 1: qdisc_lookup_rcu+0x192/0x2c0 net/sched/sch_api.c:331 __tcf_qdisc_find+0x74/0x3c0 net/sched/cls_api.c:1174 tc_get_tfilter+0x18f/0x990 net/sched/cls_api.c:2547 rtnetlink_rcv_msg+0x7af/0x8c0 net/core/rtnetlink.c:6386 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6413 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2503 ___sys_sendmsg net/socket.c:2557 [inline] __sys_sendmsg+0x1e3/0x270 net/socket.c:2586 __do_sys_sendmsg net/socket.c:2595 [inline] __se_sys_sendmsg net/socket.c:2593 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2593 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd write to 0xffff8881286fc618 of 8 bytes by task 6912 on cpu 0: dev_graft_qdisc+0x4f/0x80 net/sched/sch_generic.c:1115 qdisc_graft+0x7d0/0xb60 net/sched/sch_api.c:1103 tc_modify_qdisc+0x712/0xf10 net/sched/sch_api.c:1693 rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6395 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6413 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2503 ___sys_sendmsg net/socket.c:2557 [inline] __sys_sendmsg+0x1e3/0x270 net/socket.c:2586 __do_sys_sendmsg net/socket.c:2595 [inline] __se_sys_sendmsg net/socket.c:2593 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2593 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 6912 Comm: syz-executor.5 Not tainted 6.4.0-rc3-syzkaller-00190-g0d85b27b0cc6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/16/2023 Fixes: 3a7d0d07a386 ("net: sched: extend Qdisc with rcu") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Vlad Buslov Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit e3144ff52f7d2c884eef352cec9b9ff9acd2eb2f Merge: ab39b113e7475 5c3b74a92aa28 Author: David S. Miller Date: Wed Jun 7 10:09:05 2023 +0100 Merge branch 'rfs-lockless-annotate' Eric Dumazet says: ==================== rfs: annotate lockless accesses rfs runs without locks held, so we should annotate read and writes to shared variables. It should prevent compilers forcing writes in the following situation: if (var != val) var = val; A compiler could indeed simply avoid the conditional: var = val; This matters if var is shared between many cpus. v2: aligns one closing bracket (Simon) adds Fixes: tags (Jakub) ==================== Signed-off-by: David S. Miller commit 5c3b74a92aa285a3df722bf6329ba7ccf70346d6 Author: Eric Dumazet Date: Tue Jun 6 07:41:15 2023 +0000 rfs: annotate lockless accesses to RFS sock flow table Add READ_ONCE()/WRITE_ONCE() on accesses to the sock flow table. This also prevents a (smart ?) compiler to remove the condition in: if (table->ents[index] != newval) table->ents[index] = newval; We need the condition to avoid dirtying a shared cache line. Fixes: fec5e652e58f ("rfs: Receive Flow Steering") Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 1e5c647c3f6d4f8497dedcd226204e1880e0ffb3 Author: Eric Dumazet Date: Tue Jun 6 07:41:14 2023 +0000 rfs: annotate lockless accesses to sk->sk_rxhash Add READ_ONCE()/WRITE_ONCE() on accesses to sk->sk_rxhash. This also prevents a (smart ?) compiler to remove the condition in: if (sk->sk_rxhash != newval) sk->sk_rxhash = newval; We need the condition to avoid dirtying a shared cache line. Fixes: fec5e652e58f ("rfs: Receive Flow Steering") Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit bf06fcf4be0feefebd27deb8b60ad262f4230489 Author: Leon Romanovsky Date: Mon Jun 5 10:36:15 2023 +0300 xfrm: add missed call to delete offloaded policies Offloaded policies are deleted through two flows: netdev is going down and policy flush. In both cases, the code lacks relevant call to delete offloaded policy. Fixes: 919e43fad516 ("xfrm: add an interface to offload policy") Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit ab39b113e74751958aac1b125a14ee42bd7d3efd Merge: 20c47646a2602 75767213f3d9b Author: Jakub Kicinski Date: Tue Jun 6 21:36:57 2023 -0700 Merge tag 'for-net-2023-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fixes to debugfs registration - Fix use-after-free in hci_remove_ltk/hci_remove_irk - Fixes to ISO channel support - Fix missing checks for invalid L2CAP DCID - Fix l2cap_disconnect_req deadlock - Add lock to protect HCI_UNREGISTER * tag 'for-net-2023-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: L2CAP: Add missing checks for invalid DCID Bluetooth: ISO: use correct CIS order in Set CIG Parameters event Bluetooth: ISO: don't try to remove CIG if there are bound CIS left Bluetooth: Fix l2cap_disconnect_req deadlock Bluetooth: hci_qca: fix debugfs registration Bluetooth: fix debugfs registration Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk Bluetooth: ISO: Fix CIG auto-allocation to select configurable CIG Bluetooth: ISO: consider right CIS when removing CIG at cleanup ==================== Link: https://lore.kernel.org/r/20230606003454.2392552-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 20c47646a26026aa7d1a820eb5ebb4e1980cf552 Merge: e684ab76afebc 08e42a0d3ad30 Author: Jakub Kicinski Date: Tue Jun 6 21:23:49 2023 -0700 Merge tag 'nf-23-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Missing nul-check in basechain hook netlink dump path, from Gavrilov Ilia. 2) Fix bitwise register tracking, from Jeremy Sowden. 3) Null pointer dereference when accessing conntrack helper, from Tijs Van Buggenhout. 4) Add schedule point to ipset's call_ad, from Kuniyuki Iwashima. 5) Incorrect boundary check when building chain blob. * tag 'nf-23-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: out-of-bound check in chain blob netfilter: ipset: Add schedule point in call_ad(). netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper netfilter: nft_bitwise: fix register tracking netfilter: nf_tables: Add null check for nla_nest_start_noflag() in nft_dump_basechain_hook() ==================== Link: https://lore.kernel.org/r/20230606225851.67394-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit e684ab76afebcaccd428f7d55361d5669ccc3e2d Merge: accc1bf23068c f7e60032c6618 Author: Jakub Kicinski Date: Tue Jun 6 21:16:52 2023 -0700 Merge tag 'wireless-2023-06-06' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.4 Both rtw88 and rtw89 have a 802.11 powersave fix for a regression introduced in v6.0. mt76 fixes a race and a null pointer dereference. iwlwifi fixes an issue where not enough memory was allocated for a firmware event. And finally the stack has several smaller fixes all over. * tag 'wireless-2023-06-06' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211: fix locking in regulatory disconnect wifi: cfg80211: fix locking in sched scan stop work wifi: iwlwifi: mvm: Fix -Warray-bounds bug in iwl_mvm_wait_d3_notif() wifi: mac80211: fix switch count in EMA beacons wifi: mac80211: don't translate beacon/presp addrs wifi: mac80211: mlme: fix non-inheritence element wifi: cfg80211: reject bad AP MLD address wifi: mac80211: use correct iftype HE cap wifi: mt76: mt7996: fix possible NULL pointer dereference in mt7996_mac_write_txwi() wifi: rtw89: remove redundant check of entering LPS wifi: rtw89: correct PS calculation for SUPPORTS_DYNAMIC_PS wifi: rtw88: correct PS calculation for SUPPORTS_DYNAMIC_PS wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll ==================== Link: https://lore.kernel.org/r/20230606150817.EC133C433D2@smtp.kernel.org Signed-off-by: Jakub Kicinski commit accc1bf23068c1cdc4c2b015320ba856e210dd98 Author: Brett Creeley Date: Mon Jun 5 12:59:25 2023 -0700 virtio_net: use control_buf for coalesce params Commit 699b045a8e43 ("net: virtio_net: notifications coalescing support") added coalescing command support for virtio_net. However, the coalesce commands are using buffers on the stack, which is causing the device to see DMA errors. There should also be a complaint from check_for_stack() in debug_dma_map_xyz(). Fix this by adding and using coalesce params from the control_buf struct, which aligns with other commands. Cc: stable@vger.kernel.org Fixes: 699b045a8e43 ("net: virtio_net: notifications coalescing support") Reviewed-by: Shannon Nelson Signed-off-by: Allen Hubbe Signed-off-by: Brett Creeley Acked-by: Jason Wang Reviewed-by: Xuan Zhuo Acked-by: Michael S. Tsirkin Link: https://lore.kernel.org/r/20230605195925.51625-1-brett.creeley@amd.com Signed-off-by: Jakub Kicinski commit 4f48c30312b7af5365878ab191bb41e7b899e09b Author: Brett Creeley Date: Mon Jun 5 12:51:16 2023 -0700 pds_core: Fix FW recovery detection Commit 523847df1b37 ("pds_core: add devcmd device interfaces") included initial support for FW recovery detection. Unfortunately, the ordering in pdsc_is_fw_good() was incorrect, which was causing FW recovery to be undetected by the driver. Fix this by making sure to update the cached fw_status by calling pdsc_is_fw_running() before setting the local FW gen. Fixes: 523847df1b37 ("pds_core: add devcmd device interfaces") Signed-off-by: Shannon Nelson Signed-off-by: Brett Creeley Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230605195116.49653-1-brett.creeley@amd.com Signed-off-by: Jakub Kicinski commit 82a01ab35bd02ba4b0b4e12bc95c5b69240eb7b0 Author: Eric Dumazet Date: Mon Jun 5 16:16:47 2023 +0000 tcp: gso: really support BIG TCP We missed that tcp_gso_segment() was assuming skb->len was smaller than 65535 : oldlen = (u16)~skb->len; This part came with commit 0718bcc09b35 ("[NET]: Fix CHECKSUM_HW GSO problems.") This leads to wrong TCP checksum. Adapt the code to accept arbitrary packet length. v2: - use two csum_add() instead of csum_fold() (Alexander Duyck) - Change delta type to __wsum to reduce casts (Alexander Duyck) Fixes: 09f3d1a3a52c ("ipv6/gso: remove temporary HBH/jumbo header") Signed-off-by: Eric Dumazet Reviewed-by: Alexander Duyck Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230605161647.3624428-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 48bfd02569f5db49cc033f259e66d57aa6efc9a3 Author: Min Li Date: Fri May 26 21:01:31 2023 +0800 drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl If it is async, runqueue_node is freed in g2d_runqueue_worker on another worker thread. So in extreme cases, if g2d_runqueue_worker runs first, and then executes the following if statement, there will be use-after-free. Signed-off-by: Min Li Reviewed-by: Andi Shyti Signed-off-by: Inki Dae commit 4a059559809fd1ddbf16f847c4d2237309c08edf Author: Inki Dae Date: Fri May 19 08:55:05 2023 +0900 drm/exynos: vidi: fix a wrong error return Fix a wrong error return by dropping an error return. When vidi driver is remvoed, if ctx->raw_edid isn't same as fake_edid_info then only what we have to is to free ctx->raw_edid so that driver removing can work correctly - it's not an error case. Signed-off-by: Inki Dae Reviewed-by: Andi Shyti commit a2f4c143d76b1a47c91ef9bc46907116b111da0b Author: Kuniyuki Iwashima Date: Mon Jun 5 11:06:17 2023 -0700 ipv6: rpl: Fix Route of Death. A remote DoS vulnerability of RPL Source Routing is assigned CVE-2023-2156. The Source Routing Header (SRH) has the following format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Next Header | Hdr Ext Len | Routing Type | Segments Left | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | CmprI | CmprE | Pad | Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | . . . Addresses[1..n] . . . | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ The originator of an SRH places the first hop's IPv6 address in the IPv6 header's IPv6 Destination Address and the second hop's IPv6 address as the first address in Addresses[1..n]. The CmprI and CmprE fields indicate the number of prefix octets that are shared with the IPv6 Destination Address. When CmprI or CmprE is not 0, Addresses[1..n] are compressed as follows: 1..n-1 : (16 - CmprI) bytes n : (16 - CmprE) bytes Segments Left indicates the number of route segments remaining. When the value is not zero, the SRH is forwarded to the next hop. Its address is extracted from Addresses[n - Segment Left + 1] and swapped with IPv6 Destination Address. When Segment Left is greater than or equal to 2, the size of SRH is not changed because Addresses[1..n-1] are decompressed and recompressed with CmprI. OTOH, when Segment Left changes from 1 to 0, the new SRH could have a different size because Addresses[1..n-1] are decompressed with CmprI and recompressed with CmprE. Let's say CmprI is 15 and CmprE is 0. When we receive SRH with Segment Left >= 2, Addresses[1..n-1] have 1 byte for each, and Addresses[n] has 16 bytes. When Segment Left is 1, Addresses[1..n-1] is decompressed to 16 bytes and not recompressed. Finally, the new SRH will need more room in the header, and the size is (16 - 1) * (n - 1) bytes. Here the max value of n is 255 as Segment Left is u8, so in the worst case, we have to allocate 3825 bytes in the skb headroom. However, now we only allocate a small fixed buffer that is IPV6_RPL_SRH_WORST_SWAP_SIZE (16 + 7 bytes). If the decompressed size overflows the room, skb_push() hits BUG() below [0]. Instead of allocating the fixed buffer for every packet, let's allocate enough headroom only when we receive SRH with Segment Left 1. [0]: skbuff: skb_under_panic: text:ffffffff81c9f6e2 len:576 put:576 head:ffff8880070b5180 data:ffff8880070b4fb0 tail:0x70 end:0x140 dev:lo kernel BUG at net/core/skbuff.c:200! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 154 Comm: python3 Not tainted 6.4.0-rc4-00190-gc308e9ec0047 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:skb_panic (net/core/skbuff.c:200) Code: 4f 70 50 8b 87 bc 00 00 00 50 8b 87 b8 00 00 00 50 ff b7 c8 00 00 00 4c 8b 8f c0 00 00 00 48 c7 c7 80 6e 77 82 e8 ad 8b 60 ff <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90000003da0 EFLAGS: 00000246 RAX: 0000000000000085 RBX: ffff8880058a6600 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88807dc1c540 RDI: ffff88807dc1c540 RBP: ffffc90000003e48 R08: ffffffff82b392c8 R09: 00000000ffffdfff R10: ffffffff82a592e0 R11: ffffffff82b092e0 R12: ffff888005b1c800 R13: ffff8880070b51b8 R14: ffff888005b1ca18 R15: ffff8880070b5190 FS: 00007f4539f0b740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055670baf3000 CR3: 0000000005b0e000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: skb_push (net/core/skbuff.c:210) ipv6_rthdr_rcv (./include/linux/skbuff.h:2880 net/ipv6/exthdrs.c:634 net/ipv6/exthdrs.c:718) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5)) ip6_input_finish (./include/linux/rcupdate.h:805 net/ipv6/ip6_input.c:483) __netif_receive_skb_one_core (net/core/dev.c:5494) process_backlog (./include/linux/rcupdate.h:805 net/core/dev.c:5934) __napi_poll (net/core/dev.c:6496) net_rx_action (net/core/dev.c:6565 net/core/dev.c:6696) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) do_softirq (kernel/softirq.c:472 kernel/softirq.c:459) __local_bh_enable_ip (kernel/softirq.c:396) __dev_queue_xmit (net/core/dev.c:4272) ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:134) rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914) sock_sendmsg (net/socket.c:724 net/socket.c:747) __sys_sendto (net/socket.c:2144) __x64_sys_sendto (net/socket.c:2156 net/socket.c:2152 net/socket.c:2152) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) RIP: 0033:0x7f453a138aea Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffcc212a1c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007ffcc212a288 RCX: 00007f453a138aea RDX: 0000000000000060 RSI: 00007f4539084c20 RDI: 0000000000000003 RBP: 00007f4538308e80 R08: 00007ffcc212a300 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f4539712d1b Modules linked in: Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr") Reported-by: Max VA Closes: https://www.interruptlabs.co.uk/articles/linux-ipv6-route-of-death Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230605180617.67284-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 6eea63c7090b20ee41032d3e478e617b219d69aa Author: Erico Nunes Date: Tue Jun 6 16:32:47 2023 +0200 drm/lima: fix sched context destroy The drm sched entity must be flushed before finishing, to account for jobs potentially still in flight at that time. Lima did not do this flush until now, so switch the destroy call to the drm_sched_entity_destroy() wrapper which will take care of that. This fixes a regression on lima which started since the rework in commit 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") where some specific types of applications may hang indefinitely. Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") Reviewed-by: Vasily Khoruzhick Signed-off-by: Erico Nunes Signed-off-by: Qiang Yu Link: https://patchwork.freedesktop.org/patch/msgid/20230606143247.433018-1-nunes.erico@gmail.com commit f6ca5baf2a86d0eaff3859844da9e4e29ff750a7 Author: Jakub Kicinski Date: Mon Jun 5 16:32:57 2023 -0700 netlink: specs: ethtool: fix random typos Working on the code gen for C reveals typos in the ethtool spec as the compiler tries to find the names in the existing uAPI header. Fix the mistakes. Fixes: a353318ebf24 ("tools: ynl: populate most of the ethtool spec") Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20230605233257.843977-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 08e42a0d3ad30f276f9597b591f975971a1b0fcf Author: Pablo Neira Ayuso Date: Tue Jun 6 16:32:44 2023 +0200 netfilter: nf_tables: out-of-bound check in chain blob Add current size of rule expressions to the boundary check. Fixes: 2c865a8a28a1 ("netfilter: nf_tables: add rule blob layout") Signed-off-by: Pablo Neira Ayuso commit 24e227896bbf003165e006732dccb3516f87f88e Author: Kuniyuki Iwashima Date: Thu May 18 10:33:00 2023 -0700 netfilter: ipset: Add schedule point in call_ad(). syzkaller found a repro that causes Hung Task [0] with ipset. The repro first creates an ipset and then tries to delete a large number of IPs from the ipset concurrently: IPSET_ATTR_IPADDR_IPV4 : 172.20.20.187 IPSET_ATTR_CIDR : 2 The first deleting thread hogs a CPU with nfnl_lock(NFNL_SUBSYS_IPSET) held, and other threads wait for it to be released. Previously, the same issue existed in set->variant->uadt() that could run so long under ip_set_lock(set). Commit 5e29dc36bd5e ("netfilter: ipset: Rework long task execution when adding/deleting entries") tried to fix it, but the issue still exists in the caller with another mutex. While adding/deleting many IPs, we should release the CPU periodically to prevent someone from abusing ipset to hang the system. Note we need to increment the ipset's refcnt to prevent the ipset from being destroyed while rescheduling. [0]: INFO: task syz-executor174:268 blocked for more than 143 seconds. Not tainted 6.4.0-rc1-00145-gba79e9a73284 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor174 state:D stack:0 pid:268 ppid:260 flags:0x0000000d Call trace: __switch_to+0x308/0x714 arch/arm64/kernel/process.c:556 context_switch kernel/sched/core.c:5343 [inline] __schedule+0xd84/0x1648 kernel/sched/core.c:6669 schedule+0xf0/0x214 kernel/sched/core.c:6745 schedule_preempt_disabled+0x58/0xf0 kernel/sched/core.c:6804 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6fc/0xdb0 kernel/locking/mutex.c:747 __mutex_lock_slowpath+0x14/0x20 kernel/locking/mutex.c:1035 mutex_lock+0x98/0xf0 kernel/locking/mutex.c:286 nfnl_lock net/netfilter/nfnetlink.c:98 [inline] nfnetlink_rcv_msg+0x480/0x70c net/netfilter/nfnetlink.c:295 netlink_rcv_skb+0x1c0/0x350 net/netlink/af_netlink.c:2546 nfnetlink_rcv+0x18c/0x199c net/netfilter/nfnetlink.c:658 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x664/0x8cc net/netlink/af_netlink.c:1365 netlink_sendmsg+0x6d0/0xa4c net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x4b8/0x810 net/socket.c:2503 ___sys_sendmsg net/socket.c:2557 [inline] __sys_sendmsg+0x1f8/0x2a4 net/socket.c:2586 __do_sys_sendmsg net/socket.c:2595 [inline] __se_sys_sendmsg net/socket.c:2593 [inline] __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2593 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x84/0x270 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x134/0x24c arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193 el0_svc+0x2c/0x7c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Reported-by: syzkaller Fixes: a7b4f989a629 ("netfilter: ipset: IP set core support") Signed-off-by: Kuniyuki Iwashima Acked-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit e1f543dc660b44618a1bd72ddb4ca0828a95f7ad Author: Tijs Van Buggenhout Date: Thu May 25 12:25:26 2023 +0200 netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper An nf_conntrack_helper from nf_conn_help may become NULL after DNAT. Observed when TCP port 1720 (Q931_PORT), associated with h323 conntrack helper, is DNAT'ed to another destination port (e.g. 1730), while nfqueue is being used for final acceptance (e.g. snort). This happenned after transition from kernel 4.14 to 5.10.161. Workarounds: * keep the same port (1720) in DNAT * disable nfqueue * disable/unload h323 NAT helper $ linux-5.10/scripts/decode_stacktrace.sh vmlinux < /tmp/kernel.log BUG: kernel NULL pointer dereference, address: 0000000000000084 [..] RIP: 0010:nf_conntrack_update (net/netfilter/nf_conntrack_core.c:2080 net/netfilter/nf_conntrack_core.c:2134) nf_conntrack [..] nfqnl_reinject (net/netfilter/nfnetlink_queue.c:237) nfnetlink_queue nfqnl_recv_verdict (net/netfilter/nfnetlink_queue.c:1230) nfnetlink_queue nfnetlink_rcv_msg (net/netfilter/nfnetlink.c:241) nfnetlink [..] Fixes: ee04805ff54a ("netfilter: conntrack: make conntrack userspace helpers work again") Signed-off-by: Tijs Van Buggenhout Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 14e8b293903785590a0ef168745ac84250cb1f4c Author: Jeremy Sowden Date: Thu May 25 15:07:24 2023 +0100 netfilter: nft_bitwise: fix register tracking At the end of `nft_bitwise_reduce`, there is a loop which is intended to update the bitwise expression associated with each tracked destination register. However, currently, it just updates the first register repeatedly. Fix it. Fixes: 34cc9e52884a ("netfilter: nf_tables: cancel tracking for clobbered destination registers") Signed-off-by: Jeremy Sowden Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit bd058763a624a1fb5c20f3c46e632d623c043676 Author: Gavrilov Ilia Date: Wed May 24 12:25:27 2023 +0000 netfilter: nf_tables: Add null check for nla_nest_start_noflag() in nft_dump_basechain_hook() The nla_nest_start_noflag() function may fail and return NULL; the return value needs to be checked. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d54725cd11a5 ("netfilter: nf_tables: support for multiple devices per netdev hook") Signed-off-by: Gavrilov Ilia Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 69844e335d8c22454746c7903776533d8b4ab8fa Author: Yonghong Song Date: Tue Jun 6 10:22:02 2023 -0700 selftests/bpf: Fix sockopt_sk selftest Commit f4e4534850a9 ("net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report") fixed NETLINK_LIST_MEMBERSHIPS length report which caused selftest sockopt_sk failure. The failure log looks like test_sockopt_sk:PASS:join_cgroup /sockopt_sk 0 nsec run_test:PASS:skel_load 0 nsec run_test:PASS:setsockopt_link 0 nsec run_test:PASS:getsockopt_link 0 nsec getsetsockopt:FAIL:Unexpected NETLINK_LIST_MEMBERSHIPS value unexpected Unexpected NETLINK_LIST_MEMBERSHIPS value: actual 8 != expected 4 run_test:PASS:getsetsockopt 0 nsec #201 sockopt_sk:FAIL In net/netlink/af_netlink.c, function netlink_getsockopt(), for NETLINK_LIST_MEMBERSHIPS, nlk->ngroups equals to 36. Before Commit f4e4534850a9, the optlen is calculated as ALIGN(nlk->ngroups / 8, sizeof(u32)) = 4 After that commit, the optlen is ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32)) = 8 Fix the test by setting the expected optlen to be 8. Fixes: f4e4534850a9 ("net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report") Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230606172202.1606249-1-yhs@fb.com commit 981a37bab5e5f16137266d3f00cf2bd018af36ef Author: Chris Mason Date: Mon Jun 5 12:03:15 2023 -0700 btrfs: properly enable async discard when switching from RO->RW The async discard uses the BTRFS_FS_DISCARD_RUNNING bit in the fs_info to force discards off when the filesystem has aborted or we're generally not able to run discards. This gets flipped on when we're mounted rw, and also when we go from ro->rw. Commit 63a7cb13071842 ("btrfs: auto enable discard=async when possible") enabled async discard by default, and this meant "mount -o ro /dev/xxx /yyy" had async discards turned on. Unfortunately, this meant our check in btrfs_remount_cleanup() would see that discards are already on: /* If we toggled discard async */ if (!btrfs_raw_test_opt(old_opts, DISCARD_ASYNC) && btrfs_test_opt(fs_info, DISCARD_ASYNC)) btrfs_discard_resume(fs_info); So, we'd never call btrfs_discard_resume() when remounting the root filesystem from ro->rw. drgn shows this really nicely: import os import sys from drgn.helpers.linux.fs import path_lookup from drgn import NULL, Object, Type, cast def btrfs_sb(sb): return cast("struct btrfs_fs_info *", sb.s_fs_info) if len(sys.argv) == 1: path = "/" else: path = sys.argv[1] fs_info = cast("struct btrfs_fs_info *", path_lookup(prog, path).mnt.mnt_sb.s_fs_info) BTRFS_FS_DISCARD_RUNNING = 1 << prog['BTRFS_FS_DISCARD_RUNNING'] if fs_info.flags & BTRFS_FS_DISCARD_RUNNING: print("discard running flag is on") else: print("discard running flag is off") [root]# mount | grep nvme /dev/nvme0n1p3 on / type btrfs (rw,relatime,compress-force=zstd:3,ssd,discard=async,space_cache=v2,subvolid=5,subvol=/) [root]# ./discard_running.drgn discard running flag is off [root]# mount -o remount,discard=sync / [root]# mount -o remount,discard=async / [root]# ./discard_running.drgn discard running flag is on The fix is to call btrfs_discard_resume() when we're going from ro->rw. It already checks to make sure the async discard flag is on, so it'll do the right thing. Fixes: 63a7cb13071842 ("btrfs: auto enable discard=async when possible") CC: stable@vger.kernel.org # 6.3+ Reviewed-by: Boris Burkov Signed-off-by: Chris Mason Reviewed-by: David Sterba Signed-off-by: David Sterba commit 568a67e742dfa90b19a23305317164c5c350b71e Author: Andrew Powers-Holmes Date: Thu Jun 1 15:25:16 2023 +0200 arm64: dts: rockchip: Fix rk356x PCIe register and range mappings The register and range mappings for the PCIe controller in Rockchip's RK356x SoCs are incorrect. Replace them with corrected values from the vendor BSP sources, updated to match current DT schema. These values are also used in u-boot. Fixes: 66b51ea7d70f ("arm64: dts: rockchip: Add rk3568 PCIe2x1 controller") Cc: stable@vger.kernel.org Signed-off-by: Andrew Powers-Holmes Signed-off-by: Jonas Karlman Signed-off-by: Nicolas Frattaroli Tested-by: Diederik de Haas Link: https://lore.kernel.org/r/20230601132516.153934-1-frattaroli.nicolas@gmail.com Signed-off-by: Heiko Stuebner commit c5c31fb71f16ba75bad4ade208abbae225305b65 Author: Vladimir Oltean Date: Tue May 30 01:34:02 2023 +0300 spi: fsl-dspi: avoid SCK glitches with continuous transfers The DSPI controller has configurable timing for (a) tCSC: the interval between the assertion of the chip select and the first clock edge (b) tASC: the interval between the last clock edge and the deassertion of the chip select What is a bit surprising, but is documented in the figure "Example of continuous transfer (CPHA=1, CONT=1)" in the datasheet, is that when the chip select stays asserted between multiple TX FIFO writes, the tCSC and tASC times still apply. With CONT=1, chip select remains asserted, but SCK takes a break and goes to the idle state for tASC + tCSC ns. In other words, the default values (of 0 and 0 ns) result in SCK glitches where the SCK transition to the idle state, as well as the SCK transition from the idle state, will have no delay in between, and it may appear that a SCK cycle has simply gone missing. The resulting timing violation might cause data corruption in many peripherals, as their chip select is asserted. The driver has device tree bindings for tCSC ("fsl,spi-cs-sck-delay") and tASC ("fsl,spi-sck-cs-delay"), but these are only specified to apply when the chip select toggles in the first place, and this timing characteristic depends on each peripheral. Many peripherals do not have explicit timing requirements, so many device trees do not have these properties present at all. Nonetheless, the lack of SCK glitches is a common sense requirement, and since the SCK stays in the idle state during transfers for tCSC+tASC ns, and that in itself should look like half a cycle, then let's ensure that tCSC and tASC are at least a quarter of a SCK period, such that their sum is at least half of one. Fixes: 95bf15f38641 ("spi: fsl-dspi: Add ~50ns delay between cs and sck") Reported-by: Lisa Chen (陈敏捷) Debugged-by: Lisa Chen (陈敏捷) Tested-by: Lisa Chen (陈敏捷) Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230529223402.1199503-1-vladimir.oltean@nxp.com Signed-off-by: Mark Brown commit b752a385b584d385683c65cb76a1298f1379a88c Author: Chris Chiu Date: Tue Jun 6 22:57:47 2023 +0800 ALSA: hda/realtek: Enable 4 amplifiers instead of 2 on a HP platform In the commit 7bb62340951a ("ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform"), speakers and LEDs are fixed but only 2 CS35L41 amplifiers on SPI bus connected to Realtek codec are enabled. Need the ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED to get all amplifiers working. Signed-off-by: Chris Chiu Fixes: 7bb62340951a ("ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform") Cc: Link: https://lore.kernel.org/r/20230606145747.135966-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit 95ae9979bfe3174c2ee8d64409c44532f2881907 Author: Kent Gibson Date: Tue Jun 6 20:00:34 2023 +0800 gpio: sim: fix memory corruption when adding named lines and unnamed hogs When constructing the sim, gpio-sim constructs an array of named lines, sized based on the largest offset of any named line, and then initializes that array with the names of all lines, including unnamed hogs with higher offsets. In doing so it writes NULLs beyond the extent of the array. Add a check that only named lines are used to initialize the array. Fixes: cb8c474e79be ("gpio: sim: new testing module") Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit a4d7d701121981e3c3fe69ade376fe9f26324161 Merge: 0bdd0f0bf17c5 0c331fd1dccfb Author: Linus Torvalds Date: Tue Jun 6 06:18:28 2023 -0700 Merge tag 'spi-fix-v6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of driver specific fixes, none of them particularly remarkable or severe" * tag 'spi-fix-v6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: qup: Request DMA before enabling clocks spi: mt65xx: make sure operations completed before unloading spi: lpspi: disable lpspi module irq in DMA mode commit 08c9aa7c58e933787fa443389d540221ed9ed5cd Merge: 5c219a3408502 32cf0046a6521 Author: Takashi Iwai Date: Tue Jun 6 15:09:42 2023 +0200 Merge tag 'asoc-fix-v6.4-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.4 A lot of routine driver specific fixes here, nothing in the core though there are a couple of fixes for the generic cards. There's also a few new quirks for x86 platforms. commit 08425abbab9987ec48c78f418e61130b5dc9d22d Merge: 4a672d500bfd6 3aa0519a4780f Author: Arnd Bergmann Date: Tue Jun 6 15:05:30 2023 +0200 Merge tag 'ffa-fix-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A fix for v6.4 A single fix addressing another MBZ field being non-zero and non-compliant resulting in the rejection of certain memory interface transmissions by the receivers(secure partitions). The issue was addressed before but missed to address this one field which is part of this change. * tag 'ffa-fix-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Set handle field to zero in memory descriptor Link: https://lore.kernel.org/r/20230606125720.2816923-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 947c70a213769f60e9d5aca2bc88b50a1cfaf5a6 Author: Jiasheng Jiang Date: Tue Jun 6 17:38:59 2023 +0800 spi: cadence-quadspi: Add missing check for dma_set_mask Add check for dma_set_mask() and return the error if it fails. Fixes: 1a6f854f7daa ("spi: cadence-quadspi: Add Xilinx Versal external DMA support") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20230606093859.27818-1-jiasheng@iscas.ac.cn Signed-off-by: Mark Brown commit f7e60032c6618dfd643c7210d5cba2789e2de2e2 Author: Johannes Berg Date: Tue Jun 6 14:34:48 2023 +0200 wifi: cfg80211: fix locking in regulatory disconnect This should use wiphy_lock() now instead of requiring the RTNL, since __cfg80211_leave() via cfg80211_leave() is now requiring that lock to be held. Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver") Signed-off-by: Johannes Berg commit 3e54ed8247c94c8bdf370bd872bd9dfe72b1b12b Author: Johannes Berg Date: Tue Jun 6 14:34:47 2023 +0200 wifi: cfg80211: fix locking in sched scan stop work This should use wiphy_lock() now instead of acquiring the RTNL, since cfg80211_stop_sched_scan_req() now needs that. Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver") Signed-off-by: Johannes Berg commit 0bdd0f0bf17c5aac16f348ee4b1ebf23d1ec1649 Merge: 846b065da6460 fa58cc888d67e Author: Linus Torvalds Date: Tue Jun 6 05:49:06 2023 -0700 Merge tag 'gfs2-v6.4-rc4-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 fix from Andreas Gruenbacher: - Don't get stuck writing page onto itself under direct I/O * tag 'gfs2-v6.4-rc4-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Don't get stuck writing page onto itself under direct I/O commit 306320034e8fbe7ee1cc4f5269c55658b4612048 Author: Bernhard Seibold Date: Fri Jun 2 15:30:29 2023 +0200 serial: lantiq: add missing interrupt ack Currently, the error interrupt is never acknowledged, so once active it will stay active indefinitely, causing the handler to be called in an infinite loop. Fixes: 2f0fc4159a6a ("SERIAL: Lantiq: Add driver for MIPS Lantiq SOCs.") Cc: Signed-off-by: Bernhard Seibold Reviewed-by: Ilpo Järvinen Message-ID: <20230602133029.546-1-mail@bernhard-seibold.de> Signed-off-by: Greg Kroah-Hartman commit 411360257c1f4fccaa20143098b6d3fcc9d4e4dc Author: Stanislaw Gruszka Date: Thu Apr 13 08:38:10 2023 +0200 accel/ivpu: Reserve all non-command bo's using DMA_RESV_USAGE_BOOKKEEP Use DMA_RESV_USAGE_BOOKKEEP reservation for buffer objects, except for command buffers for which we use DMA_RESV_USAGE_WRITE (since VPU can write to command buffer context save area). Fixes: 0ec8671837a6 ("accel/ivpu: Fix S3 system suspend when not idle") Reviewed-by: Jeffrey Hugo Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20230413063810.3167511-1-stanislaw.gruszka@linux.intel.com commit 846b065da6460a4ac9d927e5511ce24901bf43ad Merge: fa56e0e44f658 fb109fba72840 Author: Linus Torvalds Date: Tue Jun 6 05:42:21 2023 -0700 Merge tag 'platform-drivers-x86-v6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: - various Microsoft Surface support fixes - one fix for the INT3472 driver * tag 'platform-drivers-x86-v6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: int3472: Avoid crash in unregistering regulator gpio platform/surface: aggregator_tabletsw: Add support for book mode in POS subsystem platform/surface: aggregator_tabletsw: Add support for book mode in KIP subsystem platform/surface: aggregator: Allow completion work-items to be executed in parallel platform/surface: aggregator: Make to_ssam_device_driver() respect constness commit 3aa0519a4780f1b8e11966bd879d4a2934ba455f Author: Balint Dobszay Date: Thu Jun 1 16:07:49 2023 +0200 firmware: arm_ffa: Set handle field to zero in memory descriptor As described in the commit 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors") some fields in the memory descriptor have to be zeroed explicitly. The handle field is one of these, but it was left out from that change, fix this now. Fixes: 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors") Reported-by: Imre Kis Signed-off-by: Balint Dobszay Link: https://lore.kernel.org/r/20230601140749.93812-1-balint.dobszay@arm.com Signed-off-by: Sudeep Holla commit 5c219a340850233aecbb444af964653ecd3d1370 Author: Takashi Iwai Date: Tue Jun 6 11:38:55 2023 +0200 ALSA: hda: Fix kctl->id initialization HD-audio core code replaces the kctl->id.index of SPDIF-related controls after assigning via snd_ctl_add(). This doesn't work any longer with the new Xarray lookup change. The change of the kctl->id content has to be done via snd_ctl_rename_id() helper, instead. Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230606093855.14685-5-tiwai@suse.de Signed-off-by: Takashi Iwai commit c5ae57b1bb99bd6f50b90428fabde397c2aeba0f Author: Takashi Iwai Date: Tue Jun 6 11:38:54 2023 +0200 ALSA: gus: Fix kctl->id initialization GUS driver replaces the kctl->id.index after assigning the kctl via snd_ctl_add(). This doesn't work any longer with the new Xarray lookup change. It has to be set before snd_ctl_add() call instead. Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230606093855.14685-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 Author: Takashi Iwai Date: Tue Jun 6 11:38:53 2023 +0200 ALSA: cmipci: Fix kctl->id initialization cmipci driver replaces the kctl->id.device after assigning the kctl via snd_ctl_add(). This doesn't work any longer with the new Xarray lookup change. It has to be set before snd_ctl_add() call instead. Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230606093855.14685-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit c9b83ae4a1609b1914ba7fc70826a3f3a8b234db Author: Takashi Iwai Date: Tue Jun 6 11:38:52 2023 +0200 ALSA: ymfpci: Fix kctl->id initialization ymfpci driver replaces the kctl->id.device after assigning the kctl via snd_ctl_add(). This doesn't work any longer with the new Xarray lookup change. It has to be set before snd_ctl_add() call instead. Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230606093855.14685-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 50d30040eb856ff6b0382b4d9dc332dc15597729 Author: Randy Dunlap Date: Thu May 25 21:45:19 2023 -0700 accel/ivpu: ivpu_ipc needs GENERIC_ALLOCATOR Drivers that use the gen_pool*() family of functions should select GENERIC_ALLOCATOR to prevent build errors like these: ld: drivers/accel/ivpu/ivpu_ipc.o: in function `gen_pool_free': include/linux/genalloc.h:172: undefined reference to `gen_pool_free_owner' ld: drivers/accel/ivpu/ivpu_ipc.o: in function `gen_pool_alloc_algo': include/linux/genalloc.h:138: undefined reference to `gen_pool_alloc_algo_owner' ld: drivers/accel/ivpu/ivpu_ipc.o: in function `gen_pool_free': include/linux/genalloc.h:172: undefined reference to `gen_pool_free_owner' ld: drivers/accel/ivpu/ivpu_ipc.o: in function `ivpu_ipc_init': drivers/accel/ivpu/ivpu_ipc.c:441: undefined reference to `devm_gen_pool_create' ld: drivers/accel/ivpu/ivpu_ipc.o: in function `gen_pool_add_virt': include/linux/genalloc.h:104: undefined reference to `gen_pool_add_owner' Fixes: 5d7422cfb498 ("accel/ivpu: Add IPC driver and JSM messages") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Link: https://lore.kernel.org/all/202305221206.1TaugDKP-lkp@intel.com/ Cc: Oded Gabbay Cc: dri-devel@lists.freedesktop.org Cc: Jacek Lawrynowicz Cc: Stanislaw Gruszka Cc: Andrzej Kacprowski Cc: Krystian Pradzynski Cc: Jeffrey Hugo Cc: Daniel Vetter Reviewed-by: Jeffrey Hugo Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20230526044519.13441-1-rdunlap@infradead.org commit 42510dffd0e2c27046905f742172ed6662af5557 Author: Manish Chopra Date: Mon Jun 5 16:56:00 2023 +0530 qed/qede: Fix scheduling while atomic Statistics read through bond interface via sysfs causes below bug and traces as it triggers the bonding module to collect the slave device statistics while holding the spinlock, beneath that qede->qed driver statistics flow gets scheduled out due to usleep_range() used in PTT acquire logic [ 3673.988874] Hardware name: HPE ProLiant DL365 Gen10 Plus/ProLiant DL365 Gen10 Plus, BIOS A42 10/29/2021 [ 3673.988878] Call Trace: [ 3673.988891] dump_stack_lvl+0x34/0x44 [ 3673.988908] __schedule_bug.cold+0x47/0x53 [ 3673.988918] __schedule+0x3fb/0x560 [ 3673.988929] schedule+0x43/0xb0 [ 3673.988932] schedule_hrtimeout_range_clock+0xbf/0x1b0 [ 3673.988937] ? __hrtimer_init+0xc0/0xc0 [ 3673.988950] usleep_range+0x5e/0x80 [ 3673.988955] qed_ptt_acquire+0x2b/0xd0 [qed] [ 3673.988981] _qed_get_vport_stats+0x141/0x240 [qed] [ 3673.989001] qed_get_vport_stats+0x18/0x80 [qed] [ 3673.989016] qede_fill_by_demand_stats+0x37/0x400 [qede] [ 3673.989028] qede_get_stats64+0x19/0xe0 [qede] [ 3673.989034] dev_get_stats+0x5c/0xc0 [ 3673.989045] netstat_show.constprop.0+0x52/0xb0 [ 3673.989055] dev_attr_show+0x19/0x40 [ 3673.989065] sysfs_kf_seq_show+0x9b/0xf0 [ 3673.989076] seq_read_iter+0x120/0x4b0 [ 3673.989087] new_sync_read+0x118/0x1a0 [ 3673.989095] vfs_read+0xf3/0x180 [ 3673.989099] ksys_read+0x5f/0xe0 [ 3673.989102] do_syscall_64+0x3b/0x90 [ 3673.989109] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3673.989115] RIP: 0033:0x7f8467d0b082 [ 3673.989119] Code: c0 e9 b2 fe ff ff 50 48 8d 3d ca 05 08 00 e8 35 e7 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 3673.989121] RSP: 002b:00007ffffb21fd08 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3673.989127] RAX: ffffffffffffffda RBX: 000000000100eca0 RCX: 00007f8467d0b082 [ 3673.989128] RDX: 00000000000003ff RSI: 00007ffffb21fdc0 RDI: 0000000000000003 [ 3673.989130] RBP: 00007f8467b96028 R08: 0000000000000010 R09: 00007ffffb21ec00 [ 3673.989132] R10: 00007ffffb27b170 R11: 0000000000000246 R12: 00000000000000f0 [ 3673.989134] R13: 0000000000000003 R14: 00007f8467b92000 R15: 0000000000045a05 [ 3673.989139] CPU: 30 PID: 285188 Comm: read_all Kdump: loaded Tainted: G W OE Fix this by collecting the statistics asynchronously from a periodic delayed work scheduled at default stats coalescing interval and return the recent copy of statisitcs from .ndo_get_stats64(), also add ability to configure/retrieve stats coalescing interval using below commands - ethtool -C ethx stats-block-usecs ethtool -c ethx Fixes: 133fac0eedc3 ("qede: Add basic ethtool support") Cc: Sudarsana Kalluru Cc: David Miller Signed-off-by: Manish Chopra Link: https://lore.kernel.org/r/20230605112600.48238-1-manishc@marvell.com Signed-off-by: Paolo Abeni commit fa56e0e44f658085262f536bbfdfff3374b8828d Merge: f8dba31b0a826 7c28afd5512e3 Author: Linus Torvalds Date: Tue Jun 6 04:36:02 2023 -0700 Merge tag 'for-linus-2023060501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fix from Jiri Kosina: - Final, confirmed fix for regression causing some devices connected via Logitech HID++ Unifying receiver take too long to initialize (Benjamin Tissoires) * tag 'for-linus-2023060501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: hidpp: terminate retry loop on success commit 7a4615b9a9da5225b22b36a20508555dd133ac24 Author: Gustavo A. R. Silva Date: Fri Jun 2 13:42:47 2023 -0600 wifi: iwlwifi: mvm: Fix -Warray-bounds bug in iwl_mvm_wait_d3_notif() kmemdup() at line 2735 is not duplicating enough memory for notif->tid_tear_down and notif->station_id. As it only duplicates 612 bytes: up to offsetofend(struct iwl_wowlan_info_notif, received_beacons), this is the range of [0, 612) bytes. 2735 notif = kmemdup(notif_v1, 2736 offsetofend(struct iwl_wowlan_info_notif, 2737 received_beacons), 2738 GFP_ATOMIC); which evidently does not cover bytes 612 and 613 for members tid_tear_down and station_id in struct iwl_wowlan_info_notif. See below: $ pahole -C iwl_wowlan_info_notif drivers/net/wireless/intel/iwlwifi/mvm/d3.o struct iwl_wowlan_info_notif { struct iwl_wowlan_gtk_status_v3 gtk[2]; /* 0 488 */ /* --- cacheline 7 boundary (448 bytes) was 40 bytes ago --- */ struct iwl_wowlan_igtk_status igtk[2]; /* 488 80 */ /* --- cacheline 8 boundary (512 bytes) was 56 bytes ago --- */ __le64 replay_ctr; /* 568 8 */ /* --- cacheline 9 boundary (576 bytes) --- */ __le16 pattern_number; /* 576 2 */ __le16 reserved1; /* 578 2 */ __le16 qos_seq_ctr[8]; /* 580 16 */ __le32 wakeup_reasons; /* 596 4 */ __le32 num_of_gtk_rekeys; /* 600 4 */ __le32 transmitted_ndps; /* 604 4 */ __le32 received_beacons; /* 608 4 */ u8 tid_tear_down; /* 612 1 */ u8 station_id; /* 613 1 */ u8 reserved2[2]; /* 614 2 */ /* size: 616, cachelines: 10, members: 13 */ /* last cacheline: 40 bytes */ }; Therefore, when the following assignments take place, actually no memory has been allocated for those objects: 2743 notif->tid_tear_down = notif_v1->tid_tear_down; 2744 notif->station_id = notif_v1->station_id; Fix this by allocating space for the whole notif object and zero out the remaining space in memory after member station_id. This also fixes the following -Warray-bounds issues: CC drivers/net/wireless/intel/iwlwifi/mvm/d3.o drivers/net/wireless/intel/iwlwifi/mvm/d3.c: In function ‘iwl_mvm_wait_d3_notif’: drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2743:30: warning: array subscript ‘struct iwl_wowlan_info_notif[0]’ is partly outside array bounds of ‘unsigned char[612]’ [-Warray-bounds=] 2743 | notif->tid_tear_down = notif_v1->tid_tear_down; | from drivers/net/wireless/intel/iwlwifi/mvm/d3.c:7: In function ‘kmemdup’, inlined from ‘iwl_mvm_wait_d3_notif’ at drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2735:12: include/linux/fortify-string.h:765:16: note: object of size 612 allocated by ‘__real_kmemdup’ 765 | return __real_kmemdup(p, size, gfp); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/intel/iwlwifi/mvm/d3.c: In function ‘iwl_mvm_wait_d3_notif’: drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2744:30: warning: array subscript ‘struct iwl_wowlan_info_notif[0]’ is partly outside array bounds of ‘unsigned char[612]’ [-Warray-bounds=] 2744 | notif->station_id = notif_v1->station_id; | ^~ In function ‘kmemdup’, inlined from ‘iwl_mvm_wait_d3_notif’ at drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2735:12: include/linux/fortify-string.h:765:16: note: object of size 612 allocated by ‘__real_kmemdup’ 765 | return __real_kmemdup(p, size, gfp); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ Link: https://github.com/KSPP/linux/issues/306 Fixes: 905d50ddbc83 ("wifi: iwlwifi: mvm: support wowlan info notification version 2") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Acked-by: Gregory Greenman Link: https://lore.kernel.org/r/ZHpGN555FwAKGduH@work Signed-off-by: Johannes Berg commit 1afa18e9e72396d1e1aedd6dbb34681f2413316b Author: Aditya Kumar Singh Date: Wed May 31 11:50:12 2023 +0530 wifi: mac80211: fix switch count in EMA beacons Currently, whenever an EMA beacon is formed, due to is_template argument being false from the caller, the switch count is always decremented once which is wrong. Also if switch count is equal to profile periodicity, this makes the switch count to reach till zero which triggers a WARN_ON_ONCE. [ 261.593915] CPU: 1 PID: 800 Comm: kworker/u8:3 Not tainted 5.4.213 #0 [ 261.616143] Hardware name: Qualcomm Technologies, Inc. IPQ9574 [ 261.622666] Workqueue: phy0 ath12k_get_link_bss_conf [ath12k] [ 261.629771] pstate: 60400005 (nZCv daif +PAN -UAO) [ 261.635595] pc : ieee80211_next_txq+0x1ac/0x1b8 [mac80211] [ 261.640282] lr : ieee80211_beacon_update_cntdwn+0x64/0xb4 [mac80211] [...] [ 261.729683] Call trace: [ 261.734986] ieee80211_next_txq+0x1ac/0x1b8 [mac80211] [ 261.737156] ieee80211_beacon_cntdwn_is_complete+0xa28/0x1194 [mac80211] [ 261.742365] ieee80211_beacon_cntdwn_is_complete+0xef4/0x1194 [mac80211] [ 261.749224] ieee80211_beacon_get_template_ema_list+0x38/0x5c [mac80211] [ 261.755908] ath12k_get_link_bss_conf+0xf8/0x33b4 [ath12k] [ 261.762590] ath12k_get_link_bss_conf+0x390/0x33b4 [ath12k] [ 261.767881] process_one_work+0x194/0x270 [ 261.773346] worker_thread+0x200/0x314 [ 261.777514] kthread+0x140/0x150 [ 261.781158] ret_from_fork+0x10/0x18 Fix this issue by making the is_template argument as true when fetching the EMA beacons. Fixes: bd54f3c29077 ("wifi: mac80211: generate EMA beacons in AP mode") Signed-off-by: Aditya Kumar Singh Link: https://lore.kernel.org/r/20230531062012.4537-1-quic_adisi@quicinc.com Signed-off-by: Johannes Berg commit 47c171a426e305f2225b92ed7b5e0a990c95f6d4 Author: Johannes Berg Date: Sun Jun 4 12:11:15 2023 +0300 wifi: mac80211: don't translate beacon/presp addrs Don't do link address translation for beacons and probe responses, this leads to reporting multiple scan list entries for the same AP (one with the MLD address) which just breaks things. We might need to extend this in the future for some other (action) frames that aren't MLD addressed. Fixes: 42fb9148c078 ("wifi: mac80211: do link->MLD address translation on RX") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230604120651.62adead1b43a.Ifc25eed26ebf3b269f60b1ec10060156d0e7ec0d@changeid Signed-off-by: Johannes Berg commit 68c228557d52616cf040651abefda9839de7086a Author: Johannes Berg Date: Sun Jun 4 12:11:16 2023 +0300 wifi: mac80211: mlme: fix non-inheritence element There were two bugs when creating the non-inheritence element: 1) 'at_extension' needs to be declared outside the loop, otherwise the value resets every iteration and we can never really switch properly 2) 'added' never got set to true, so we always cut off the extension element again at the end of the function This shows another issue that we might add a list but no extension list, but we need to make the extension list a zero-length one in that case. Fix all these issues. While at it, add a comment explaining the trim. Fixes: 81151ce462e5 ("wifi: mac80211: support MLO authentication/association with one link") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230604120651.3addaa5c4782.If3a78f9305997ad7ef4ba7ffc17a8234c956f613@changeid Signed-off-by: Johannes Berg commit 727073ca5e55ab6a07df316250be8a12606e8677 Author: Johannes Berg Date: Sun Jun 4 12:11:18 2023 +0300 wifi: cfg80211: reject bad AP MLD address When trying to authenticate, if the AP MLD address isn't a valid address, mac80211 can throw a warning. Avoid that by rejecting such addresses. Fixes: d648c23024bd ("wifi: nl80211: support MLO in auth/assoc") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230604120651.89188912bd1d.I8dbc6c8ee0cb766138803eec59508ef4ce477709@changeid Signed-off-by: Johannes Berg commit c37ab22bb1a43cdca8bf69cc0a22f1ccfc449e68 Author: Johannes Berg Date: Sun Jun 4 12:11:23 2023 +0300 wifi: mac80211: use correct iftype HE cap We already check that the right iftype capa exists, but then don't use it. Assign it to a variable so we can actually use it, and then do that. Fixes: bac2fd3d7534 ("mac80211: remove use of ieee80211_get_he_sta_cap()") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230604120651.0e908e5c5fdd.Iac142549a6144ac949ebd116b921a59ae5282735@changeid Signed-off-by: Johannes Berg commit 870611e4877eff1e8413c3fb92a585e45d5291f6 Author: Ilya Dryomov Date: Mon Jun 5 16:33:35 2023 +0200 rbd: get snapshot context after exclusive lock is ensured to be held Move capturing the snapshot context into the image request state machine, after exclusive lock is ensured to be held for the duration of dealing with the image request. This is needed to ensure correctness of fast-diff states (OBJECT_EXISTS vs OBJECT_EXISTS_CLEAN) and object deltas computed based off of them. Otherwise the object map that is forked for the snapshot isn't guaranteed to accurately reflect the contents of the snapshot when the snapshot is taken under I/O. This breaks differential backup and snapshot-based mirroring use cases with fast-diff enabled: since some object deltas may be incomplete, the destination image may get corrupted. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/61472 Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 09fe05c57b5aaf23e2c35036c98ea9f282b19a77 Author: Ilya Dryomov Date: Mon Jun 5 16:33:35 2023 +0200 rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting Move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting into the object request state machine to allow for the snapshot context to be captured in the image request state machine rather than in rbd_queue_workfn(). Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit b9a4efd61b6b9f62f83752959e75a5dae20624fa Author: Jaroslav Kysela Date: Tue Jun 6 09:31:22 2023 +0200 ALSA: ice1712,ice1724: fix the kcontrol->id initialization The new xarray lookup code requires to know complete kcontrol->id before snd_ctl_add() call. Reorder the code to make the initialization properly. Cc: stable@kernel.org # v5.19+ Reported-by: Martin Zidek Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230606073122.597491-1-perex@perex.cz Signed-off-by: Takashi Iwai commit 75767213f3d9b97f63694d02260b6a49a2271876 Author: Sungwoo Kim Date: Sat Jun 3 08:28:09 2023 -0400 Bluetooth: L2CAP: Add missing checks for invalid DCID When receiving a connect response we should make sure that the DCID is within the valid range and that we don't already have another channel allocated for the same DCID. Missing checks may violate the specification (BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 3, Part A, Page 1046). Fixes: 40624183c202 ("Bluetooth: L2CAP: Add missing checks for invalid LE DCID") Signed-off-by: Sungwoo Kim Signed-off-by: Luiz Augusto von Dentz commit 71e9588435c38112d6a8686d3d8e7cc1de8fe22c Author: Pauli Virtanen Date: Thu Jun 1 09:34:45 2023 +0300 Bluetooth: ISO: use correct CIS order in Set CIG Parameters event The order of CIS handle array in Set CIG Parameters response shall match the order of the CIS_ID array in the command (Core v5.3 Vol 4 Part E Sec 7.8.97). We send CIS_IDs mainly in the order of increasing CIS_ID (but with "last" CIS first if it has fixed CIG_ID). In handling of the reply, we currently assume this is also the same as the order of hci_conn in hdev->conn_hash, but that is not true. Match the correct hci_conn to the correct handle by matching them based on the CIG+CIS combination. The CIG+CIS combination shall be unique for ISO_LINK hci_conn at state >= BT_BOUND, which we maintain in hci_le_set_cig_params. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 6c242c64a09e78349fb0a5f0a6f8076a3d7c0bb4 Author: Pauli Virtanen Date: Thu Jun 1 09:34:44 2023 +0300 Bluetooth: ISO: don't try to remove CIG if there are bound CIS left Consider existing BOUND & CONNECT state CIS to block CIG removal. Otherwise, under suitable timing conditions we may attempt to remove CIG while Create CIS is pending, which fails. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 02c5ea5246a44d6ffde0fddebfc1d56188052976 Author: Ying Hsu Date: Wed May 31 03:44:56 2023 +0000 Bluetooth: Fix l2cap_disconnect_req deadlock L2CAP assumes that the locks conn->chan_lock and chan->lock are acquired in the order conn->chan_lock, chan->lock to avoid potential deadlock. For example, l2sock_shutdown acquires these locks in the order: mutex_lock(&conn->chan_lock) l2cap_chan_lock(chan) However, l2cap_disconnect_req acquires chan->lock in l2cap_get_chan_by_scid first and then acquires conn->chan_lock before calling l2cap_chan_del. This means that these locks are acquired in unexpected order, which leads to potential deadlock: l2cap_chan_lock(c) mutex_lock(&conn->chan_lock) This patch releases chan->lock before acquiring the conn_chan_lock to avoid the potential deadlock. Fixes: a2a9339e1c9d ("Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}") Signed-off-by: Ying Hsu Signed-off-by: Luiz Augusto von Dentz commit 47c5d829a3e326b7395352a10fc8a6effe7afa15 Author: Johan Hovold Date: Wed May 31 10:57:59 2023 +0200 Bluetooth: hci_qca: fix debugfs registration Since commit 3e4be65eb82c ("Bluetooth: hci_qca: Add poweroff support during hci down for wcn3990"), the setup callback which registers the debugfs interface can be called multiple times. This specifically leads to the following error when powering on the controller: debugfs: Directory 'ibs' with parent 'hci0' already present! Add a driver flag to avoid trying to register the debugfs interface more than once. Fixes: 3e4be65eb82c ("Bluetooth: hci_qca: Add poweroff support during hci down for wcn3990") Cc: stable@vger.kernel.org # 4.20 Signed-off-by: Johan Hovold Signed-off-by: Luiz Augusto von Dentz commit fe2ccc6c29d53e14d3c8b3ddf8ad965a92e074ee Author: Johan Hovold Date: Wed May 31 10:57:58 2023 +0200 Bluetooth: fix debugfs registration Since commit ec6cef9cd98d ("Bluetooth: Fix SMP channel registration for unconfigured controllers") the debugfs interface for unconfigured controllers will be created when the controller is configured. There is however currently nothing preventing a controller from being configured multiple time (e.g. setting the device address using btmgmt) which results in failed attempts to register the already registered debugfs entries: debugfs: File 'features' in directory 'hci0' already present! debugfs: File 'manufacturer' in directory 'hci0' already present! debugfs: File 'hci_version' in directory 'hci0' already present! ... debugfs: File 'quirk_simultaneous_discovery' in directory 'hci0' already present! Add a controller flag to avoid trying to register the debugfs interface more than once. Fixes: ec6cef9cd98d ("Bluetooth: Fix SMP channel registration for unconfigured controllers") Cc: stable@vger.kernel.org # 4.0 Signed-off-by: Johan Hovold Signed-off-by: Luiz Augusto von Dentz commit 1857c19941c87eb36ad47f22a406be5dfe5eff9f Author: Zhengping Jiang Date: Wed May 24 17:11:58 2023 -0700 Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER When the HCI_UNREGISTER flag is set, no jobs should be scheduled. Fix potential race when HCI_UNREGISTER is set after the flag is tested in hci_cmd_sync_queue. Fixes: 0b94f2651f56 ("Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set") Signed-off-by: Zhengping Jiang Signed-off-by: Luiz Augusto von Dentz commit c5d2b6fa26b5b8386a9cc902cdece3a46bef2bd2 Author: Luiz Augusto von Dentz Date: Tue May 30 13:48:44 2023 -0700 Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk Similar to commit 0f7d9b31ce7a ("netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()"). We can not access k after kfree_rcu() call. Cc: stable@vger.kernel.org Signed-off-by: Min Li Signed-off-by: Luiz Augusto von Dentz commit e6a7a46b8636efe95c75bed63a57fc05c13feba4 Author: Pauli Virtanen Date: Sun May 21 15:48:29 2023 +0000 Bluetooth: ISO: Fix CIG auto-allocation to select configurable CIG Make CIG auto-allocation to select the first CIG_ID that is still configurable. Also use correct CIG_ID range (see Core v5.3 Vol 4 Part E Sec 7.8.97 p.2553). Previously, it would always select CIG_ID 0 regardless of anything, because cis_list with data.cis == 0xff (BT_ISO_QOS_CIS_UNSET) would not count any CIS. Since we are not adding CIS here, use find_cis instead. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 31c5f9164949347c9cb34f041a7e04fdc08b1b85 Author: Pauli Virtanen Date: Sun May 21 15:48:28 2023 +0000 Bluetooth: ISO: consider right CIS when removing CIG at cleanup When looking for CIS blocking CIG removal, consider only the CIS with the right CIG ID. Don't try to remove CIG with unset CIG ID. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 5647e53f7856bb39dae781fe26aa65a699e2fc9f Author: Dan Schatzberg Date: Thu Jun 1 11:38:19 2023 -0700 cgroup: Documentation: Clarify usage of memory limits The existing documentation refers to memory.high as the "main mechanism to control memory usage." This seems incorrect to me - memory.high can result in reclaim pressure which simply leads to stalls unless some external component observes and actions on it (e.g. systemd-oomd can be used for this purpose). While this is feasible, users are unaware of this interaction and are led to believe that memory.high alone is an effective mechanism for limiting memory. The documentation should recommend the use of memory.max as the effective way to enforce memory limits - it triggers reclaim and results in OOM kills by itself. Signed-off-by: Dan Schatzberg Acked-by: Johannes Weiner Acked-by: Chris Down Signed-off-by: Tejun Heo commit 8cfb98196cceec35416041c6b91212d2b99392e4 Author: Nitesh Shetty Date: Mon Jun 5 11:53:53 2023 +0530 null_blk: Fix: memory release when memory_backed=1 Memory/pages are not freed, when unloading nullblk driver. Steps to reproduce issue 1.free -h total used free shared buff/cache available Mem: 7.8Gi 260Mi 7.1Gi 3.0Mi 395Mi 7.3Gi Swap: 0B 0B 0B 2.modprobe null_blk memory_backed=1 3.dd if=/dev/urandom of=/dev/nullb0 oflag=direct bs=1M count=1000 4.modprobe -r null_blk 5.free -h total used free shared buff/cache available Mem: 7.8Gi 1.2Gi 6.1Gi 3.0Mi 398Mi 6.3Gi Swap: 0B 0B 0B Signed-off-by: Anuj Gupta Signed-off-by: Nitesh Shetty Link: https://lore.kernel.org/r/20230605062354.24785-1-nj.shetty@samsung.com Signed-off-by: Jens Axboe commit 132328e8e85174ea788faf8f627c33258c88fbad Author: Florian Westphal Date: Mon Jun 5 15:14:45 2023 +0200 bpf: netfilter: Add BPF_NETFILTER bpf_attach_type Andrii Nakryiko writes: And we currently don't have an attach type for NETLINK BPF link. Thankfully it's not too late to add it. I see that link_create() in kernel/bpf/syscall.c just bypasses attach_type check. We shouldn't have done that. Instead we need to add BPF_NETLINK attach type to enum bpf_attach_type. And wire all that properly throughout the kernel and libbpf itself. This adds BPF_NETFILTER and uses it. This breaks uabi but this wasn't in any non-rc release yet, so it should be fine. v2: check link_attack prog type in link_create too Fixes: 84601d6ee68a ("bpf: add bpf_link support for BPF_NETFILTER programs") Suggested-by: Andrii Nakryiko Signed-off-by: Florian Westphal Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/CAEf4BzZ69YgrQW7DHCJUT_X+GqMq_ZQQPBwopaJJVGFD5=d5Vg@mail.gmail.com/ Link: https://lore.kernel.org/bpf/20230605131445.32016-1-fw@strlen.de commit 7c28afd5512e371773dbb2bf95a31ed5625651d9 Author: Benjamin Tissoires Date: Mon Jun 5 18:56:36 2023 +0200 HID: hidpp: terminate retry loop on success It seems we forgot the normal case to terminate the retry loop, making us asking 3 times each command, which is probably a little bit too much. And remove the ugly "goto exit" that can be replaced by a simpler "break" Fixes: 586e8fede795 ("HID: logitech-hidpp: Retry commands when device is busy") Suggested-by: Mark Lord Tested-by: Mark Lord Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 917ac77846b907dfdbd878688a9a61236ad6c51e Author: Qu Wenruo Date: Fri May 26 20:30:20 2023 +0800 btrfs: subpage: fix a crash in metadata repair path [BUG] Test case btrfs/027 would crash with subpage (64K page size, 4K sectorsize) with the following dying messages: debug: map_length=16384 length=65536 type=metadata|raid6(0x104) assertion failed: map_length >= length, in fs/btrfs/volumes.c:8093 ------------[ cut here ]------------ kernel BUG at fs/btrfs/messages.c:259! Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: btrfs_assertfail+0x28/0x2c [btrfs] btrfs_map_repair_block+0x150/0x2b8 [btrfs] btrfs_repair_io_failure+0xd4/0x31c [btrfs] btrfs_read_extent_buffer+0x150/0x16c [btrfs] read_tree_block+0x38/0xbc [btrfs] read_tree_root_path+0xfc/0x1bc [btrfs] btrfs_get_root_ref.part.0+0xd4/0x3a8 [btrfs] open_ctree+0xa30/0x172c [btrfs] btrfs_mount_root+0x3c4/0x4a4 [btrfs] legacy_get_tree+0x30/0x60 vfs_get_tree+0x28/0xec vfs_kern_mount.part.0+0x90/0xd4 vfs_kern_mount+0x14/0x28 btrfs_mount+0x114/0x418 [btrfs] legacy_get_tree+0x30/0x60 vfs_get_tree+0x28/0xec path_mount+0x3e0/0xb64 __arm64_sys_mount+0x200/0x2d8 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0x60/0x11c do_el0_svc+0x38/0x98 el0_svc+0x40/0xa8 el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x190/0x194 Code: aa0403e2 b0fff060 91010000 959c2024 (d4210000) [CAUSE] In btrfs/027 we test RAID6 with missing devices, in this particular case, we're repairing a metadata at the end of a data stripe. But at btrfs_repair_io_failure(), we always pass a full PAGE for repair, and for subpage case this can cross stripe boundary and lead to the above BUG_ON(). This metadata repair code is always there, since the introduction of subpage support, but this can trigger BUG_ON() after the bio split ability at btrfs_map_bio(). [FIX] Instead of passing the old PAGE_SIZE, we calculate the correct length based on the eb size and page size for both regular and subpage cases. CC: stable@vger.kernel.org # 6.3+ Reviewed-by: Christoph Hellwig Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit da209f7a80dd633a32cbcbafe9e9f778933119c1 Author: Tim Crawford Date: Mon Jun 5 10:38:34 2023 -0600 ALSA: hda/realtek: Add quirk for Clevo NS50AU Fixes headset detection on Clevo NS50AU. Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20230605163834.24653-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit 811dd426a9b16cf61a86fdb12d5f5b983cbfb130 Author: Stefan Binding Date: Mon Jun 5 16:33:08 2023 +0100 ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41 Add support for Asus ROG 2024 models using CS35L41 SPI with Internal Boost. Signed-off-by: Stefan Binding Cc: Link: https://lore.kernel.org/r/20230605153308.448550-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 4a672d500bfd6bb87092c33d5a2572c3d0a1cf83 Author: Linus Walleij Date: Wed May 10 12:51:56 2023 +0200 ARM: dts: Fix erroneous ADS touchscreen polarities Several device tree files get the polarity of the pendown-gpios wrong: this signal is active low. Fix up all incorrect flags, so that operating systems can rely on the flag being correctly set. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230510105156.1134320-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit eeda0b71a7003aa13ef4f2720edc01f6783a909e Merge: 44b5814fbab41 6b0db163ff920 Author: Arnd Bergmann Date: Mon Jun 5 17:38:51 2023 +0200 Merge tag 'at91-fixes-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes for 6.4 It contains: - fix imbalanced reference counter for ethernet devices; without it system hangs after consecutive suspend/resume cycles; - fix debounce delay property for shutdown controller; the initial DT property is not what the driver expects. * tag 'at91-fixes-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc ARM: at91: pm: fix imbalanced reference counter for ethernet devices Link: https://lore.kernel.org/r/20230530105930.11621-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit 44b5814fbab412a34b350480b10110754f25e094 Merge: be02e1fc71d22 661a4f089317c Author: Arnd Bergmann Date: Mon Jun 5 17:37:28 2023 +0200 Merge tag 'qcom-arm64-fixes-for-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM64 DeviceTree fixes for 6.4 Register scheme for SM8550 LLCC is corrected to avoid using the wrong register offsets. SDRAM frequency for misidentified SC7180-lite boards is handled. The datatype for Soundwire interval on SM8550 is corrected. The resource controller on SC8280XP is added to the CPU cluster power-domain to get notified to send cached sleep and wake votes before going entering the lower power states. SA8155P power-domains that differ from what's inherited from the SM8150 DeviceTree are adjusted to make the platform boot again. Remoteproc firmware paths are corrected for Sony Xperia 10 IV. Cache properties are adjusted across a range of platforms, to meet changes in the binding. Panel compatibles are corrected for Xiaomi Mi Pad 5 Pro, to match binding. Invalid dai-cells are dropped from SC7280 devices, to match binding. The incorrect removal of "input-enable" from the LPASS pinctrl node of SC8280XP was reverted, to get dmic pins in the correct state again. The incorrect input-enable property is dropped from a msm8974, mdm9615 and apq8026 to resolve a range of DT validation warnings, incorrectly picked up through the ARM64 tree. * tag 'qcom-arm64-fixes-for-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: sm8550: Use the correct LLCC register scheme arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards arm64: dts: qcom: sm8550: use uint16 for Soundwire interval arm64: dts: qcom: Split out SA8155P and use correct RPMh power domains arm64: dts: qcom: sm6375-pdx225: Fix remoteproc firmware paths arm64: dts: qcom: add missing cache properties arm64: dts: qcom: use decimal for cache level arm64: dts: qcom: fix indentation ARM: dts: qcom: msm8974: remove superfluous "input-enable" ARM: dts: qcom: mdm9615: remove superfluous "input-enable" ARM: dts: qcom: apq8026: remove superfluous "input-enable" arm64: dts: qcom: sm8250-xiaomi-elish-csot: fix panel compatible arm64: dts: qcom: sm8250-xiaomi-elish-boe: fix panel compatible arm64: dts: qcom: sc7280-qcard: drop incorrect dai-cells from WCD938x SDW arm64: dts: qcom: sc7280-idp: drop incorrect dai-cells from WCD938x SDW arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes arm64: dts: qcom: sc8280xp: Revert "arm64: dts: qcom: sc8280xp: remove superfluous "input-enable"" Link: https://lore.kernel.org/r/20230601142659.2246348-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit be02e1fc71d2256f4657eb4ac9aadcee4354bc36 Merge: 1c278f8eba9b6 cbd77119b6355 Author: Arnd Bergmann Date: Mon Jun 5 17:35:28 2023 +0200 Merge tag 'qcom-driver-fixes-for-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fixes for 6.4 Error paths is corrected across icc-bwmon, rpmh-rsc, ramp_controller and rmtfs. The ice module is renamed qcom_ice, to avoid clashing with existing "ice" driver. SA8155P-specific RPMh power-domains are introduced to avoid the code trying to access resources that exists on SM8150, but not on SA8155P. Lastly, changes to the EDAC driver to fix an issue where the driver performs mmio based on the wrong register map. * tag 'qcom-driver-fixes-for-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: EDAC/qcom: Get rid of hardcoded register offsets EDAC/qcom: Remove superfluous return variable assignment in qcom_llcc_core_setup() dt-bindings: cache: qcom,llcc: Fix SM8550 description soc: qcom: rpmhpd: Add SA8155P power domains dt-bindings: power: qcom,rpmpd: Add SA8155P soc: qcom: Rename ice to qcom_ice to avoid module name conflict soc: qcom: rmtfs: Fix error code in probe() soc: qcom: ramp_controller: Fix an error handling path in qcom_ramp_controller_probe() soc: qcom: rpmh-rsc: drop redundant unsigned >=0 comparision soc: qcom: icc-bwmon: fix incorrect error code passed to dev_err_probe() Link: https://lore.kernel.org/r/20230601141058.2246039-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 1c278f8eba9b6fed8290beb5c4aa8d90619c782f Merge: 7877cb91f1081 925a80af6106a Author: Arnd Bergmann Date: Mon Jun 5 17:34:35 2023 +0200 Merge tag 'qcom-dts-fixes-for-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM32 fix for 6.4 A range of 32-bit Qualcomm platforms are missing cache-unified, which is now required by the binding, this is now corrected. * tag 'qcom-dts-fixes-for-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: add missing cache properties Link: https://lore.kernel.org/r/20230601140347.2245680-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit f8dba31b0a826e691949cd4fdfa5c30defaac8c5 Merge: 9561de3a55bed c3d03e8e35e00 Author: Linus Torvalds Date: Mon Jun 5 11:31:36 2023 -0400 Merge tag 'asym-keys-fix-for-linus-v6.4-rc5' of https://github.com/robertosassu/linux Pull asymmetric keys fix from Roberto Sassu: "Here is a small fix to make an unconditional copy of the buffer passed to crypto operations, to take into account the case of the stack not in the linear mapping area. It has been tested and verified to fix the bug" Acked-by: Herbert Xu Acked-by: David Howells * tag 'asym-keys-fix-for-linus-v6.4-rc5' of https://github.com/robertosassu/linux: KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() commit ad24919540fb4df83981d469b5253cc1aecca939 Author: Richard Fitzgerald Date: Mon Jun 5 15:32:38 2023 +0100 firmware: cs_dsp: Log correct region name in bin error messages In cs_dsp_load_coeff() region_name should be set in the XM/YM/ZM cases otherwise any errors will log the region as "Unknown". While doing this also change one error message that logged the region type ID to log the region_name instead. This makes it consistent with other messages in the same function. Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20230605143238.4001982-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit fb928170e32ebf4f983db7ea64901b1ea19ceadf Merge: 9bc0097347745 77e4b94a3de69 Author: David S. Miller Date: Mon Jun 5 15:15:57 2023 +0100 Merge branch 'mptcp-addr-adv-fixes' Mat Martineau says: ==================== mptcp: Fixes for address advertisement Patches 1 and 2 allow address advertisements to be removed without affecting current connected subflows, and updates associated self tests. Patches 3 and 4 correctly track (and allow removal of) addresses that were implicitly announced as part of subflow creation. Also updates associated self tests. Patch 5 makes subflow and address announcement counters work consistently between the userspace and in-kernel path managers. ==================== Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 77e4b94a3de692a09b79945ecac5b8e6b77f10c1 Author: Geliang Tang Date: Sun Jun 4 20:25:21 2023 -0700 mptcp: update userspace pm infos Increase pm subflows counter on both server side and client side when userspace pm creates a new subflow, and decrease the counter when it closes a subflow. Increase add_addr_signaled counter in mptcp_nl_cmd_announce() when the address is announced by userspace PM. This modification is similar to how the in-kernel PM is updating the counter: when additional subflows are created/removed. Fixes: 9ab4807c84a4 ("mptcp: netlink: Add MPTCP_PM_CMD_ANNOUNCE") Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/329 Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 6c160b636c91e71e50c39134f78257cc35305ff0 Author: Geliang Tang Date: Sun Jun 4 20:25:20 2023 -0700 selftests: mptcp: update userspace pm subflow tests To align with what is done by the in-kernel PM, update userspace pm subflow selftests, by sending the a remove_addrs command together before the remove_subflows command. This will get a RM_ADDR in chk_rm_nr(). Fixes: d9a4594edabf ("mptcp: netlink: Add MPTCP_PM_CMD_REMOVE") Fixes: 5e986ec46874 ("selftests: mptcp: userspace pm subflow tests") Link: https://github.com/multipath-tcp/mptcp_net-next/issues/379 Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 24430f8bf51655c5ab7ddc2fafe939dd3cd0dd47 Author: Geliang Tang Date: Sun Jun 4 20:25:19 2023 -0700 mptcp: add address into userspace pm list Add the address into userspace_pm_local_addr_list when the subflow is created. Make sure it can be found in mptcp_nl_cmd_remove(). And delete it in the new helper mptcp_userspace_pm_delete_local_addr(). By doing this, the "REMOVE" command also works with subflows that have been created via the "SUB_CREATE" command instead of restricting to the addresses that have been announced via the "ANNOUNCE" command. Fixes: d9a4594edabf ("mptcp: netlink: Add MPTCP_PM_CMD_REMOVE") Link: https://github.com/multipath-tcp/mptcp_net-next/issues/379 Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 48d73f609dcceeb563b0d960e59bf0362581e39c Author: Geliang Tang Date: Sun Jun 4 20:25:18 2023 -0700 selftests: mptcp: update userspace pm addr tests This patch is linked to the previous commit ("mptcp: only send RM_ADDR in nl_cmd_remove"). To align with what is done by the in-kernel PM, update userspace pm addr selftests, by sending a remove_subflows command together after the remove_addrs command. Fixes: d9a4594edabf ("mptcp: netlink: Add MPTCP_PM_CMD_REMOVE") Fixes: 97040cf9806e ("selftests: mptcp: userspace pm address tests") Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 8b1c94da1e481090f24127b2c420b0c0b0421ce3 Author: Geliang Tang Date: Sun Jun 4 20:25:17 2023 -0700 mptcp: only send RM_ADDR in nl_cmd_remove The specifications from [1] about the "REMOVE" command say: Announce that an address has been lost to the peer It was then only supposed to send a RM_ADDR and not trying to delete associated subflows. A new helper mptcp_pm_remove_addrs() is then introduced to do just that, compared to mptcp_pm_remove_addrs_and_subflows() also removing subflows. To delete a subflow, the userspace daemon can use the "SUB_DESTROY" command, see mptcp_nl_cmd_sf_destroy(). Fixes: d9a4594edabf ("mptcp: netlink: Add MPTCP_PM_CMD_REMOVE") Link: https://github.com/multipath-tcp/mptcp/blob/mptcp_v0.96/include/uapi/linux/mptcp.h [1] Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 2d6f2f79e06571d41eb1223abebe9097511c9544 Author: Jouni Högander Date: Tue May 30 13:16:49 2023 +0300 drm/i915: Use 18 fast wake AUX sync len HW default for wake sync pulses is 18. 10 precharge and 8 preamble. There is no reason to change this especially as it is causing problems with certain eDP panels. v3: Change "Fixes:" commit v2: Remove "fast wake" repeat from subject Signed-off-by: Jouni Högander Fixes: e1c71f8f9180 ("drm/i915: Fix fast wake AUX sync len") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8475 Reviewed-by: Luca Coelho Link: https://patchwork.freedesktop.org/patch/msgid/20230530101649.2549949-1-jouni.hogander@intel.com (cherry picked from commit b29a20f7c4995a059ed764ce42389857426397c7) Signed-off-by: Joonas Lahtinen commit cb2e701305f4ffe3a107c1d97f8588b4ed48ccb3 Author: Chaitanya Kumar Borah Date: Mon May 29 11:37:47 2023 +0530 drm/i915/display: Set correct voltage level for 480MHz CDCLK According to Bspec, the voltage level for 480MHz is to be set as 1 instead of 2. BSpec: 49208 Fixes: 06f1b06dc5b7 ("drm/i915/display: Add 480 MHz CDCLK steps for RPL-U") v2: rebase Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Mika Kahola Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20230529060747.3972259-1-chaitanya.kumar.borah@intel.com (cherry picked from commit 5a3c46b809d09f8ef59e2fbf2463b1c102aecbaa) Signed-off-by: Joonas Lahtinen commit 40023959dbab3c6ad56fa7213770e63d197b69fb Author: Andi Shyti Date: Fri May 26 14:41:38 2023 +0200 drm/i915/gt: Use the correct error value when kernel_context() fails kernel_context() returns an error pointer. Use pointer-error conversion functions to evaluate its return value, rather than checking for a '0' return. Fixes: eb5c10cbbc2f ("drm/i915: Remove I915_USER_PRIORITY_SHIFT") Reported-by: Dan Carpenter Signed-off-by: Andi Shyti Cc: Chris Wilson Cc: # v5.13+ Reviewed-by: Andrzej Hajda Acked-by: Tejas Upadhyay Link: https://patchwork.freedesktop.org/patch/msgid/20230526124138.2006110-1-andi.shyti@linux.intel.com (cherry picked from commit edad9ee94f17adc75d3b13ab51bbe3d615ce1e7e) Signed-off-by: Joonas Lahtinen commit 592295e61b5c51ea89fd1959932fd0f121f08c46 Merge: 9561de3a55bed 9f9666e65359d Author: Greg Kroah-Hartman Date: Mon Jun 5 12:55:06 2023 +0200 Merge tag 'thunderbolt-for-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v6.4-rc6 This includes following fixes for v6.4-rc6: - Fix DMA test driver to pass correct values when only RX or TX ring is used - Increase timeout when DisplayPort tunnel is established to cope with a VGA/DVI dongle connected to a dock - Do not enable CL states when BIOS connnection manager already created the tunnels - Correct the ring interrupt masking to work again in Intel hardware on resume from system sleep states. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Mask ring interrupt on Intel hardware as well thunderbolt: Do not touch CL state configuration during discovery thunderbolt: Increase DisplayPort Connection Manager handshake timeout thunderbolt: dma_test: Use correct value for absent rings when creating paths commit 9bc009734774549f8bb8d7e526ba10e70d751a7c Author: Bartosz Golaszewski Date: Fri Jun 2 21:04:55 2023 +0200 net: stmmac: dwmac-qcom-ethqos: fix a regression on EMAC < 3 We must not assign plat_dat->dwmac4_addrs unconditionally as for structures which don't set them, this will result in the core driver using zeroes everywhere and breaking the driver for older HW. On EMAC < 2 the address should remain NULL. Fixes: b68376191c69 ("net: stmmac: dwmac-qcom-ethqos: Add EMAC3 support") Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Reviewed-by: Siddharth Vadapalli Reviewed-by: Vinod Koul Signed-off-by: David S. Miller commit 5578d0a79b6430fa1543640dd6f2d397d0886ce7 Author: Marek Behún Date: Sun May 21 14:19:40 2023 +0200 i2c: mv64xxx: Fix reading invalid status value in atomic mode There seems to be a bug within the mv64xxx I2C controller, wherein the status register may not necessarily contain valid value immediately after the IFLG flag is set in the control register. My theory is that the controller: - first sets the IFLG in control register - then updates the status register - then raises an interrupt This may sometime cause weird bugs when in atomic mode, since in this mode we do not wait for an interrupt, but instead we poll the control register for IFLG and read status register immediately after. I encountered -ENXIO from mv64xxx_i2c_fsm() due to this issue when using this driver in atomic mode. Note that I've only seen this issue on Armada 385, I don't know whether other SOCs with this controller are also affected. Also note that this fix has been in U-Boot for over 4 years [1] without anybody complaining, so it should not cause regressions. [1] https://source.denx.de/u-boot/u-boot/-/commit/d50e29662f78 Fixes: 544a8d75f3d6 ("i2c: mv64xxx: Add atomic_xfer method to driver") Signed-off-by: Marek Behún Signed-off-by: Wolfram Sang commit d753693101881b9c17f04edc365cf6685c475ff1 Merge: cd2b8113c2e8b 628f725d3b090 Author: David S. Miller Date: Mon Jun 5 11:21:10 2023 +0100 Merge tag 'linux-can-fixes-for-6.4-20230605' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== this is a pull request of 3 patches for net/master. All 3 patches target the j1939 stack. The 1st patch is by Oleksij Rempel and fixes the error queue handling for (E)TP sessions that run into timeouts. The last 2 patches are by Fedor Pchelkin and fix a potential use-after-free in j1939_netdev_start() if j1939_can_rx_register() fails. ==================== Signed-off-by: David S. Miller commit 1acfc6e753ed978b36d722f54e57fe4d1e8a6ffa Author: David Zheng Date: Wed May 24 11:14:59 2023 -0700 i2c: designware: fix idx_write_cnt in read loop With IC_INTR_RX_FULL slave interrupt handler reads data in a loop until RX FIFO is empty. When testing with the slave-eeprom, each transaction has 2 bytes for address/index and 1 byte for value, the address byte can be written as data byte due to dropping STOP condition. In the test below, the master continuously writes to the slave, first 2 bytes are index, 3rd byte is value and follow by a STOP condition. i2c_write: i2c-3 #0 a=04b f=0000 l=3 [00-D1-D1] i2c_write: i2c-3 #0 a=04b f=0000 l=3 [00-D2-D2] i2c_write: i2c-3 #0 a=04b f=0000 l=3 [00-D3-D3] Upon receiving STOP condition slave eeprom would reset `idx_write_cnt` so next 2 bytes can be treated as buffer index for upcoming transaction. Supposedly the slave eeprom buffer would be written as EEPROM[0x00D1] = 0xD1 EEPROM[0x00D2] = 0xD2 EEPROM[0x00D3] = 0xD3 When CPU load is high the slave irq handler may not read fast enough, the interrupt status can be seen as 0x204 with both DW_IC_INTR_STOP_DET (0x200) and DW_IC_INTR_RX_FULL (0x4) bits. The slave device may see the transactions below. 0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x1594 : INTR_STAT=0x4 0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x1594 : INTR_STAT=0x4 0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x1594 : INTR_STAT=0x4 0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x1794 : INTR_STAT=0x204 0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x1790 : INTR_STAT=0x200 0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x1594 : INTR_STAT=0x4 0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x1594 : INTR_STAT=0x4 0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x1594 : INTR_STAT=0x4 After `D1` is received, read loop continues to read `00` which is the first bype of next index. Since STOP condition is ignored by the loop, eeprom buffer index increased to `D2` and `00` is written as value. So the slave eeprom buffer becomes EEPROM[0x00D1] = 0xD1 EEPROM[0x00D2] = 0x00 EEPROM[0x00D3] = 0xD3 The fix is to use `FIRST_DATA_BYTE` (bit 11) in `IC_DATA_CMD` to split the transactions. The first index byte in this case would have bit 11 set. Check this indication to inject I2C_SLAVE_WRITE_REQUESTED event which will reset `idx_write_cnt` in slave eeprom. Signed-off-by: David Zheng Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit cd2b8113c2e8b9f5a88a942e1eaca61eba401b85 Author: Eric Dumazet Date: Fri Jun 2 12:37:47 2023 +0000 net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values We got multiple syzbot reports, all duplicates of the following [1] syzbot managed to install fq_pie with a zero TCA_FQ_PIE_QUANTUM, thus triggering infinite loops. Use limits similar to sch_fq, with commits 3725a269815b ("pkt_sched: fq: avoid hang when quantum 0") and d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM") [1] watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [swapper/0:0] Modules linked in: irq event stamp: 172817 hardirqs last enabled at (172816): [] __el1_irq arch/arm64/kernel/entry-common.c:476 [inline] hardirqs last enabled at (172816): [] el1_interrupt+0x58/0x68 arch/arm64/kernel/entry-common.c:486 hardirqs last disabled at (172817): [] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline] hardirqs last disabled at (172817): [] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486 softirqs last enabled at (167634): [] softirq_handle_end kernel/softirq.c:414 [inline] softirqs last enabled at (167634): [] __do_softirq+0xac0/0xd54 kernel/softirq.c:600 softirqs last disabled at (167701): [] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : fq_pie_qdisc_dequeue+0x10c/0x8ac net/sched/sch_fq_pie.c:246 lr : fq_pie_qdisc_dequeue+0xe4/0x8ac net/sched/sch_fq_pie.c:240 sp : ffff800008007210 x29: ffff800008007280 x28: ffff0000c86f7890 x27: ffff0000cb20c2e8 x26: ffff0000cb20c2f0 x25: dfff800000000000 x24: ffff0000cb20c2e0 x23: ffff0000c86f7880 x22: 0000000000000040 x21: 1fffe000190def10 x20: ffff0000cb20c2e0 x19: ffff0000cb20c2e0 x18: ffff800008006e60 x17: 0000000000000000 x16: ffff80000850af6c x15: 0000000000000302 x14: 0000000000000100 x13: 0000000000000000 x12: 0000000000000001 x11: 0000000000000302 x10: 0000000000000100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffff80000841c468 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0000cb20c2e0 x1 : ffff0000cb20c2e0 x0 : 0000000000000001 Call trace: fq_pie_qdisc_dequeue+0x10c/0x8ac net/sched/sch_fq_pie.c:246 dequeue_skb net/sched/sch_generic.c:292 [inline] qdisc_restart net/sched/sch_generic.c:397 [inline] __qdisc_run+0x1fc/0x231c net/sched/sch_generic.c:415 __dev_xmit_skb net/core/dev.c:3868 [inline] __dev_queue_xmit+0xc80/0x3318 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_connected_output+0x2f8/0x38c net/core/neighbour.c:1581 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0xd60/0x1a1c net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x538/0x8c8 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ndisc_send_skb+0xc30/0x1790 net/ipv6/ndisc.c:508 ndisc_send_rs+0x47c/0x5d4 net/ipv6/ndisc.c:718 addrconf_rs_timer+0x300/0x58c net/ipv6/addrconf.c:3936 call_timer_fn+0x19c/0x8cc kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x55c/0x734 kernel/time/timer.c:2022 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035 __do_softirq+0x2d0/0xd54 kernel/softirq.c:571 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:882 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:650 irq_exit_rcu+0x14/0x84 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:587 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:33 [inline] arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:55 cpuidle_idle_call kernel/sched/idle.c:170 [inline] do_idle+0x1f0/0x4e8 kernel/sched/idle.c:282 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:379 rest_init+0x2dc/0x2f4 init/main.c:735 start_kernel+0x0/0x55c init/main.c:834 start_kernel+0x3f0/0x55c init/main.c:1088 __primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:523 Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler") Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 7ebfd881abe9e0ea9557b29dab6aa28d294fabb4 Author: Simon Horman Date: Wed May 10 14:32:17 2023 +0200 i2c: mchp-pci1xxxx: Avoid cast to incompatible function type Rather than casting pci1xxxx_i2c_shutdown to an incompatible function type, update the type to match that expected by __devm_add_action. Reported by clang-16 with W-1: .../i2c-mchp-pci1xxxx.c:1159:29: error: cast from 'void (*)(struct pci1xxxx_i2c *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] ret = devm_add_action(dev, (void (*)(void *))pci1xxxx_i2c_shutdown, i2c); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/device.h:251:29: note: expanded from macro 'devm_add_action' __devm_add_action(release, action, data, #action) ^~~~~~ No functional change intended. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Horatiu Vultur Reviewed-by: Andi Shyti Reviewed-by: Tharun Kumar P Signed-off-by: Wolfram Sang commit 8110bf24c82d08aa2ed1d09a2b996d06c41f2e67 Author: Christian Heusel Date: Mon May 8 16:18:01 2023 +0200 i2c: img-scb: Fix spelling mistake "innacurate" -> "inaccurate" There is a spelling mistake in a comment. Fix it. Signed-off-by: Christian Heusel Signed-off-by: Wolfram Sang commit 63b679a962acc49a9e412d5c511da8e25bda598f Author: Andi Shyti Date: Fri Jun 2 03:21:00 2023 +0200 MAINTAINERS: Add myself as I2C host drivers maintainer I will help Wolfram out with the i2c controllers patches. Signed-off-by: Andi Shyti Acked-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 1a93f10c5b12bd766a537b24a50fca5373467303 Author: Sayed, Karimuddin Date: Fri Jun 2 14:38:12 2023 -0500 ALSA: hda/realtek: Add "Intel Reference board" and "NUC 13" SSID in the ALC256 Add "Intel Reference boad" and "Intel NUC 13" SSID in the alc256. Enable jack headset volume buttons Reviewed-by: Kai Vehmanen Signed-off-by: Sayed, Karimuddin Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230602193812.66768-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit 7ca4c8d4d3f41c2cd9b4cf22bb829bf03dac0956 Author: RenHai Date: Fri Jun 2 08:36:04 2023 +0800 ALSA: hda/realtek: Add Lenovo P3 Tower platform Headset microphone on this platform does not work without ALC897_FIXUP_HEADSET_MIC_PIN fixup. Signed-off-by: RenHai Cc: Link: https://lore.kernel.org/r/20230602003604.975892-1-kean0048@gmail.com Signed-off-by: Takashi Iwai commit 527c356b51f3ddee02c9ed5277538f85e30a2cdc Author: Ai Chao Date: Fri May 26 17:47:04 2023 +0800 ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 Add a quirk for HP Slim Desktop S01 to fixup headset MIC no presence. Signed-off-by: Ai Chao Cc: Link: https://lore.kernel.org/r/20230526094704.14597-1-aichao@kylinos.cn Signed-off-by: Takashi Iwai commit bd574889c25d2ed7e3d61d784c59a539a95f0167 Author: Mirsad Goran Todorovac Date: Wed May 24 21:15:29 2023 +0200 selftests: alsa: pcm-test: Fix compiler warnings about the format GCC 11.3.0 issues warnings in this module about wrong sizes of format specifiers: pcm-test.c: In function ‘test_pcm_time’: pcm-test.c:384:68: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 5 \ has type ‘unsigned int’ [-Wformat=] 384 | snprintf(msg, sizeof(msg), "rate mismatch %ld != %ld", rate, rrate); pcm-test.c:455:53: warning: format ‘%d’ expects argument of type ‘int’, but argument 4 has \ type ‘long int’ [-Wformat=] 455 | "expected %d, wrote %li", rate, frames); pcm-test.c:462:53: warning: format ‘%d’ expects argument of type ‘int’, but argument 4 has \ type ‘long int’ [-Wformat=] 462 | "expected %d, wrote %li", rate, frames); pcm-test.c:467:53: warning: format ‘%d’ expects argument of type ‘int’, but argument 4 has \ type ‘long int’ [-Wformat=] 467 | "expected %d, wrote %li", rate, frames); Simple fix according to compiler's suggestion removed the warnings. Signed-off-by: Mirsad Goran Todorovac Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20230524191528.13203-1-mirsad.todorovac@alu.unizg.hr Signed-off-by: Takashi Iwai commit 628f725d3b090fadcc3735aaf4332e778335188e Merge: 2a84aea80e925 9f16eb106aa5f Author: Marc Kleine-Budde Date: Mon Jun 5 08:27:23 2023 +0200 Merge patch series "can: j1939: avoid possible use-after-free when j1939_can_rx_register fails" Fedor Pchelkin says: The patch series fixes a possible racy use-after-free scenario described in 2/2: if j1939_can_rx_register() fails then the concurrent thread may have already read the invalid priv structure. The 1/2 makes j1939_netdev_lock a mutex so that access to j1939_can_rx_register() can be serialized without changing GFP_KERNEL to GFP_ATOMIC inside can_rx_register(). This seems to be safe. Note that the patch series has been tested only via Syzkaller and not with a real device. Link: https://lore.kernel.org/r/20230526171910.227615-1-pchelkin@ispras.ru Signed-off-by: Marc Kleine-Budde commit 9f16eb106aa5fce15904625661312623ec783ed3 Author: Fedor Pchelkin Date: Fri May 26 20:19:10 2023 +0300 can: j1939: avoid possible use-after-free when j1939_can_rx_register fails Syzkaller reports the following failure: BUG: KASAN: use-after-free in kref_put include/linux/kref.h:64 [inline] BUG: KASAN: use-after-free in j1939_priv_put+0x25/0xa0 net/can/j1939/main.c:172 Write of size 4 at addr ffff888141c15058 by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.10.144-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 print_address_description.constprop.0+0x1c/0x220 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562 check_memory_region_inline mm/kasan/generic.c:186 [inline] check_memory_region+0x145/0x190 mm/kasan/generic.c:192 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_fetch_sub_release include/asm-generic/atomic-instrumented.h:220 [inline] __refcount_sub_and_test include/linux/refcount.h:272 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] kref_put include/linux/kref.h:64 [inline] j1939_priv_put+0x25/0xa0 net/can/j1939/main.c:172 j1939_sk_sock_destruct+0x44/0x90 net/can/j1939/socket.c:374 __sk_destruct+0x4e/0x820 net/core/sock.c:1784 rcu_do_batch kernel/rcu/tree.c:2485 [inline] rcu_core+0xb35/0x1a30 kernel/rcu/tree.c:2726 __do_softirq+0x289/0x9a3 kernel/softirq.c:298 asm_call_irq_on_stack+0x12/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xe0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x136/0x200 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1095 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 Allocated by task 1141: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc9/0xd0 mm/kasan/common.c:461 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:664 [inline] j1939_priv_create net/can/j1939/main.c:131 [inline] j1939_netdev_start+0x111/0x860 net/can/j1939/main.c:268 j1939_sk_bind+0x8ea/0xd30 net/can/j1939/socket.c:485 __sys_bind+0x1f2/0x260 net/socket.c:1645 __do_sys_bind net/socket.c:1656 [inline] __se_sys_bind net/socket.c:1654 [inline] __x64_sys_bind+0x6f/0xb0 net/socket.c:1654 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Freed by task 1141: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x112/0x170 mm/kasan/common.c:422 slab_free_hook mm/slub.c:1542 [inline] slab_free_freelist_hook+0xad/0x190 mm/slub.c:1576 slab_free mm/slub.c:3149 [inline] kfree+0xd9/0x3b0 mm/slub.c:4125 j1939_netdev_start+0x5ee/0x860 net/can/j1939/main.c:300 j1939_sk_bind+0x8ea/0xd30 net/can/j1939/socket.c:485 __sys_bind+0x1f2/0x260 net/socket.c:1645 __do_sys_bind net/socket.c:1656 [inline] __se_sys_bind net/socket.c:1654 [inline] __x64_sys_bind+0x6f/0xb0 net/socket.c:1654 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 It can be caused by this scenario: CPU0 CPU1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start() j1939_sk_bind(socket1, ndev0, ...) j1939_netdev_start() mutex_lock(&j1939_netdev_lock) j1939_priv_set(ndev0, priv) mutex_unlock(&j1939_netdev_lock) if (priv_new) kref_get(&priv_new->rx_kref) return priv_new; /* inside j1939_sk_bind() */ jsk->priv = priv j1939_can_rx_register(priv) // fails j1939_priv_set(ndev, NULL) kfree(priv) j1939_sk_sock_destruct() j1939_priv_put() // <- uaf To avoid this, call j1939_can_rx_register() under j1939_netdev_lock so that a concurrent thread cannot process j1939_priv before j1939_can_rx_register() returns. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Signed-off-by: Fedor Pchelkin Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Link: https://lore.kernel.org/r/20230526171910.227615-3-pchelkin@ispras.ru Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit cd9c790de2088b0d797dc4d244b4f174f9962554 Author: Fedor Pchelkin Date: Fri May 26 20:19:09 2023 +0300 can: j1939: change j1939_netdev_lock type to mutex It turns out access to j1939_can_rx_register() needs to be serialized, otherwise j1939_priv can be corrupted when parallel threads call j1939_netdev_start() and j1939_can_rx_register() fails. This issue is thoroughly covered in other commit which serializes access to j1939_can_rx_register(). Change j1939_netdev_lock type to mutex so that we do not need to remove GFP_KERNEL from can_rx_register(). j1939_netdev_lock seems to be used in normal contexts where mutex usage is not prohibited. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Suggested-by: Alexey Khoroshilov Signed-off-by: Fedor Pchelkin Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Link: https://lore.kernel.org/r/20230526171910.227615-2-pchelkin@ispras.ru Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit 2a84aea80e925ecba6349090559754f8e8eb68ef Author: Oleksij Rempel Date: Fri May 26 10:19:46 2023 +0200 can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket This patch addresses an issue within the j1939_sk_send_loop_abort() function in the j1939/socket.c file, specifically in the context of Transport Protocol (TP) sessions. Without this patch, when a TP session is initiated and a Clear To Send (CTS) frame is received from the remote side requesting one data packet, the kernel dispatches the first Data Transport (DT) frame and then waits for the next CTS. If the remote side doesn't respond with another CTS, the kernel aborts due to a timeout. This leads to the user-space receiving an EPOLLERR on the socket, and the socket becomes active. However, when trying to read the error queue from the socket with sock.recvmsg(, , socket.MSG_ERRQUEUE), it returns -EAGAIN, given that the socket is non-blocking. This situation results in an infinite loop: the user-space repeatedly calls epoll(), epoll() returns the socket file descriptor with EPOLLERR, but the socket then blocks on the recv() of ERRQUEUE. This patch introduces an additional check for the J1939_SOCK_ERRQUEUE flag within the j1939_sk_send_loop_abort() function. If the flag is set, it indicates that the application has subscribed to receive error queue messages. In such cases, the kernel can communicate the current transfer state via the error queue. This allows for the function to return early, preventing the unnecessary setting of the socket into an error state, and breaking the infinite loop. It is crucial to note that a socket error is only needed if the application isn't using the error queue, as, without it, the application wouldn't be aware of transfer issues. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Reported-by: David Jander Tested-by: David Jander Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20230526081946.715190-1-o.rempel@pengutronix.de Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit d4d12c02bf5f768f1b423c7ae2909c5afdfe0d5f Author: Dave Chinner Date: Mon Jun 5 14:48:15 2023 +1000 xfs: collect errors from inodegc for unlinked inode recovery Unlinked list recovery requires errors removing the inode the from the unlinked list get fed back to the main recovery loop. Now that we offload the unlinking to the inodegc work, we don't get errors being fed back when we trip over a corruption that prevents the inode from being removed from the unlinked list. This means we never clear the corrupt unlinked list bucket, resulting in runtime operations eventually tripping over it and shutting down. Fix this by collecting inodegc worker errors and feed them back to the flush caller. This is largely best effort - the only context that really cares is log recovery, and it only flushes a single inode at a time so we don't need complex synchronised handling. Essentially the inodegc workers will capture the first error that occurs and the next flush will gather them and clear them. The flush itself will only report the first gathered error. In the cases where callers can return errors, propagate the collected inodegc flush error up the error handling chain. In the case of inode unlinked list recovery, there are several superfluous calls to flush queued unlinked inodes - xlog_recover_iunlink_bucket() guarantees that it has flushed the inodegc and collected errors before it returns. Hence nothing in the calling path needs to run a flush, even when an error is returned. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 7dfee17b13e5024c5c0ab1911859ded4182de3e5 Author: Dave Chinner Date: Mon Jun 5 14:48:15 2023 +1000 xfs: validate block number being freed before adding to xefi Bad things happen in defered extent freeing operations if it is passed a bad block number in the xefi. This can come from a bogus agno/agbno pair from deferred agfl freeing, or just a bad fsbno being passed to __xfs_free_extent_later(). Either way, it's very difficult to diagnose where a null perag oops in EFI creation is coming from when the operation that queued the xefi has already been completed and there's no longer any trace of it around.... Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 3148ebf2c0782340946732bfaf3073d23ac833fa Author: Dave Chinner Date: Mon Jun 5 14:48:15 2023 +1000 xfs: validity check agbnos on the AGFL If the agfl or the indexing in the AGF has been corrupted, getting a block form the AGFL could return an invalid block number. If this happens, bad things happen. Check the agbno we pull off the AGFL and return -EFSCORRUPTED if we find somethign bad. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit e0a8de7da35e5b22b44fa1013ccc0716e17b0c14 Author: Dave Chinner Date: Mon Jun 5 14:48:15 2023 +1000 xfs: fix agf/agfl verification on v4 filesystems When a v4 filesystem has fl_last - fl_first != fl_count, we do not not detect the corruption and allow the AGF to be used as it if was fully valid. On V5 filesystems, we reset the AGFL to empty in these cases and avoid the corruption at a small cost of leaked blocks. If we don't catch the corruption on V4 filesystems, bad things happen later when an allocation attempts to trim the free list and either double-frees stale entries in the AGFl or tries to free NULLAGBNO entries. Either way, this is bad. Prevent this from happening by using the AGFL_NEED_RESET logic for v4 filesysetms, too. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 1e473279f492faf33ed3fbb3ecf8eec9f56b951c Author: Dave Chinner Date: Mon Jun 5 14:48:15 2023 +1000 xfs: fix double xfs_perag_rele() in xfs_filestream_pick_ag() xfs_bmap_longest_free_extent() can return an error when accessing the AGF fails. In this case, the behaviour of xfs_filestream_pick_ag() is conditional on the error. We may continue the loop, or break out of it. The error handling after the loop cleans up the perag reference held when the break occurs. If we continue, the next loop iteration handles cleaning up the perag reference. EIther way, we don't need to release the active perag reference when xfs_bmap_longest_free_extent() fails. Doing so means we do a double decrement on the active reference count, and this causes tha active reference count to fall to zero. At this point, new active references will fail. This leads to unmount hanging because it tries to grab active references to that perag, only for it to fail. This happens inside a loop that retries until a inode tree radix tree tag is cleared, which cannot happen because we can't get an active reference to the perag. The unmount livelocks in this path: xfs_reclaim_inodes+0x80/0xc0 xfs_unmount_flush_inodes+0x5b/0x70 xfs_unmountfs+0x5b/0x1a0 xfs_fs_put_super+0x49/0x110 generic_shutdown_super+0x7c/0x1a0 kill_block_super+0x27/0x50 deactivate_locked_super+0x30/0x90 deactivate_super+0x3c/0x50 cleanup_mnt+0xc2/0x160 __cleanup_mnt+0x12/0x20 task_work_run+0x5e/0xa0 exit_to_user_mode_prepare+0x1bc/0x1c0 syscall_exit_to_user_mode+0x16/0x40 do_syscall_64+0x40/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Reported-by: Pengfei Xu Fixes: eb70aa2d8ed9 ("xfs: use for_each_perag_wrap in xfs_filestream_pick_ag") Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 6be73cecb5a241309008d7fc4c47749e5324bfb0 Author: Darrick J. Wong Date: Mon Jun 5 14:48:12 2023 +1000 xfs: fix broken logic when detecting mergeable bmap records Commit 6bc6c99a944c was a well-intentioned effort to initiate consolidation of adjacent bmbt mapping records by setting the PREEN flag. Consolidation can only happen if the length of the combined record doesn't overflow the 21-bit blockcount field of the bmbt recordset. Unfortunately, the length test is inverted, leading to it triggering on data forks like these: EXT: FILE-OFFSET BLOCK-RANGE AG AG-OFFSET TOTAL 0: [0..16777207]: 76110848..92888055 0 (76110848..92888055) 16777208 1: [16777208..20639743]: 92888056..96750591 0 (92888056..96750591) 3862536 Note that record 0 has a length of 16777208 512b blocks. This corresponds to 2097151 4k fsblocks, which is the maximum. Hence the two records cannot be merged. However, the logic is still wrong even if we change the in-loop comparison, because the scope of our examination isn't broad enough inside the loop to detect mappings like this: 0: [0..9]: 76110838..76110847 0 (76110838..76110847) 10 1: [10..16777217]: 76110848..92888055 0 (76110848..92888055) 16777208 2: [16777218..20639753]: 92888056..96750591 0 (92888056..96750591) 3862536 These three records could be merged into two, but one cannot determine this purely from looking at records 0-1 or 1-2 in isolation. Hoist the mergability detection outside the loop, and base its decision making on whether or not a merged mapping could be expressed in fewer bmbt records. While we're at it, fix the incorrect return type of the iter function. Fixes: 336642f79283 ("xfs: alert the user about data/attr fork mappings that could be merged") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 4320f34666363e202f8c290869c2d78c1ce9f3f1 Author: Geert Uytterhoeven Date: Mon Jun 5 04:09:27 2023 +1000 xfs: Fix undefined behavior of shift into sign bit With gcc-5: In file included from ./include/trace/define_trace.h:102:0, from ./fs/xfs/scrub/trace.h:988, from fs/xfs/scrub/trace.c:40: ./fs/xfs/./scrub/trace.h: In function ‘trace_raw_output_xchk_fsgate_class’: ./fs/xfs/scrub/scrub.h:111:28: error: initializer element is not constant #define XREP_ALREADY_FIXED (1 << 31) /* checking our repair work */ ^ Shifting the (signed) value 1 into the sign bit is undefined behavior. Fix this for all definitions in the file by shifting "1U" instead of "1". This was exposed by the first user added in commit 466c525d6d35e691 ("xfs: minimize overhead of drain wakeups by using jump labels"). Fixes: 160b5a784525e8a4 ("xfs: hoist the already_fixed variable to the scrub context") Signed-off-by: Geert Uytterhoeven Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 82842fee6e5979ca7e2bf4d839ef890c22ffb7aa Author: Dave Chinner Date: Mon Jun 5 04:08:27 2023 +1000 xfs: fix AGF vs inode cluster buffer deadlock Lock order in XFS is AGI -> AGF, hence for operations involving inode unlinked list operations we always lock the AGI first. Inode unlinked list operations operate on the inode cluster buffer, so the lock order there is AGI -> inode cluster buffer. For O_TMPFILE operations, this now means the lock order set down in xfs_rename and xfs_link is AGI -> inode cluster buffer -> AGF as the unlinked ops are done before the directory modifications that may allocate space and lock the AGF. Unfortunately, we also now lock the inode cluster buffer when logging an inode so that we can attach the inode to the cluster buffer and pin it in memory. This creates a lock order of AGF -> inode cluster buffer in directory operations as we have to log the inode after we've allocated new space for it. This creates a lock inversion between the AGF and the inode cluster buffer. Because the inode cluster buffer is shared across multiple inodes, the inversion is not specific to individual inodes but can occur when inodes in the same cluster buffer are accessed in different orders. To fix this we need move all the inode log item cluster buffer interactions to the end of the current transaction. Unfortunately, xfs_trans_log_inode() calls are littered throughout the transactions with no thought to ordering against other items or locking. This makes it difficult to do anything that involves changing the call sites of xfs_trans_log_inode() to change locking orders. However, we do now have a mechanism that allows is to postpone dirty item processing to just before we commit the transaction: the ->iop_precommit method. This will be called after all the modifications are done and high level objects like AGI and AGF buffers have been locked and modified, thereby providing a mechanism that guarantees we don't lock the inode cluster buffer before those high level objects are locked. This change is largely moving the guts of xfs_trans_log_inode() to xfs_inode_item_precommit() and providing an extra flag context in the inode log item to track the dirty state of the inode in the current transaction. This also means we do a lot less repeated work in xfs_trans_log_inode() by only doing it once per transaction when all the work is done. Fixes: 298f7bec503f ("xfs: pin inode backing buffer to the inode log item") Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit cb042117488dbf0b3b38b05771639890fada9a52 Author: Dave Chinner Date: Mon Jun 5 04:07:27 2023 +1000 xfs: defered work could create precommits To fix a AGI-AGF-inode cluster buffer deadlock, we need to move inode cluster buffer operations to the ->iop_precommit() method. However, this means that deferred operations can require precommits to be run on the final transaction that the deferred ops pass back to xfs_trans_commit() context. This will be exposed by attribute handling, in that the last changes to the inode in the attr set state machine "disappear" because the precommit operation is not run. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 00dcd17cfa7f103f7d640ffd34645a2ddab96330 Author: Dave Chinner Date: Mon Jun 5 04:06:27 2023 +1000 xfs: restore allocation trylock iteration It was accidentally dropped when refactoring the allocation code, resulting in the AG iteration always doing blocking AG iteration. This results in a small performance regression for a specific fsmark test that runs more user data writer threads than there are AGs. Reported-by: kernel test robot Fixes: 2edf06a50f5b ("xfs: factor xfs_alloc_vextent_this_ag() for _iterate_ags()") Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 89a4bf0dc3857569a77061d3d5ea2ac85f7e13c6 Author: Dave Chinner Date: Mon Jun 5 04:05:27 2023 +1000 xfs: buffer pins need to hold a buffer reference When a buffer is unpinned by xfs_buf_item_unpin(), we need to access the buffer after we've dropped the buffer log item reference count. This opens a window where we can have two racing unpins for the buffer item (e.g. shutdown checkpoint context callback processing racing with journal IO iclog completion processing) and both attempt to access the buffer after dropping the BLI reference count. If we are unlucky, the "BLI freed" context wins the race and frees the buffer before the "BLI still active" case checks the buffer pin count. This results in a use after free that can only be triggered in active filesystem shutdown situations. To fix this, we need to ensure that buffer existence extends beyond the BLI reference count checks and until the unpin processing is complete. This implies that a buffer pin operation must also take a buffer reference to ensure that the buffer cannot be freed until the buffer unpin processing is complete. Reported-by: yangerkun Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 9561de3a55bed6bdd44a12820ba81ec416e705a7 Author: Linus Torvalds Date: Sun Jun 4 14:04:27 2023 -0400 Linux 6.4-rc5 commit 0c2f9acf6ae74118385f7a7d48f4b2d93637b628 Author: Reiji Watanabe Date: Fri Jun 2 19:50:35 2023 -0700 KVM: arm64: PMU: Don't overwrite PMUSERENR with vcpu loaded Currently, with VHE, KVM sets ER, CR, SW and EN bits of PMUSERENR_EL0 to 1 on vcpu_load(), and saves and restores the register value for the host on vcpu_load() and vcpu_put(). If the value of those bits are cleared on a pCPU with a vCPU loaded (armv8pmu_start() would do that when PMU counters are programmed for the guest), PMU access from the guest EL0 might be trapped to the guest EL1 directly regardless of the current PMUSERENR_EL0 value of the vCPU. Fix this by not letting armv8pmu_start() overwrite PMUSERENR_EL0 on the pCPU where PMUSERENR_EL0 for the guest is loaded, and instead updating the saved shadow register value for the host so that the value can be restored on vcpu_put() later. While vcpu_{put,load}() are manipulating PMUSERENR_EL0, disable IRQs to prevent a race condition between these processes and IPIs that attempt to update PMUSERENR_EL0 for the host EL0. Suggested-by: Mark Rutland Suggested-by: Marc Zyngier Fixes: 83a7a4d643d3 ("arm64: perf: Enable PMU counter userspace access for perf event") Signed-off-by: Reiji Watanabe Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230603025035.3781797-3-reijiw@google.com commit 8681f71759010503892f9e3ddb05f65c0f21b690 Author: Reiji Watanabe Date: Fri Jun 2 19:50:34 2023 -0700 KVM: arm64: PMU: Restore the host's PMUSERENR_EL0 Restore the host's PMUSERENR_EL0 value instead of clearing it, before returning back to userspace, as the host's EL0 might have a direct access to PMU registers (some bits of PMUSERENR_EL0 for might not be zero for the host EL0). Fixes: 83a7a4d643d3 ("arm64: perf: Enable PMU counter userspace access for perf event") Signed-off-by: Reiji Watanabe Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230603025035.3781797-2-reijiw@google.com commit 6f64a5ebe1dc64add6e1d8ed3113200909988c02 Merge: 5e89d62ec1014 2d5b205dfa32b Author: Linus Torvalds Date: Sun Jun 4 11:57:38 2023 -0400 Merge tag 'irq_urgent_for_v6.4_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Borislav Petkov: - Fix open firmware quirks validation so that they don't get applied wrongly * tag 'irq_urgent_for_v6.4_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic: Correctly validate OF quirk descriptors commit 8cde87b007dad2e461015ff70352af56ceb02c75 Author: Min-Hua Chen Date: Sat Jun 3 07:52:09 2023 +0800 net: sched: wrap tc_skip_wrapper with CONFIG_RETPOLINE This patch fixes the following sparse warning: net/sched/sch_api.c:2305:1: sparse: warning: symbol 'tc_skip_wrapper' was not declared. Should it be static? No functional change intended. Signed-off-by: Min-Hua Chen Acked-by: Pedro Tammela Signed-off-by: David S. Miller commit 3d5f4d29f6a8c1f248ea652daddc9c4701370120 Merge: c308e9ec00472 fdebd850cc065 Author: David S. Miller Date: Sun Jun 4 15:43:45 2023 +0100 Merge branch 'enetc-fixes' Wei Fang says: ==================== net: enetc: correct the statistics of rx bytes The purpose of this patch set is to fix the issue of rx bytes statistics. The first patch corrects the rx bytes statistics of normal kernel protocol stack path, and the second patch is used to correct the rx bytes statistics of XDP. ==================== Signed-off-by: David S. Miller commit fdebd850cc065495abf1d64756496050bb22db67 Author: Wei Fang Date: Fri Jun 2 17:46:59 2023 +0800 net: enetc: correct rx_bytes statistics of XDP The rx_bytes statistics of XDP are always zero, because rx_byte_cnt is not updated after it is initialized to 0. So fix it. Fixes: d1b15102dd16 ("net: enetc: add support for XDP_DROP and XDP_PASS") Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 7190d0ff0e17690a9b1279d84a06473600ba2060 Author: Wei Fang Date: Fri Jun 2 17:46:58 2023 +0800 net: enetc: correct the statistics of rx bytes The rx_bytes of struct net_device_stats should count the length of ethernet frames excluding the FCS. However, there are two problems with the rx_bytes statistics of the current enetc driver. one is that the length of VLAN header is not counted if the VLAN extraction feature is enabled. The other is that the length of L2 header is not counted, because eth_type_trans() is invoked before updating rx_bytes which will subtract the length of L2 header from skb->len. BTW, the rx_bytes statistics of XDP path also have similar problem, I will fix it in another patch. Fixes: a800abd3ecb9 ("net: enetc: move skb creation into enetc_build_skb") Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 5e89d62ec1014800e411868b8d750f9d631bdd01 Merge: 209835e8ecb01 81f3affa19d6a Author: Linus Torvalds Date: Sun Jun 4 09:10:43 2023 -0400 Merge tag 'media/v6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "Some driver fixes: - a regression fix for the verisilicon driver - uvcvideo: don't expose unsupported video formats to userspace - camss-video: don't zero subdev format after init - mediatek: some fixes for 4K decoder formats - fix a Sphinx build warning (missing doc for client_caps) - some fixes for imx and atomisp staging drivers And two CEC core fixes: - don't set last_initiator if TX in progress - disable adapter in cec_devnode_unregister" * tag 'media/v6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: uvcvideo: Don't expose unsupported formats to userspace media: v4l2-subdev: Fix missing kerneldoc for client_caps media: staging: media: imx: initialize hs_settle to avoid warning media: v4l2-mc: Drop subdev check in v4l2_create_fwnode_links_to_pad() media: staging: media: atomisp: init high & low vars media: cec: core: don't set last_initiator if tx in progress media: cec: core: disable adapter in cec_devnode_unregister media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats media: camss: camss-video: Don't zero subdev format again after initialization media: verisilicon: Additional fix for the crash when opening the driver commit 899e373ef0b0d3f1c2712a849f019de4f46bfa02 Merge: 81f3affa19d6a 7877cb91f1081 Author: Mauro Carvalho Chehab Date: Sun Jun 4 13:50:38 2023 +0100 Merge tag 'v6.4-rc4' into v4l_for_linus Linux 6.4-rc4 * tag 'v6.4-rc4': (606 commits) Linux 6.4-rc4 cxl: Explicitly initialize resources when media is not ready x86: re-introduce support for ERMS copies for user space accesses NVMe: Add MAXIO 1602 to bogus nid list. module: error out early on concurrent load of the same module file x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf() io_uring: unlock sqd->lock before sq thread release CPU MAINTAINERS: update arm64 Microchip entries udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). net: phy: mscc: enable VSC8501/2 RGMII RX clock net: phy: mscc: remove unnecessary phydev locking net: phy: mscc: add support for VSC8501 net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE net/handshake: Enable the SNI extension to work properly net/handshake: Unpin sock->file if a handshake is cancelled net/handshake: handshake_genl_notify() shouldn't ignore @flags net/handshake: Fix uninitialized local variable net/handshake: Fix handshake_dup() ref counting net/handshake: Remove unneeded check from handshake_dup() ... commit 209835e8ecb01a2f60b7da153d223ba182447197 Merge: 41f3ab2d5ded5 48e156023059e Author: Linus Torvalds Date: Sun Jun 4 08:32:30 2023 -0400 Merge tag 'char-misc-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a bunch of tiny char/misc/other driver fixes for 6.4-rc5 that resolve a number of reported issues. Included in here are: - iio driver fixes - fpga driver fixes - test_firmware bugfixes - fastrpc driver tiny bugfixes - MAINTAINERS file updates for some subsystems All of these have been in linux-next this past week with no reported issues" * tag 'char-misc-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (34 commits) test_firmware: fix the memory leak of the allocated firmware buffer test_firmware: fix a memory leak with reqs buffer test_firmware: prevent race conditions by a correct implementation of locking firmware_loader: Fix a NULL vs IS_ERR() check MAINTAINERS: Vaibhav Gupta is the new ipack maintainer dt-bindings: fpga: replace Ivan Bornyakov maintainership MAINTAINERS: update Microchip MPF FPGA reviewers misc: fastrpc: reject new invocations during device removal misc: fastrpc: return -EPIPE to invocations on device removal misc: fastrpc: Reassign memory ownership only for remote heap misc: fastrpc: Pass proper scm arguments for secure map request iio: imu: inv_icm42600: fix timestamp reset iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value iio: dac: mcp4725: Fix i2c_master_send() return value handling iio: accel: kx022a fix irq getting iio: bu27034: Ensure reset is written iio: dac: build ad5758 driver when AD5758 is selected iio: addac: ad74413: fix resistance input processing iio: light: vcnl4035: fixed chip ID check ... commit 9bf2e534313fcf420367668cc1f30e10469901dc Author: Adam Ford Date: Sun May 28 06:22:54 2023 -0500 arm64: dts: imx8mn-beacon: Fix SPI CS pinmux The final production baseboard had a different chip select than earlier prototype boards. When the newer board was released, the SPI stopped working because the wrong pin was used in the device tree and conflicted with the UART RTS. Fix the pinmux for production boards. Fixes: 36ca3c8ccb53 ("arm64: dts: imx: Add Beacon i.MX8M Nano development kit") Signed-off-by: Adam Ford Signed-off-by: Shawn Guo commit 41f3ab2d5ded530f2b2c19cd3d27f072f908c12d Merge: 12c2f77b32b5d c26fabe73330d Author: Linus Torvalds Date: Sun Jun 4 08:02:25 2023 -0400 Merge tag 'driver-core-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are two small driver core cacheinfo fixes for 6.4-rc5 that resolve a number of reported issues with that file. These changes have been in linux-next this past week with no reported problems" * tag 'driver-core-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug commit 12c2f77b32b5de3f5cc4a9ae2eb2b1f68f86df31 Merge: 8b435e40256f5 403e97d6ab2cb Author: Linus Torvalds Date: Sun Jun 4 07:51:33 2023 -0400 Merge tag 'tty-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small tty/serial driver fixes for 6.4-rc5 that have all been in linux-next this past week with no reported problems. Included in here are: - 8250_tegra driver bugfix - fsl uart driver bugfixes - Kconfig fix for dependancy issue - dt-bindings fix for the 8250_omap driver" * tag 'tty-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: dt-bindings: serial: 8250_omap: add rs485-rts-active-high serial: cpm_uart: Fix a COMPILE_TEST dependency soc: fsl: cpm1: Fix TSA and QMC dependencies in case of COMPILE_TEST tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() commit 8b435e40256f51f4576c8ab22b88398d21acb149 Merge: b066935bf8337 fcfe84236ec09 Author: Linus Torvalds Date: Sun Jun 4 07:31:48 2023 -0400 Merge tag 'usb-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some USB driver and core fixes for 6.4-rc5. Most of these are tiny driver fixes, including: - udc driver bugfix - f_fs gadget driver bugfix - cdns3 driver bugfix - typec bugfixes But the "big" thing in here is a fix yet-again for how the USB buffers are handled from userspace when dealing with DMA issues. The changes were discussed a lot, and tested a lot, on the list, and acked by the relevant mm maintainers and have been in linux-next all this past week with no reported problems" * tag 'usb-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: typec: tps6598x: Fix broken polling mode after system suspend/resume mm: page_table_check: Ensure user pages are not slab pages mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM usb: usbfs: Use consistent mmap functions usb: usbfs: Enforce page requirements for mmap dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type usb: gadget: udc: fix NULL dereference in remove() usb: gadget: f_fs: Add unbind event before functionfs_unbind usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM commit b066935bf83371c34ab8ba3b15f4232536e2786f Merge: 9455b4b6db1e9 f211b45057d8b Author: Linus Torvalds Date: Sun Jun 4 07:16:53 2023 -0400 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Address some fallout of the locking rework, this time affecting the way the vgic is configured - Fix an issue where the page table walker frees a subtree and then proceeds with walking what it has just freed... - Check that a given PA donated to the guest is actually memory (only affecting pKVM) - Correctly handle MTE CMOs by Set/Way - Fix the reported address of a watchpoint forwarded to userspace - Fix the freeing of the root of stage-2 page tables - Stop creating spurious PMU events to perform detection of the default PMU and use the existing PMU list instead x86: - Fix a memslot lookup bug in the NX recovery thread that could theoretically let userspace bypass the NX hugepage mitigation - Fix a s/BLOCKING/PENDING bug in SVM's vNMI support - Account exit stats for fastpath VM-Exits that never leave the super tight run-loop - Fix an out-of-bounds bug in the optimized APIC map code, and add a regression test for the race" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: selftests: Add test for race in kvm_recalculate_apic_map() KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds KVM: x86: Account fastpath-only VM-Exits in vCPU stats KVM: SVM: vNMI pending bit is V_NMI_PENDING_MASK not V_NMI_BLOCKING_MASK KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker KVM: arm64: Document default vPMU behavior on heterogeneous systems KVM: arm64: Iterate arm_pmus list to probe for default PMU KVM: arm64: Drop last page ref in kvm_pgtable_stage2_free_removed() KVM: arm64: Populate fault info for watchpoint KVM: arm64: Reload PTE after invoking walker callback on preorder traversal KVM: arm64: Handle trap of tagged Set/Way CMOs arm64: Add missing Set/Way CMO encodings KVM: arm64: Prevent unconditional donation of unmapped regions from the host KVM: arm64: vgic: Fix a comment KVM: arm64: vgic: Fix locking comment KVM: arm64: vgic: Wrap vgic_its_create() with config_lock KVM: arm64: vgic: Fix a circular locking issue commit 9455b4b6db1e9b11d242595cc968332ecdd3cc91 Merge: e5282a7d8f6b6 719dfd5925e18 Author: Linus Torvalds Date: Sun Jun 4 07:11:13 2023 -0400 Merge tag 'powerpc-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix link errors in new aes-gcm-p10 code when built-in with other drivers - Limit number of TCEs passed to H_STUFF_TCE hcall as per spec - Use KSYM_NAME_LEN in xmon array size to avoid possible OOB write Thanks to Gaurav Batra and Maninder Singh Vishal Chourasia. * tag 'powerpc-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/xmon: Use KSYM_NAME_LEN in array size powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall powerpc/crypto: Fix aes-gcm-p10 link errors commit ddad59331a4e16088468ca0ad228a9fe32d7955a Author: Tian Lan Date: Sat May 13 18:12:27 2023 -0400 blk-mq: fix blk_mq_hw_ctx active request accounting The nr_active counter continues to increase over time which causes the blk_mq_get_tag to hang until the thread is rescheduled to a different core despite there are still tags available. kernel-stack INFO: task inboundIOReacto:3014879 blocked for more than 2 seconds Not tainted 6.1.15-amd64 #1 Debian 6.1.15~debian11 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:inboundIOReacto state:D stack:0 pid:3014879 ppid:4557 flags:0x00000000 Call Trace: __schedule+0x351/0xa20 scheduler+0x5d/0xe0 io_schedule+0x42/0x70 blk_mq_get_tag+0x11a/0x2a0 ? dequeue_task_stop+0x70/0x70 __blk_mq_alloc_requests+0x191/0x2e0 kprobe output showing RQF_MQ_INFLIGHT bit is not cleared before __blk_mq_free_request being called. 320 320 kworker/29:1H __blk_mq_free_request rq_flags 0x220c0 in-flight 1 b'__blk_mq_free_request+0x1 [kernel]' b'bt_iter+0x50 [kernel]' b'blk_mq_queue_tag_busy_iter+0x318 [kernel]' b'blk_mq_timeout_work+0x7c [kernel]' b'process_one_work+0x1c4 [kernel]' b'worker_thread+0x4d [kernel]' b'kthread+0xe6 [kernel]' b'ret_from_fork+0x1f [kernel]' Signed-off-by: Tian Lan Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter") Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20230513221227.497327-1-tilan7663@gmail.com Signed-off-by: Jens Axboe commit c308e9ec004721a656c193243eab61a8be324657 Author: Wen Gu Date: Thu Jun 1 16:41:52 2023 +0800 net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT SMCRv1 has a similar issue to SMCRv2 (see link below) that may access invalid MRs of RMBs when construct LLC ADD LINK CONT messages. BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 5 PID: 48 Comm: kworker/5:0 Kdump: loaded Tainted: G W E 6.4.0-rc3+ #49 Workqueue: events smc_llc_add_link_work [smc] RIP: 0010:smc_llc_add_link_cont+0x160/0x270 [smc] RSP: 0018:ffffa737801d3d50 EFLAGS: 00010286 RAX: ffff964f82144000 RBX: ffffa737801d3dd8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff964f81370c30 RBP: ffffa737801d3dd4 R08: ffff964f81370000 R09: ffffa737801d3db0 R10: 0000000000000001 R11: 0000000000000060 R12: ffff964f82e70000 R13: ffff964f81370c38 R14: ffffa737801d3dd3 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff9652bfd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 000000008fa20004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: smc_llc_srv_rkey_exchange+0xa7/0x190 [smc] smc_llc_srv_add_link+0x3ae/0x5a0 [smc] smc_llc_add_link_work+0xb8/0x140 [smc] process_one_work+0x1e5/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 When an alernate RNIC is available in system, SMC will try to add a new link based on the RNIC for resilience. All the RMBs in use will be mapped to the new link. Then the RMBs' MRs corresponding to the new link will be filled into LLC messages. For SMCRv1, they are ADD LINK CONT messages. However smc_llc_add_link_cont() may mistakenly access to unused RMBs which haven't been mapped to the new link and have no valid MRs, thus causing a crash. So this patch fixes it. Fixes: 87f88cda2128 ("net/smc: rkey processing for a new link as SMC client") Link: https://lore.kernel.org/r/1685101741-74826-3-git-send-email-guwen@linux.alibaba.com Signed-off-by: Wen Gu Reviewed-by: Wenjia Zhang Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 02a7eee1ebf213dda4d517b9ed09fae4c1734312 Author: Weihao Gao Date: Fri Jun 2 19:54:50 2023 +0000 Fix gitignore for recently added usptream self tests This resolves the issue that generated binary is showing up as an untracked git file after every build on the kernel. Signed-off-by: Weihao Gao Signed-off-by: David S. Miller commit f211b45057d8b0264b494f1acebf2e8d7f9432c9 Merge: 49661a52a4b8c 47d2804bc99ca Author: Paolo Bonzini Date: Sat Jun 3 15:16:58 2023 -0400 Merge tag 'kvm-x86-fixes-6.4' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes for 6.4 - Fix a memslot lookup bug in the NX recovery thread that could theoretically let userspace bypass the NX hugepage mitigation - Fix a s/BLOCKING/PENDING bug in SVM's vNMI support - Account exit stats for fastpath VM-Exits that never leave the super tight run-loop - Fix an out-of-bounds bug in the optimized APIC map code, and add a regression test for the race. commit 49661a52a4b8c6c4e67cf69831c9a88b62c6ebcf Merge: 26f314988091d 40e54cad45407 Author: Paolo Bonzini Date: Sat Jun 3 15:15:49 2023 -0400 Merge tag 'kvmarm-fixes-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.4, take #3 - Fix the reported address of a watchpoint forwarded to userspace - Fix the freeing of the root of stage-2 page tables - Stop creating spurious PMU events to perform detection of the default PMU and use the existing PMU list instead. commit 26f314988091de60949f7d69f2764c98d48a7a90 Merge: b9846a698c9af a9f0e3d5a089d Author: Paolo Bonzini Date: Sat Jun 3 15:14:18 2023 -0400 Merge tag 'kvmarm-fixes-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.4, take #2 - Address some fallout of the locking rework, this time affecting the way the vgic is configured - Fix an issue where the page table walker frees a subtree and then proceeds with walking what it has just freed... - Check that a given PA donated to the gues is actually memory (only affecting pKVM) - Correctly handle MTE CMOs by Set/Way commit e5282a7d8f6b604f2bb6a06457734b8cf1e2f8f2 Merge: d1b65edf4d1e6 6d074ce231772 Author: Linus Torvalds Date: Sat Jun 3 13:52:24 2023 -0400 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Five fixes, all in drivers. The most extensive is the target change to fix the hang in the login code, which involves changing timers from per login to per connection" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: stex: Fix gcc 13 warnings scsi: qla2xxx: Fix NULL pointer dereference in target mode scsi: target: iscsi: Prevent login threads from racing between each other scsi: target: iscsi: Remove unused transport_timer scsi: target: iscsi: Fix hang in the iSCSI login code commit d1b65edf4d1e6506349196a2f665185eeca2a114 Merge: 51f269a6ecc70 b05d39466ba11 Author: Linus Torvalds Date: Sat Jun 3 13:46:11 2023 -0400 Merge tag 'leds-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/linux Pull LED fix from Johan Hovold: "Here's a fix for a regression in 6.4-rc1 which broke the backlight on machines such as the Lenovo ThinkPad X13s" Acked-by: Lee Jones Link: https://lore.kernel.org/lkml/20230602091928.GR449117@google.com/ * tag 'leds-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/linux: leds: qcom-lpg: Fix PWM period limits commit b05d39466ba111fc3775d5d46180b73c34ebe8f7 Author: Bjorn Andersson Date: Mon May 15 09:26:04 2023 -0700 leds: qcom-lpg: Fix PWM period limits The introduction of high resolution PWM support changed the order of the operations in the calculation of min and max period. The result in both divisions is in most cases a truncation to 0, which limits the period to the range of [0, 0]. Both numerators (and denominators) are within 64 bits, so the whole expression can be put directly into the div64_u64, instead of doing it partially. Fixes: b00d2ed37617 ("leds: rgb: leds-qcom-lpg: Add support for high resolution PWM") Reviewed-by: Caleb Connolly Tested-by: Steev Klimaszewski Signed-off-by: Bjorn Andersson Acked-by: Lee Jones Tested-by: Johan Hovold Tested-by: Neil Armstrong # on SM8550-QRD Link: https://lore.kernel.org/r/20230515162604.649203-1-quic_bjorande@quicinc.com Signed-off-by: Johan Hovold commit 51f269a6ecc701f9932eff5b253a1f89746be6bd Merge: 4ecd704a4c51f eb50d0f250e96 Author: Linus Torvalds Date: Sat Jun 3 08:23:16 2023 -0400 Merge tag 'probes-fixes-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - Return NULL if the trace_probe list on trace_probe_event is empty - selftests/ftrace: Choose testing symbol name for filtering feature from sample data instead of fixed symbol * tag 'probes-fixes-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: selftests/ftrace: Choose target function for filter test from samples tracing/probe: trace_probe_primary_from_call(): checked list_first_entry commit 03c44a21d0333a2f469680bc9caaf96a9bfaea87 Author: Russell King (Oracle) Date: Thu Jun 1 10:12:06 2023 +0100 net: phylink: actually fix ksettings_set() ethtool call Raju Lakkaraju reported that the below commit caused a regression with Lan743x drivers and a 2.5G SFP. Sadly, this is because the commit was utterly wrong. Let's fix this properly by not moving the linkmode_and(), but instead copying the link ksettings and then modifying the advertising mask before passing the modified link ksettings to phylib. Fixes: df0acdc59b09 ("net: phylink: fix ksettings_set() ethtool call") Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1q4eLm-00Ayxk-GZ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit eb50d0f250e96ede9192d936d220cd97adc93b89 Author: Masami Hiramatsu (Google) Date: Sun Mar 19 11:53:32 2023 +0900 selftests/ftrace: Choose target function for filter test from samples Since the event-filter-function.tc expects the 'exit_mmap()' directly calls 'kmem_cache_free()', this is vulnerable to code modifications. Choose the target function for the filter test from the sample event data so that it can keep test running correctly even if the caller function name will be changed. Link: https://lore.kernel.org/linux-trace-kernel/167919441260.1922645.18355804179347364057.stgit@mhiramat.roam.corp.google.com/ Link: https://lore.kernel.org/all/CA+G9fYtF-XEKi9YNGgR=Kf==7iRb2FrmEC7qtwAeQbfyah-UhA@mail.gmail.com/ Reported-by: Linux Kernel Functional Testing Fixes: 7f09d639b8c4 ("tracing/selftests: Add test for event filtering on function name") Signed-off-by: Masami Hiramatsu (Google) Acked-by: Steven Rostedt (Google) commit 3696e140c25f5a2af763505aff99d14c0661cede Merge: 37a826d86ff74 ef62c0ae6db11 Author: Jakub Kicinski Date: Fri Jun 2 22:55:45 2023 -0700 Merge branch 'net-ipv6-skip_notify_on_dev_down-fix' Eric Dumazet says: ==================== net/ipv6: skip_notify_on_dev_down fix While reviewing Matthieu Baerts recent patch [1], I found it copied/pasted an existing bug around skip_notify_on_dev_down. First patch is a stable candidate, and second one can simply land in net tree. https://lore.kernel.org/lkml/20230601-net-next-skip_print_link_becomes_ready-v1-1-c13e64c14095@tessares.net/ ==================== Link: https://lore.kernel.org/r/20230601160445.1480257-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit ef62c0ae6db11c095880e473db9f846132d7eba8 Author: Eric Dumazet Date: Thu Jun 1 16:04:45 2023 +0000 net/ipv6: convert skip_notify_on_dev_down sysctl to u8 Save a bit a space, and could help future sysctls to use the same pattern. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Acked-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit edf2e1d2019b2730d6076dbe4c040d37d7c10bbe Author: Eric Dumazet Date: Thu Jun 1 16:04:44 2023 +0000 net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down skip_notify_on_dev_down ctl table expects this field to be an int (4 bytes), not a bool (1 byte). Because proc_dou8vec_minmax() was added in 5.13, this patch converts skip_notify_on_dev_down to an int. Following patch then converts the field to u8 and use proc_dou8vec_minmax(). Fixes: 7c6bb7d2faaf ("net/ipv6: Add knob to skip DELROUTE message on device down") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Acked-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 47d2804bc99ca873470df17c20737b28225a320d Author: Michal Luczaj Date: Fri Jun 2 16:32:50 2023 -0700 KVM: selftests: Add test for race in kvm_recalculate_apic_map() Keep switching between LAPIC_MODE_X2APIC and LAPIC_MODE_DISABLED during APIC map construction to hunt for TOCTOU bugs in KVM. KVM's optimized map recalc makes multiple passes over the list of vCPUs, and the calculations ignore vCPU's whose APIC is hardware-disabled, i.e. there's a window where toggling LAPIC_MODE_DISABLED is quite interesting. Signed-off-by: Michal Luczaj Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20230602233250.1014316-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 4364b287982bd05bfafa461c80650c732001974b Author: Sean Christopherson Date: Fri Jun 2 16:32:48 2023 -0700 KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds Bail from kvm_recalculate_phys_map() and disable the optimized map if the target vCPU's x2APIC ID is out-of-bounds, i.e. if the vCPU was added and/or enabled its local APIC after the map was allocated. This fixes an out-of-bounds access bug in the !x2apic_format path where KVM would write beyond the end of phys_map. Check the x2APIC ID regardless of whether or not x2APIC is enabled, as KVM's hardcodes x2APIC ID to be the vCPU ID, i.e. it can't change, and the map allocation in kvm_recalculate_apic_map() doesn't check for x2APIC being enabled, i.e. the check won't get false postivies. Note, this also affects the x2apic_format path, which previously just ignored the "x2apic_id > new->max_apic_id" case. That too is arguably a bug fix, as ignoring the vCPU meant that KVM would not send interrupts to the vCPU until the next map recalculation. In practice, that "bug" is likely benign as a newly present vCPU/APIC would immediately trigger a recalc. But, there's no functional downside to disabling the map, and a future patch will gracefully handle the -E2BIG case by retrying instead of simply disabling the optimized map. Opportunistically add a sanity check on the xAPIC ID size, along with a comment explaining why the xAPIC ID is guaranteed to be "good". Reported-by: Michal Luczaj Fixes: 5b84b0291702 ("KVM: x86: Honor architectural behavior for aliased 8-bit APIC IDs") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230602233250.1014316-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 23509e92cf13ed22c17d160efac7d0f0602d0bcb Merge: b0fd1852bcc21 1022b67b89ce5 Author: Martin KaFai Lau Date: Fri Jun 2 16:22:13 2023 -0700 Merge branch 'Fix elem_size not being set for inner maps' Rhys Rustad-Elliott says: ==================== Commit d937bc3449fa ("bpf: make uniform use of array->elem_size everywhere in arraymap.c") changed array_map_gen_lookup to use array->elem_size instead of round_up(map->value_size, 8) as the element size when generating code to access a value in an array map. array->elem_size, however, is not set by bpf_map_meta_alloc when initializing an BPF_MAP_TYPE_ARRAY_OF_MAPS or BPF_MAP_TYPE_HASH_OF_MAPS. This results in array_map_gen_lookup incorrectly outputting code that always accesses index 0 in the array (as the index will be calculated via a multiplication with the element size, which is incorrectly set to 0). This patchset sets elem_size on the bpf_array object when allocating an array or hash of maps to fix this and adds a selftest that accesses an array map nested within a hash of maps at a nonzero index to prevent regressions. v1: https://lore.kernel.org/bpf/95b5da7c-ee52-3ecb-0a4e-f6a7a114f269@linux.dev/ Changelog: v1 -> v2: Address comments by Martin KaFai Lau: - Directly use inner_array->elem_size instead of using round_up - Move selftests to a new patch - Use ASSERT_* macros instead of CHECK and remove duration - Remove unnecessary usleep - Shorten selftest name ==================== Signed-off-by: Martin KaFai Lau commit 1022b67b89ce5b92906fec6447f02acf6ba018e4 Author: Rhys Rustad-Elliott Date: Fri Jun 2 19:02:24 2023 +0000 selftests/bpf: Add access_inner_map selftest Add a selftest that accesses a BPF_MAP_TYPE_ARRAY (at a nonzero index) nested within a BPF_MAP_TYPE_HASH_OF_MAPS to flex a previously buggy case. Signed-off-by: Rhys Rustad-Elliott Link: https://lore.kernel.org/r/20230602190110.47068-3-me@rhysre.net Signed-off-by: Martin KaFai Lau commit a37f2699c36a7f6606ba3300f243227856c5ad6b Author: Tom Lendacky Date: Wed May 17 11:26:41 2023 -0500 x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed The call to startup_64_setup_env() will install a new GDT but does not actually switch to using the KERNEL_CS entry until returning from the function call. Commit bcce82908333 ("x86/sev: Detect/setup SEV/SME features earlier in boot") moved the call to sme_enable() earlier in the boot process and in between the call to startup_64_setup_env() and the switch to KERNEL_CS. An SEV-ES or an SEV-SNP guest will trigger #VC exceptions during the call to sme_enable() and if the CS pushed on the stack as part of the exception and used by IRETQ is not mapped by the new GDT, then problems occur. Today, the current CS when entering startup_64 is the kernel CS value because it was set up by the decompressor code, so no issue is seen. However, a recent patchset that looked to avoid using the legacy decompressor during an EFI boot exposed this bug. At entry to startup_64, the CS value is that of EFI and is not mapped in the new kernel GDT. So when a #VC exception occurs, the CS value used by IRETQ is not valid and the guest boot crashes. Fix this issue by moving the block that switches to the KERNEL_CS value to be done immediately after returning from startup_64_setup_env(). Fixes: bcce82908333 ("x86/sev: Detect/setup SEV/SME features earlier in boot") Signed-off-by: Tom Lendacky Signed-off-by: Dave Hansen Reviewed-by: Joerg Roedel Link: https://lore.kernel.org/all/6ff1f28af2829cc9aea357ebee285825f90a431f.1684340801.git.thomas.lendacky%40amd.com commit 8b703a49c9df5e74870381ad7ba9c85d8a74ed2c Author: Sean Christopherson Date: Thu Jun 1 18:19:19 2023 -0700 KVM: x86: Account fastpath-only VM-Exits in vCPU stats Increment vcpu->stat.exits when handling a fastpath VM-Exit without going through any part of the "slow" path. Not bumping the exits stat can result in wildly misleading exit counts, e.g. if the primary reason the guest is exiting is to program the TSC deadline timer. Fixes: 404d5d7bff0d ("KVM: X86: Introduce more exit_fastpath_completion enum values") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230602011920.787844-2-seanjc@google.com Signed-off-by: Sean Christopherson commit b2ce89978889b848a6dd652695dd1887e416f9d2 Author: Maciej S. Szmigiero Date: Fri May 19 13:26:18 2023 +0200 KVM: SVM: vNMI pending bit is V_NMI_PENDING_MASK not V_NMI_BLOCKING_MASK While testing Hyper-V enabled Windows Server 2019 guests on Zen4 hardware I noticed that with vCPU count large enough (> 16) they sometimes froze at boot. With vCPU count of 64 they never booted successfully - suggesting some kind of a race condition. Since adding "vnmi=0" module parameter made these guests boot successfully it was clear that the problem is most likely (v)NMI-related. Running kvm-unit-tests quickly showed failing NMI-related tests cases, like "multiple nmi" and "pending nmi" from apic-split, x2apic and xapic tests and the NMI parts of eventinj test. The issue was that once one NMI was being serviced no other NMI was allowed to be set pending (NMI limit = 0), which was traced to svm_is_vnmi_pending() wrongly testing for the "NMI blocked" flag rather than for the "NMI pending" flag. Fix this by testing for the right flag in svm_is_vnmi_pending(). Once this is done, the NMI-related kvm-unit-tests pass successfully and the Windows guest no longer freezes at boot. Fixes: fa4c027a7956 ("KVM: x86: Add support for SVM's Virtual NMI") Signed-off-by: Maciej S. Szmigiero Reviewed-by: Sean Christopherson Link: https://lore.kernel.org/r/be4ca192eb0c1e69a210db3009ca984e6a54ae69.1684495380.git.maciej.szmigiero@oracle.com Signed-off-by: Sean Christopherson commit 817fa998362d6ea9fabd5e97af8e9e2eb5f0e6f2 Author: Sean Christopherson Date: Thu Jun 1 18:01:37 2023 -0700 KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker Factor in the address space (non-SMM vs. SMM) of the target shadow page when recovering potential NX huge pages, otherwise KVM will retrieve the wrong memslot when zapping shadow pages that were created for SMM. The bug most visibly manifests as a WARN on the memslot being non-NULL, but the worst case scenario is that KVM could unaccount the shadow page without ensuring KVM won't install a huge page, i.e. if the non-SMM slot is being dirty logged, but the SMM slot is not. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 3911 at arch/x86/kvm/mmu/mmu.c:7015 kvm_nx_huge_page_recovery_worker+0x38c/0x3d0 [kvm] CPU: 1 PID: 3911 Comm: kvm-nx-lpage-re RIP: 0010:kvm_nx_huge_page_recovery_worker+0x38c/0x3d0 [kvm] RSP: 0018:ffff99b284f0be68 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99b284edd000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff9271397024e0 R08: 0000000000000000 R09: ffff927139702450 R10: 0000000000000000 R11: 0000000000000001 R12: ffff99b284f0be98 R13: 0000000000000000 R14: ffff9270991fcd80 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff927f9f640000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0aacad3ae0 CR3: 000000088fc2c005 CR4: 00000000003726e0 Call Trace: __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [kvm] kvm_vm_worker_thread+0x106/0x1c0 [kvm] kthread+0xd9/0x100 ret_from_fork+0x2c/0x50 ---[ end trace 0000000000000000 ]--- This bug was exposed by commit edbdb43fc96b ("KVM: x86: Preserve TDP MMU roots until they are explicitly invalidated"), which allowed KVM to retain SMM TDP MMU roots effectively indefinitely. Before commit edbdb43fc96b, KVM would zap all SMM TDP MMU roots and thus all SMM TDP MMU shadow pages once all vCPUs exited SMM, which made the window where this bug (recovering an SMM NX huge page) could be encountered quite tiny. To hit the bug, the NX recovery thread would have to run while at least one vCPU was in SMM. Most VMs typically only use SMM during boot, and so the problematic shadow pages were gone by the time the NX recovery thread ran. Now that KVM preserves TDP MMU roots until they are explicitly invalidated (e.g. by a memslot deletion), the window to trigger the bug is effectively never closed because most VMMs don't delete memslots after boot (except for a handful of special scenarios). Fixes: eb298605705a ("KVM: x86/mmu: Do not recover dirty-tracked NX Huge Pages") Reported-by: Fabio Coatti Closes: https://lore.kernel.org/all/CADpTngX9LESCdHVu_2mQkNGena_Ng2CphWNwsRGSMxzDsTjU2A@mail.gmail.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230602010137.784664-1-seanjc@google.com Signed-off-by: Sean Christopherson commit cba41bb78d70aad98d8e61e019fd48c561f7f396 Author: Rhys Rustad-Elliott Date: Fri Jun 2 19:02:02 2023 +0000 bpf: Fix elem_size not being set for inner maps Commit d937bc3449fa ("bpf: make uniform use of array->elem_size everywhere in arraymap.c") changed array_map_gen_lookup to use array->elem_size instead of round_up(map->value_size, 8) as the element size when generating code to access a value in an array map. array->elem_size, however, is not set by bpf_map_meta_alloc when initializing an BPF_MAP_TYPE_ARRAY_OF_MAPS or BPF_MAP_TYPE_HASH_OF_MAPS. This results in array_map_gen_lookup incorrectly outputting code that always accesses index 0 in the array (as the index will be calculated via a multiplication with the element size, which is incorrectly set to 0). Set elem_size on the bpf_array object when allocating an array or hash of maps to fix this. Fixes: d937bc3449fa ("bpf: make uniform use of array->elem_size everywhere in arraymap.c") Signed-off-by: Rhys Rustad-Elliott Link: https://lore.kernel.org/r/20230602190110.47068-2-me@rhysre.net Signed-off-by: Martin KaFai Lau commit 4ecd704a4c51fd95973fcc3a60444e0e24eb9439 Author: Lino Sanfilippo Date: Tue May 30 18:41:16 2023 +0200 tpm, tpm_tis: correct tpm_tis_flags enumeration values With commit 858e8b792d06 ("tpm, tpm_tis: Avoid cache incoherency in test for interrupts") bit accessor functions are used to access flags in tpm_tis_data->flags. However these functions expect bit numbers, while the flags are defined as bit masks in enum tpm_tis_flag. Fix this inconsistency by using numbers instead of masks also for the flags in the enum. Reported-by: Pavel Machek Fixes: 858e8b792d06 ("tpm, tpm_tis: Avoid cache incoherency in test for interrupts") Signed-off-by: Lino Sanfilippo Cc: stable@vger.kernel.org Reviewed-by: Pavel Machek Signed-off-by: Linus Torvalds commit 6d7d0603ca7c397a07efc88e314e38b4242a3a8d Merge: e0178b546d24f 3582e74599d37 Author: Linus Torvalds Date: Fri Jun 2 17:25:22 2023 -0400 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fix from Ted Ts'o: "Fix an ext4 regression which landed during the 6.4 merge window" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: Revert "ext4: remove ac->ac_found > sbi->s_mb_min_to_scan dead check in ext4_mb_check_limits" commit e0178b546d24f42a85f4d4da080fb801e0d49107 Merge: 5321d1b1afb9a b675df0257bb7 Author: Linus Torvalds Date: Fri Jun 2 17:16:19 2023 -0400 Merge tag 'for-6.4-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "One regression fix. The rewrite of scrub code in 6.4 broke device replace in zoned mode, some of the writes could happen out of order so this had to be adjusted for all cases" * tag 'for-6.4-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: zoned: fix dev-replace after the scrub rework commit 3582e74599d376bc18cae123045cd295360d885b Author: Ojaswin Mujoo Date: Tue May 30 18:03:39 2023 +0530 Revert "ext4: remove ac->ac_found > sbi->s_mb_min_to_scan dead check in ext4_mb_check_limits" This reverts commit 32c0869370194ae5ac9f9f501953ef693040f6a1. The reverted commit was intended to remove a dead check however it was observed that this check was actually being used to exit early instead of looping sbi->s_mb_max_to_scan times when we are able to find a free extent bigger than the goal extent. Due to this, a my performance tests (fsmark, parallel file writes in a highly fragmented FS) were seeing a 2x-3x regression. Example, the default value of the following variables is: sbi->s_mb_max_to_scan = 200 sbi->s_mb_min_to_scan = 10 In ext4_mb_check_limits() if we find an extent smaller than goal, then we return early and try again. This loop will go on until we have processed sbi->s_mb_max_to_scan(=200) number of free extents at which point we exit and just use whatever we have even if it is smaller than goal extent. Now, the regression comes when we find an extent bigger than goal. Earlier, in this case we would loop only sbi->s_mb_min_to_scan(=10) times and then just use the bigger extent. However with commit 32c08693 that check was removed and hence we would loop sbi->s_mb_max_to_scan(=200) times even though we have a big enough free extent to satisfy the request. The only time we would exit early would be when the free extent is *exactly* the size of our goal, which is pretty uncommon occurrence and so we would almost always end up looping 200 times. Hence, revert the commit by adding the check back to fix the regression. Also add a comment to outline this policy. Fixes: 32c086937019 ("ext4: remove ac->ac_found > sbi->s_mb_min_to_scan dead check in ext4_mb_check_limits") Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Kemeng Shi Link: https://lore.kernel.org/r/ddcae9658e46880dfec2fb0aa61d01fb3353d202.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 81f3affa19d6ab0c32aef46b053838219eef7e71 Author: Laurent Pinchart Date: Thu Apr 20 10:45:59 2023 +0100 media: uvcvideo: Don't expose unsupported formats to userspace When the uvcvideo driver encounters a format descriptor with an unknown format GUID, it creates a corresponding struct uvc_format instance with the fcc field set to 0. Since commit 50459f103edf ("media: uvcvideo: Remove format descriptions"), the driver relies on the V4L2 core to provide the format description string, which the V4L2 core can't do without a valid 4CC. This triggers a WARN_ON. As a format with a zero 4CC can't be selected, it is unusable for applications. Ignore the format completely without creating a uvc_format instance, which fixes the warning. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217252 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2180107 Fixes: 50459f103edf ("media: uvcvideo: Remove format descriptions") Signed-off-by: Laurent Pinchart Reviewed-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab commit 5321d1b1afb9a17302c6cec79f0cbf823eb0d3fc Merge: a746ca666a848 6966d7988c4fb Author: Linus Torvalds Date: Fri Jun 2 13:47:36 2023 -0400 Merge tag 'riscv-for-linus-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A build warning fix for BUILTIN_DTB=y - Hibernation support is hidden behind NONPORTABLE, as it depends on some undocumented early boot behavior and breaks on most platforms - A fix for relocatable kernels on systems with early boot errata - A fix to properly handle perf callchains for kernel tracepoints - A pair of fixes for NAPOT to avoid inconsistencies between PTEs and handle hardware that sets arbitrary A/D bits * tag 'riscv-for-linus-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Implement missing huge_ptep_get riscv: Fix huge_ptep_set_wrprotect when PTE is a NAPOT riscv: perf: Fix callchain parse error with kernel tracepoint events riscv: Fix relocatable kernels with early alternatives using -fno-pie RISC-V: mark hibernation as nonportable riscv: Fix unused variable warning when BUILTIN_DTB is set commit b37a356df86b9e56d30cef4673cba2621c7b7a1e Author: Tomi Valkeinen Date: Mon May 22 11:52:45 2023 +0100 media: v4l2-subdev: Fix missing kerneldoc for client_caps Add missing kernel doc for the new 'client_caps' field in struct v4l2_subdev_fh. Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Fixes: f57fa2959244 ("media: v4l2-subdev: Add new ioctl for client capabilities") Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 6970888d38be0a960673e3d203e8517a5c300ae5 Author: Hans Verkuil Date: Tue Apr 18 08:46:52 2023 +0100 media: staging: media: imx: initialize hs_settle to avoid warning Initialize hs_settle to 0 to avoid this compiler warning: imx8mq-mipi-csi2.c: In function 'imx8mq_mipi_csi_start_stream.part.0': imx8mq-mipi-csi2.c:91:55: warning: 'hs_settle' may be used uninitialized [-Wmaybe-uninitialized] 91 | #define GPR_CSI2_1_S_PRG_RXHS_SETTLE(x) (((x) & 0x3f) << 2) | ^~ imx8mq-mipi-csi2.c:357:13: note: 'hs_settle' was declared here 357 | u32 hs_settle; | ^~~~~~~~~ It's a false positive, but it is too complicated for the compiler to detect that. Signed-off-by: Hans Verkuil Reviewed-by: Martin Kepplinger Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 3a4cdef13fa389ffe8f74c22581155688c827d18 Author: Vaishnav Achath Date: Fri Apr 21 11:04:30 2023 +0100 media: v4l2-mc: Drop subdev check in v4l2_create_fwnode_links_to_pad() While updating v4l2_create_fwnode_links_to_pad() to accept non-subdev sinks, the check is_media_entity_v4l2_subdev() was not removed which prevented the function from being used with non-subdev sinks, Drop the unnecessary check. Fixes: bd5a03bc5be8 ("media: Accept non-subdev sinks in v4l2_create_fwnode_links_to_pad()") Signed-off-by: Vaishnav Achath Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit a746ca666a8486a04b6c0584966bfce16f6b1e1a Merge: 2b7497739fc8b c034203b6a9da Author: Linus Torvalds Date: Fri Jun 2 13:38:55 2023 -0400 Merge tag 'nfsd-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Two minor bug fixes * tag 'nfsd-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: fix double fget() bug in __write_ports_addfd() nfsd: make a copy of struct iattr before calling notify_change commit 1c1bcf2d3ea061613119b534f57507c377df20f9 Author: Namjae Jeon Date: Wed May 31 17:59:32 2023 +0900 ksmbd: validate smb request protocol id This patch add the validation for smb request protocol id. If it is not one of the four ids(SMB1_PROTO_NUMBER, SMB2_PROTO_NUMBER, SMB2_TRANSFORM_PROTO_NUM, SMB2_COMPRESSION_TRANSFORM_ID), don't allow processing the request. And this will fix the following KASAN warning also. [ 13.905265] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1b9/0x1f0 [ 13.905900] Read of size 16 at addr ffff888005fd2f34 by task kworker/0:2/44 ... [ 13.908553] Call Trace: [ 13.908793] [ 13.908995] dump_stack_lvl+0x33/0x50 [ 13.909369] print_report+0xcc/0x620 [ 13.910870] kasan_report+0xae/0xe0 [ 13.911519] kasan_check_range+0x35/0x1b0 [ 13.911796] init_smb2_rsp_hdr+0x1b9/0x1f0 [ 13.912492] handle_ksmbd_work+0xe5/0x820 Cc: stable@vger.kernel.org Reported-by: Chih-Yen Chang Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 368ba06881c395f1c9a7ba22203cf8d78b4addc0 Author: Namjae Jeon Date: Tue May 30 23:10:31 2023 +0900 ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop The length field of netbios header must be greater than the SMB header sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB packet. If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to `conn->request_buf`. In the function `get_smb2_cmd_val` ksmbd will read cmd from `rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN detector to print the following error message: [ 7.205018] BUG: KASAN: slab-out-of-bounds in get_smb2_cmd_val+0x45/0x60 [ 7.205423] Read of size 2 at addr ffff8880062d8b50 by task ksmbd:42632/248 ... [ 7.207125] [ 7.209191] get_smb2_cmd_val+0x45/0x60 [ 7.209426] ksmbd_conn_enqueue_request+0x3a/0x100 [ 7.209712] ksmbd_server_process_request+0x72/0x160 [ 7.210295] ksmbd_conn_handler_loop+0x30c/0x550 [ 7.212280] kthread+0x160/0x190 [ 7.212762] ret_from_fork+0x1f/0x30 [ 7.212981] Cc: stable@vger.kernel.org Reported-by: Chih-Yen Chang Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 25933573ef48f3586f559c2cac6c436c62dcf63f Author: Namjae Jeon Date: Tue May 30 21:42:34 2023 +0900 ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR() Dan reported the following error message: fs/smb/server/smbacl.c:1296 smb_check_perm_dacl() error: 'posix_acls' dereferencing possible ERR_PTR() fs/smb/server/vfs.c:1323 ksmbd_vfs_make_xattr_posix_acl() error: 'posix_acls' dereferencing possible ERR_PTR() fs/smb/server/vfs.c:1830 ksmbd_vfs_inherit_posix_acl() error: 'acls' dereferencing possible ERR_PTR() __get_acl() returns a mix of error pointers and NULL. This change it with IS_ERR_OR_NULL(). Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit fc6c6a3c324c1b3e93a03d0cfa3749c781f23de0 Author: Namjae Jeon Date: Sun May 28 00:23:41 2023 +0900 ksmbd: fix out-of-bound read in parse_lease_state() This bug is in parse_lease_state, and it is caused by the missing check of `struct create_context`. When the ksmbd traverses the create_contexts, it doesn't check if the field of `NameOffset` and `Next` is valid, The KASAN message is following: [ 6.664323] BUG: KASAN: slab-out-of-bounds in parse_lease_state+0x7d/0x280 [ 6.664738] Read of size 2 at addr ffff888005c08988 by task kworker/0:3/103 ... [ 6.666644] Call Trace: [ 6.666796] [ 6.666933] dump_stack_lvl+0x33/0x50 [ 6.667167] print_report+0xcc/0x620 [ 6.667903] kasan_report+0xae/0xe0 [ 6.668374] kasan_check_range+0x35/0x1b0 [ 6.668621] parse_lease_state+0x7d/0x280 [ 6.668868] smb2_open+0xbe8/0x4420 [ 6.675137] handle_ksmbd_work+0x282/0x820 Use smb2_find_context_vals() to find smb2 create request lease context. smb2_find_context_vals validate create context fields. Cc: stable@vger.kernel.org Reported-by: Chih-Yen Chang Tested-by: Chih-Yen Chang Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit f1a411873c85b642f13b01f21b534c2bab81fc1b Author: Namjae Jeon Date: Sun May 28 00:23:09 2023 +0900 ksmbd: fix out-of-bound read in deassemble_neg_contexts() The check in the beginning is `clen + sizeof(struct smb2_neg_context) <= len_of_ctxts`, but in the end of loop, `len_of_ctxts` will subtract `((clen + 7) & ~0x7) + sizeof(struct smb2_neg_context)`, which causes integer underflow when clen does the 8 alignment. We should use `(clen + 7) & ~0x7` in the check to avoid underflow from happening. Then there are some variables that need to be declared unsigned instead of signed. [ 11.671070] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x799/0x1610 [ 11.671533] Read of size 2 at addr ffff888005e86cf2 by task kworker/0:0/7 ... [ 11.673383] Call Trace: [ 11.673541] [ 11.673679] dump_stack_lvl+0x33/0x50 [ 11.673913] print_report+0xcc/0x620 [ 11.674671] kasan_report+0xae/0xe0 [ 11.675171] kasan_check_range+0x35/0x1b0 [ 11.675412] smb2_handle_negotiate+0x799/0x1610 [ 11.676217] ksmbd_smb_negotiate_common+0x526/0x770 [ 11.676795] handle_ksmbd_work+0x274/0x810 ... Cc: stable@vger.kernel.org Signed-off-by: Chih-Yen Chang Tested-by: Chih-Yen Chang Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit b0fd1852bcc21accca6260ef245356d5c141ff66 Author: KP Singh Date: Fri Jun 2 02:26:12 2023 +0200 bpf: Fix UAF in task local storage When task local storage was generalized for tracing programs, the bpf_task_local_storage callback was moved from a BPF LSM hook callback for security_task_free LSM hook to it's own callback. But a failure case in bad_fork_cleanup_security was missed which, when triggered, led to a dangling task owner pointer and a subsequent use-after-free. Move the bpf_task_storage_free to the very end of free_task to handle all failure cases. This issue was noticed when a BPF LSM program was attached to the task_alloc hook on a kernel with KASAN enabled. The program used bpf_task_storage_get to copy the task local storage from the current task to the new task being created. Fixes: a10787e6d58c ("bpf: Enable task local storage for tracing programs") Reported-by: Kuba Piecuch Signed-off-by: KP Singh Acked-by: Song Liu Link: https://lore.kernel.org/r/20230602002612.1117381-1-kpsingh@kernel.org Signed-off-by: Martin KaFai Lau commit 2b7497739fc8b4f411b70b78044a9fc21d34d18d Merge: 26d147799001e 2e45a49531fef Author: Linus Torvalds Date: Fri Jun 2 13:13:50 2023 -0400 Merge tag 'block-6.4-2023-06-02' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Just an NVMe pull request with (mostly) KATO fixes, a regression fix for zoned device revalidation, and a fix for an md raid5 regression" * tag 'block-6.4-2023-06-02' of git://git.kernel.dk/linux: nvme: fix the name of Zone Append for verbose logging nvme: improve handling of long keep alives nvme: check IO start time when deciding to defer KA nvme: double KA polling frequency to avoid KATO with TBKAS on nvme: fix miss command type check block: fix revalidate performance regression md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk() commit 26d147799001edfe479c0b015ba1cb038def5ae7 Merge: 921bdc72a0d68 4ea0bf4b98d66 Author: Linus Torvalds Date: Fri Jun 2 13:08:27 2023 -0400 Merge tag 'io_uring-6.4-2023-06-02' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a single revert in here, removing the warning on the epoll ctl opcode. We originally deprecated this a few releases ago, but I've since had two people report that it's being used. Which isn't the biggest deal, obviously this is why we out in the deprecation notice in the first place, but it also means that we should just kill this warning again and abandon the deprecation plans. Since it's only a few handfuls of code to support epoll ctl, not worth going any further with this imho" * tag 'io_uring-6.4-2023-06-02' of git://git.kernel.dk/linux: io_uring: undeprecate epoll_ctl support commit c3d03e8e35e005e1a614e51bb59053eeb5857f76 Author: Roberto Sassu Date: Thu Dec 8 10:56:46 2022 +0100 KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() Commit ac4e97abce9b8 ("scatterlist: sg_set_buf() argument must be in linear mapping") checks that both the signature and the digest reside in the linear mapping area. However, more recently commit ba14a194a434c ("fork: Add generic vmalloced stack support") made it possible to move the stack in the vmalloc area, which is not contiguous, and thus not suitable for sg_set_buf() which needs adjacent pages. Always make a copy of the signature and digest in the same buffer used to store the key and its parameters, and pass them to sg_init_one(). Prefer it to conditionally doing the copy if necessary, to keep the code simple. The buffer allocated with kmalloc() is in the linear mapping area. Cc: stable@vger.kernel.org # 4.9.x Fixes: ba14a194a434 ("fork: Add generic vmalloced stack support") Link: https://lore.kernel.org/linux-integrity/Y4pIpxbjBdajymBJ@sol.localdomain/ Suggested-by: Eric Biggers Signed-off-by: Roberto Sassu Reviewed-by: Eric Biggers Tested-by: Stefan Berger commit 921bdc72a0d68977092d6a64855a1b8967acc1d9 Merge: 7bdecc2672271 0b5d5c436a5c5 Author: Linus Torvalds Date: Fri Jun 2 08:35:13 2023 -0400 Merge tag 'mmc-v6.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix pwrseq for WILC1000/WILC3000 SDIO card MMC host: - vub300: Fix invalid response handling" * tag 'mmc-v6.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order mmc: vub300: fix invalid response handling commit 7bdecc26722710bad806bc583a92881a2fa51c73 Merge: e99a74673a196 b3fc95709c54f Author: Linus Torvalds Date: Fri Jun 2 08:21:18 2023 -0400 Merge tag 'iommu-fixes-v6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: "AMD IOMMU fixes: - Fix domain type and size checks - IOTLB flush fix for invalidating ranges - Guest IRQ handling fixes and GALOG overflow fix Rockchip IOMMU: - Error handling fix Mediatek IOMMU: - IOTLB flushing fix Renesas IOMMU: - Fix Kconfig dependencies to avoid build errors on RiscV" * tag 'iommu-fixes-v6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/mediatek: Flush IOTLB completely only if domain has been attached iommu/amd/pgtbl_v2: Fix domain max address iommu/amd: Fix domain flush size when syncing iotlb iommu/amd: Add missing domain type checks iommu/amd: Fix up merge conflict resolution iommu/amd: Handle GALog overflows iommu/amd: Don't block updates to GATag if guest mode is on iommu/rockchip: Fix unwind goto issue iommu: Make IPMMU_VMSA dependencies more strict commit 0e2aba694866b451db0932a6706683c48379134c Author: Jisheng Zhang Date: Wed May 24 21:13:05 2023 +0800 arm64: mm: pass original fault address to handle_mm_fault() in PER_VMA_LOCK block When reading the arm64's PER_VMA_LOCK support code, I found a bit difference between arm64 and other arch when calling handle_mm_fault() during VMA lock-based page fault handling: the fault address is masked before passing to handle_mm_fault(). This is also different from the usage in mmap_lock-based handling. I think we need to pass the original fault address to handle_mm_fault() as we did in commit 84c5e23edecd ("arm64: mm: Pass original fault address to handle_mm_fault()"). If we go through the code path further, we can find that the "masked" fault address can cause mismatched fault address between perf sw major/minor page fault sw event and perf page fault sw event: do_page_fault perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, ..., addr) // orig addr handle_mm_fault mm_account_fault perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, ...) // masked addr Fixes: cd7f176aea5f ("arm64/mm: try VMA lock-based page fault handling first") Signed-off-by: Jisheng Zhang Reviewed-by: Suren Baghdasaryan Reviewed-by: Anshuman Khandual Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20230524131305.2808-1-jszhang@kernel.org Signed-off-by: Will Deacon commit f3c3762178fad5cf5dc108fb061ba010818323b4 Author: Catalin Marinas Date: Fri May 19 18:14:40 2023 +0100 arm64: Remove the ARCH_FORCE_MAX_ORDER config input prompt Commit 34affcd7577a ("arm64: drop ranges in definition of ARCH_FORCE_MAX_ORDER") dropped the ranges from the config entry and introduced an EXPERT condition on the input prompt instead. However, starting with defconfig (ARCH_FORCE_MAX_ORDER of 10) and setting ARM64_64K_PAGES together with EXPERT leaves MAX_ORDER 10 which fails to build in this configuration. Drop the input prompt for ARCH_FORCE_MAX_ORDER completely so that it's no longer configurable. People requiring a higher MAX_ORDER should send a patch changing the default, together with proper justification. Fixes: 34affcd7577a ("arm64: drop ranges in definition of ARCH_FORCE_MAX_ORDER") Signed-off-by: Catalin Marinas Reported-by: Marc Zyngier Cc: Will Deacon Cc: Mike Rapoport Cc: Andrew Morton Cc: Justin M. Forbes Reviewed-by: Anshuman Khandual Acked-by: Marc Zyngier Acked-by: Mike Rapoport (IBM) Link: https://lore.kernel.org/r/20230519171440.1941213-1-catalin.marinas@arm.com Signed-off-by: Will Deacon commit 32cf0046a652116d6a216d575f3049a9ff9dd80d Author: Chancel Liu Date: Tue May 30 18:30:12 2023 +0800 ASoC: fsl_sai: Enable BCI bit if SAI works on synchronous mode with BYP asserted There's an issue on SAI synchronous mode that TX/RX side can't get BCLK from RX/TX it sync with if BYP bit is asserted. It's a workaround to fix it that enable SION of IOMUX pad control and assert BCI. For example if TX sync with RX which means both TX and RX are using clk form RX and BYP=1. TX can get BCLK only if the following two conditions are valid: 1. SION of RX BCLK IOMUX pad is set to 1 2. BCI of TX is set to 1 Signed-off-by: Chancel Liu Acked-by: Shengjiu Wang Link: https://lore.kernel.org/r/20230530103012.3448838-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit 635071f5fee31550e921644b2becc42b3ff1036c Author: Robert Hancock Date: Thu Jun 1 19:19:35 2023 -0600 ASoC: simple-card-utils: fix PCM constraint error check The code in asoc_simple_startup was treating any non-zero return from snd_pcm_hw_constraint_minmax as an error, when this can return 1 in some normal cases and only negative values indicate an error. When this happened, it caused asoc_simple_startup to disable the clocks it just enabled and return 1, which was not treated as an error by the calling code which only checks for negative return values. Then when the PCM is eventually shut down, it causes the clock framework to complain about disabling clocks that were not enabled. Fix the check for snd_pcm_hw_constraint_minmax return value to only treat negative values as an error. Fixes: 5ca2ab459817 ("ASoC: simple-card-utils: Add new system-clock-fixed flag") Signed-off-by: Robert Hancock Link: https://lore.kernel.org/r/20230602011936.231931-1-robert.hancock@calian.com Signed-off-by: Mark Brown commit e99a74673a19631d4a23c7e1fe2f21c55471a5d1 Merge: 1419c3ba31446 b6ccf213d95e9 Author: Linus Torvalds Date: Fri Jun 2 07:42:22 2023 -0400 Merge tag 'drm-fixes-2023-06-02' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Quiet enough week, though the misc fixes tree didn't get to me when I was sending this, so maybe it'll be a bit bigger next week, just one i915 fix and some scattered amdgpu fixes: amdgpu: - Fix mclk and fclk output ordering on some APUs - Fix display regression with 5K VRR - VCN, JPEG spurious interrupt warning fixes - Fix SI DPM on some ARM64 platforms - Fix missing TMZ enablement on GC 11.0.1 i915: - Fix for OA reporting to allow detecting non-power-of-two reports" * tag 'drm-fixes-2023-06-02' of git://anongit.freedesktop.org/drm/drm: drm/i915/perf: Clear out entire reports after reading if not power of 2 size drm/amdgpu: enable tmz by default for GC 11.0.1 drm/amd/pm: resolve reboot exception for si oland drm/amdgpu: add RAS POISON interrupt funcs for jpeg_v4_0 drm/amdgpu: add RAS POISON interrupt funcs for jpeg_v2_6 drm/amdgpu: separate ras irq from jpeg instance irq for UVD_POISON drm/amdgpu: add RAS POISON interrupt funcs for vcn_v4_0 drm/amdgpu: add RAS POISON interrupt funcs for vcn_v2_6 drm/amdgpu: separate ras irq from vcn instance irq for UVD_POISON Revert "drm/amd/display: Do not set drr on pipe commit" Revert "drm/amd/display: Block optimize on consecutive FAMS enables" drm/amd/pm: reverse mclk and fclk clocks levels for renoir drm/amd/pm: reverse mclk and fclk clocks levels for vangogh drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5 drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4 commit 1419c3ba31446feecb728f49820ff2730d6deaed Merge: c43a6ff9f93f2 42c4e97e06a83 Author: Linus Torvalds Date: Fri Jun 2 07:30:27 2023 -0400 Merge tag 'selinux-pr-20230601' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fix from Paul Moore: "A small SELinux Makefile fix to resolve a problem seen when building the kernel with older versions of make. The fix is pretty trivial and effectively reverts a patch that was merged during the last merge window" * tag 'selinux-pr-20230601' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: don't use make's grouped targets feature yet commit 37a826d86ff746c4eac8bd3415af19f3c9598206 Author: Arnd Bergmann Date: Thu Jun 1 23:31:04 2023 +0200 net: dsa: qca8k: add CONFIG_LEDS_TRIGGERS dependency Without LED triggers, the driver now fails to build: drivers/net/dsa/qca/qca8k-leds.c: In function 'qca8k_parse_port_leds': drivers/net/dsa/qca/qca8k-leds.c:403:31: error: 'struct led_classdev' has no member named 'hw_control_is_supported' 403 | port_led->cdev.hw_control_is_supported = qca8k_cled_hw_control_is_supported; | ^ There is a mix of 'depends on' and 'select' for LEDS_TRIGGERS, so it's not clear what we should use here, but in general using 'depends on' causes fewer problems, so use that. Fixes: e0256648c831a ("net: dsa: qca8k: implement hw_control ops") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit f1832e2b5e498e258b090af3b065b85cf8cc5161 Author: Jerry Meng Date: Wed May 31 11:51:16 2023 +0800 USB: serial: option: add Quectel EM061KGL series Add support for Quectel EM061KGL series which are based on Qualcomm SDX12 chip: EM061KGL_LTA(0x2c7c / 0x0123): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL EM061KGL_LMS(0x2c7c / 0x0124): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL EM061KGL_LWW(0x2c7c / 0x6008): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL EM061KGL_LCN(0x2c7c / 0x6009): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL Above products use the exact same interface layout and option driver is for interfaces DIAG, NMEA and AT. T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=6008 Rev= 5.04 S: Manufacturer=Quectel S: Product=Quectel EM061K-GL S: SerialNumber=f6fa08b6 C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Jerry Meng Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit f93b30e50a81a16cefa262b68bde5c4096ea9235 Author: Jiasheng Jiang Date: Thu Jun 1 11:30:02 2023 +0800 net: systemport: Replace platform_get_irq with platform_get_irq_optional Replace platform_get_irq with platform_get_irq_optional because wol_irq is optional. Signed-off-by: Jiasheng Jiang Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e209fee4118fe9a449d4d805361eb2de6796be39 Author: Akihiro Suda Date: Thu Jun 1 12:13:05 2023 +0900 net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294 With this commit, all the GIDs ("0 4294967294") can be written to the "net.ipv4.ping_group_range" sysctl. Note that 4294967295 (0xffffffff) is an invalid GID (see gid_valid() in include/linux/uidgid.h), and an attempt to register this number will cause -EINVAL. Prior to this commit, only up to GID 2147483647 could be covered. Documentation/networking/ip-sysctl.rst had "0 4294967295" as an example value, but this example was wrong and causing -EINVAL. Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Co-developed-by: Kuniyuki Iwashima Signed-off-by: Kuniyuki Iwashima Signed-off-by: Akihiro Suda Signed-off-by: David S. Miller commit 5a59a58ec25d44f853c26bdbfda47d73b3067435 Author: Alexander Sverdlin Date: Wed May 31 16:38:26 2023 +0200 net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods LAN9303 doesn't associate FDB (ALR) entries with VLANs, it has just one global Address Logic Resolution table [1]. Ignore VID in port_fdb_{add|del} methods, go on with the global table. This is the same semantics as hellcreek or RZ/N1 implement. Visible symptoms: LAN9303_MDIO 5b050000.ethernet-1:00: port 2 failed to delete 00:xx:xx:xx:xx:cf vid 1 from fdb: -2 LAN9303_MDIO 5b050000.ethernet-1:00: port 2 failed to add 00:xx:xx:xx:xx:cf vid 1 to fdb: -95 [1] https://ww1.microchip.com/downloads/en/DeviceDoc/00002308A.pdf Fixes: 0620427ea0d6 ("net: dsa: lan9303: Add fdb/mdb manipulation") Signed-off-by: Alexander Sverdlin Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230531143826.477267-1-alexander.sverdlin@siemens.com Signed-off-by: Jakub Kicinski commit ed779fe4c9b5a20b4ab4fd6f3e19807445bb78c7 Author: Qingfang DENG Date: Thu Jun 1 09:54:32 2023 +0800 neighbour: fix unaligned access to pneigh_entry After the blamed commit, the member key is longer 4-byte aligned. On platforms that do not support unaligned access, e.g., MIPS32R2 with unaligned_action set to 1, this will trigger a crash when accessing an IPv6 pneigh_entry, as the key is cast to an in6_addr pointer. Change the type of the key to u32 to make it aligned. Fixes: 62dd93181aaa ("[IPV6] NDISC: Set per-entry is_router flag in Proxy NA.") Signed-off-by: Qingfang DENG Link: https://lore.kernel.org/r/20230601015432.159066-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 6966d7988c4fb6af3e395868e9800c07f9e98a30 Author: Alexandre Ghiti Date: Fri Apr 28 14:01:20 2023 +0200 riscv: Implement missing huge_ptep_get huge_ptep_get must be reimplemented in order to go through all the PTEs of a NAPOT region: this is needed because the HW can update the A/D bits of any of the PTE that constitutes the NAPOT region. Fixes: 82a1a1f3bfb6 ("riscv: mm: support Svnapot in hugetlb page") Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230428120120.21620-2-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 835e5ac3f98e78eca5c512bd48bd1880b90c4eb1 Author: Alexandre Ghiti Date: Fri Apr 28 14:01:19 2023 +0200 riscv: Fix huge_ptep_set_wrprotect when PTE is a NAPOT We need to avoid inconsistencies across the PTEs that form a NAPOT region, so when we write protect such a region, we should clear and flush all the PTEs to make sure that any of those PTEs is not cached which would result in such inconsistencies (arm64 does the same). Fixes: 82a1a1f3bfb6 ("riscv: mm: support Svnapot in hugetlb page") Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230428120120.21620-1-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit c43a6ff9f93f230cc0f448ebb5d86d277ad7771e Merge: 792fc92140366 fadb74f9f2f60 Author: Linus Torvalds Date: Thu Jun 1 20:48:16 2023 -0400 Merge tag 'modules-6.4-rc5-second-pull' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull modules fix from Luis Chamberlain: "A zstd fix by lucas as he tested zstd decompression support" * tag 'modules-6.4-rc5-second-pull' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module/decompress: Fix error checking on zstd decompression commit 792fc9214036633f2c26fe551cd26d5d7abdecfb Merge: 9e87b63ed37e2 36e4fc57fc161 Author: Linus Torvalds Date: Thu Jun 1 20:43:11 2023 -0400 Merge tag 'efi-fixes-for-v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: "A few minor fixes for EFI, one of which fixes the reported boot regression when booting x86 kernels using the BIOS based loader built into the hypervisor framework on macOS. - fix harmless warning in zboot code on 'make clean' - add some missing prototypes - fix boot regressions triggered by PE/COFF header image minor version bump" * tag 'efi-fixes-for-v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: Bump stub image version for macOS HVF compatibility efi: fix missing prototype warnings efi/libstub: zboot: Avoid eager evaluation of objcopy flags commit b6ccf213d95e9373ac1f7fbcb5de3b52eec0ddb3 Merge: f9e94d6c85e90 62fe398761cd0 Author: Dave Airlie Date: Fri Jun 2 10:33:29 2023 +1000 Merge tag 'drm-intel-fixes-2023-06-01' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix for OA reporting to allow detecting non-power-of-two reports Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZHimf55x/DyXYar1@jlahtine-mobl.ger.corp.intel.com commit f9e94d6c85e9083466fef9a1ccd5b6b46f13af32 Merge: 7877cb91f1081 663b930e24842 Author: Dave Airlie Date: Fri Jun 2 09:52:47 2023 +1000 Merge tag 'amd-drm-fixes-6.4-2023-05-31' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.4-2023-05-31: amdgpu: - Fix mclk and fclk output ordering on some APUs - Fix display regression with 5K VRR - VCN, JPEG spurious interrupt warning fixes - Fix SI DPM on some ARM64 platforms - Fix missing TMZ enablement on GC 11.0.1 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230601033846.7628-1-alexander.deucher@amd.com commit 18e7e3e4217083a682e2c7282011c70c8a1ba070 Author: Kamal Heib Date: Mon May 29 11:35:26 2023 -0400 RDMA/bnxt_re: Fix reporting active_{speed,width} attributes After commit 6d758147c7b8 ("RDMA/bnxt_re: Use auxiliary driver interface") the active_{speed, width} attributes are reported incorrectly, This is happening because ib_get_eth_speed() is called only once from bnxt_re_ib_init() - Fix this issue by calling ib_get_eth_speed() from bnxt_re_query_port(). Fixes: 6d758147c7b8 ("RDMA/bnxt_re: Use auxiliary driver interface") Link: https://lore.kernel.org/r/20230529153525.87254-1-kheib@redhat.com Signed-off-by: Kamal Heib Acked-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 9e87b63ed37e202c77aa17d4112da6ae0c7c097c Merge: b0e78154c0876 d19663edc91de Author: Linus Torvalds Date: Thu Jun 1 17:50:22 2023 -0400 Merge tag 'fbdev-for-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "Most notable is a fix for a null-ptr-deref in fbcon's soft_cursor function which was found by syzbot. - Fix null-ptr-deref in soft_cursor - various remove callback conversions - error path fixes in imsttfb" * tag 'fbdev-for-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: bw2: Convert to platform remove callback returning void fbdev: broadsheetfb: Convert to platform remove callback returning void fbdev: au1200fb: Convert to platform remove callback returning void fbdev: au1100fb: Convert to platform remove callback returning void fbdev: arcfb: Convert to platform remove callback returning void fbdev: au1100fb: Drop if with an always false condition fbcon: Fix null-ptr-deref in soft_cursor fbdev: imsttfb: Fix error path of imsttfb_probe() fbdev: imsttfb: Release framebuffer and dealloc cmap on error path fbdev: matroxfb ssd1307fb: Switch i2c drivers back to use .probe() commit fadb74f9f2f609238070c7ca1b04933dc9400e4a Author: Lucas De Marchi Date: Thu Jun 1 14:23:31 2023 -0700 module/decompress: Fix error checking on zstd decompression While implementing support for in-kernel decompression in kmod, finit_module() was returning a very suspicious value: finit_module(3, "", MODULE_INIT_COMPRESSED_FILE) = 18446744072717407296 It turns out the check for module_get_next_page() failing is wrong, and hence the decompression was not really taking place. Invert the condition to fix it. Fixes: 169a58ad824d ("module/decompress: Support zstd in-kernel decompression") Cc: stable@kernel.org Cc: Luis Chamberlain Cc: Dmitry Torokhov Cc: Stephen Boyd Signed-off-by: Lucas De Marchi Signed-off-by: Luis Chamberlain commit b0e78154c0876a46ec874615262bd3ea58b80788 Merge: 714069daa5d34 c4d28e30a8d0b Author: Linus Torvalds Date: Thu Jun 1 17:35:17 2023 -0400 Merge tag 'mtd/fixes-for-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fixes from Miquel Raynal: "MTD core: - MAINTAINERS: Add Michal as reviewer instead of Naga - mtdchar: Mark bits of ioctl handler noinline NAND controller drivers: - marvell: - Don't set the NAND frequency select - Ensure timing values are written - ingenic: Fix empty stub helper definitions SPI-NOR core: - Fix divide by zero for spi-nor-generic flashes SPI-NOR manufacturer driver: - spansion: make sure local struct does not contain garbage" * tag 'mtd/fixes-for-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: marvell: don't set the NAND frequency select mtd: rawnand: marvell: ensure timing values are written mtdchar: mark bits of ioctl handler noinline MAINTAINERS: Add myself as reviewer instead of Naga mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes mtd: rawnand: ingenic: fix empty stub helper definitions mtd: spi-nor: spansion: make sure local struct does not contain garbage commit 714069daa5d345483578e2ff77fb6f06f4dcba6a Merge: f9010dbdce911 a451b8eb96e52 Author: Linus Torvalds Date: Thu Jun 1 17:29:18 2023 -0400 Merge tag 'net-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Happy Wear a Dress Day. Fairly standard-sized batch of fixes, accounting for the lack of sub-tree submissions this week. The mlx5 IRQ fixes are notable, people were complaining about that. No fires burning. Current release - regressions: - eth: mlx5e: - multiple fixes for dynamic IRQ allocation - prevent encap offload when neigh update is running - eth: mana: fix perf regression: remove rx_cqes, tx_cqes counters Current release - new code bugs: - eth: mlx5e: DR, add missing mutex init/destroy in pattern manager Previous releases - always broken: - tcp: deny tcp_disconnect() when threads are waiting - sched: prevent ingress Qdiscs from getting installed in random locations in the hierarchy and moving around - sched: flower: fix possible OOB write in fl_set_geneve_opt() - netlink: fix NETLINK_LIST_MEMBERSHIPS length report - udp6: fix race condition in udp6_sendmsg & connect - tcp: fix mishandling when the sack compression is deferred - rtnetlink: validate link attributes set at creation time - mptcp: fix connect timeout handling - eth: stmmac: fix call trace when stmmac_xdp_xmit() is invoked - eth: amd-xgbe: fix the false linkup in xgbe_phy_status - eth: mlx5e: - fix corner cases in internal buffer configuration - drain health before unregistering devlink - usb: qmi_wwan: set DTR quirk for BroadMobi BM818 Misc: - tcp: return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set" * tag 'net-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (71 commits) mptcp: fix active subflow finalization mptcp: add annotations around sk->sk_shutdown accesses mptcp: fix data race around msk->first access mptcp: consolidate passive msk socket initialization mptcp: add annotations around msk->subflow accesses mptcp: fix connect timeout handling rtnetlink: add the missing IFLA_GRO_ tb check in validate_linkmsg rtnetlink: move IFLA_GSO_ tb check to validate_linkmsg rtnetlink: call validate_linkmsg in rtnl_create_link ice: recycle/free all of the fragments from multi-buffer frame net: phy: mxl-gpy: extend interrupt fix to all impacted variants net: renesas: rswitch: Fix return value in error path of xmit net: dsa: mv88e6xxx: Increase wait after reset deactivation net: ipa: Use correct value for IPA_STATUS_SIZE tcp: fix mishandling when the sack compression is deferred. net/sched: flower: fix possible OOB write in fl_set_geneve_opt() sfc: fix error unwinds in TC offload net/mlx5: Read embedded cpu after init bit cleared net/mlx5e: Fix error handling in mlx5e_refresh_tirs net/mlx5: Ensure af_desc.mask is properly initialized ... commit f9010dbdce911ee1f1af1398a24b1f9f992e0080 Author: Mike Christie Date: Thu Jun 1 13:32:32 2023 -0500 fork, vhost: Use CLONE_THREAD to fix freezer/ps regression When switching from kthreads to vhost_tasks two bugs were added: 1. The vhost worker tasks's now show up as processes so scripts doing ps or ps a would not incorrectly detect the vhost task as another process. 2. kthreads disabled freeze by setting PF_NOFREEZE, but vhost tasks's didn't disable or add support for them. To fix both bugs, this switches the vhost task to be thread in the process that does the VHOST_SET_OWNER ioctl, and has vhost_worker call get_signal to support SIGKILL/SIGSTOP and freeze signals. Note that SIGKILL/STOP support is required because CLONE_THREAD requires CLONE_SIGHAND which requires those 2 signals to be supported. This is a modified version of the patch written by Mike Christie which was a modified version of patch originally written by Linus. Much of what depended upon PF_IO_WORKER now depends on PF_USER_WORKER. Including ignoring signals, setting up the register state, and having get_signal return instead of calling do_group_exit. Tidied up the vhost_task abstraction so that the definition of vhost_task only needs to be visible inside of vhost_task.c. Making it easier to review the code and tell what needs to be done where. As part of this the main loop has been moved from vhost_worker into vhost_task_fn. vhost_worker now returns true if work was done. The main loop has been updated to call get_signal which handles SIGSTOP, freezing, and collects the message that tells the thread to exit as part of process exit. This collection clears __fatal_signal_pending. This collection is not guaranteed to clear signal_pending() so clear that explicitly so the schedule() sleeps. For now the vhost thread continues to exist and run work until the last file descriptor is closed and the release function is called as part of freeing struct file. To avoid hangs in the coredump rendezvous and when killing threads in a multi-threaded exec. The coredump code and de_thread have been modified to ignore vhost threads. Remvoing the special case for exec appears to require teaching vhost_dev_flush how to directly complete transactions in case the vhost thread is no longer running. Removing the special case for coredump rendezvous requires either the above fix needed for exec or moving the coredump rendezvous into get_signal. Fixes: 6e890c5d5021 ("vhost: use vhost_tasks for worker threads") Signed-off-by: Eric W. Biederman Co-developed-by: Mike Christie Signed-off-by: Mike Christie Acked-by: Michael S. Tsirkin Signed-off-by: Linus Torvalds commit 403e97d6ab2cb6fd0ac1ff968cd7b691771f1613 Author: Francesco Dolcini Date: Wed May 31 13:10:38 2023 +0200 dt-bindings: serial: 8250_omap: add rs485-rts-active-high Add rs485-rts-active-high property, this was removed by mistake. In general we just use rs485-rts-active-low property, however the OMAP UART for legacy reason uses the -high one. Fixes: 767d3467eb60 ("dt-bindings: serial: 8250_omap: drop rs485 properties") Closes: https://lore.kernel.org/all/ZGefR4mTHHo1iQ7H@francesco-nb.int.toradex.com/ Signed-off-by: Francesco Dolcini Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230531111038.6302-1-francesco@dolcini.it Signed-off-by: Greg Kroah-Hartman commit 42c4e97e06a839b07d834f640a10911ad84ec8b3 Author: Paul Moore Date: Thu Jun 1 10:21:21 2023 -0400 selinux: don't use make's grouped targets feature yet The Linux Kernel currently only requires make v3.82 while the grouped target functionality requires make v4.3. Removed the grouped target introduced in 4ce1f694eb5d ("selinux: ensure av_permissions.h is built when needed") as well as the multiple header file targets in the make rule. This effectively reverts the problem commit. We will revisit this change when make >= 4.3 is required by the rest of the kernel. Cc: stable@vger.kernel.org Fixes: 4ce1f694eb5d ("selinux: ensure av_permissions.h is built when needed") Reported-by: Erwan Velu Reported-by: Luiz Capitulino Tested-by: Luiz Capitulino Signed-off-by: Paul Moore commit b00683422fd79dd07c9b75efdce1660e5e19150e Author: Bob Pearson Date: Wed May 17 16:15:10 2023 -0500 RDMA/rxe: Fix ref count error in check_rkey() There is a reference count error in error path code and a potential race in check_rkey() in rxe_resp.c. When looking up the rkey for a memory window the reference to the mw from rxe_lookup_mw() is dropped before a reference is taken on the mr referenced by the mw. If the mr is destroyed immediately after the call to rxe_put(mw) the mr pointer is unprotected and may end up pointing at freed memory. The rxe_get(mr) call should take place before the rxe_put(mw) call. All errors in check_rkey() call rxe_put(mw) if mw is not NULL but it was already called after the above. The mw pointer should be set to NULL after the rxe_put(mw) call to prevent this from happening. Fixes: cdd0b85675ae ("RDMA/rxe: Implement memory access through MWs") Link: https://lore.kernel.org/r/20230517211509.1819998-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit 9a3763e87379c97a78b7c6c6f40720b1e877174f Author: Bob Pearson Date: Wed May 17 12:22:42 2023 -0500 RDMA/rxe: Fix packet length checks In rxe_net.c a received packet, from udp or loopback, is passed to rxe_rcv() in rxe_recv.c as a udp packet. I.e. skb->data is pointing at the udp header. But rxe_rcv() makes length checks to verify the packet is long enough to hold the roce headers as if it were a roce packet. I.e. skb->data pointing at the bth header. A runt packet would appear to have 8 more bytes than it actually does which may lead to incorrect behavior. This patch calls skb_pull() to adjust the skb to point at the bth header before calling rxe_rcv() which fixes this error. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20230517172242.1806340-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit a451b8eb96e521ebabc9c53fefa2bcfad6f80f25 Merge: 66dd101487305 bbfa4b58997e3 Author: Jakub Kicinski Date: Thu Jun 1 10:15:43 2023 -0700 Merge tag 'mlx5-fixes-2023-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-05-31 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Read embedded cpu after init bit cleared net/mlx5e: Fix error handling in mlx5e_refresh_tirs net/mlx5: Ensure af_desc.mask is properly initialized net/mlx5: Fix setting of irq->map.index for static IRQ case net/mlx5: Remove rmap also in case dynamic MSIX not supported ==================== Link: https://lore.kernel.org/r/20230601031051.131529-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 2e45a49531fef55f4abbd6738c052545f53f43d4 Merge: 47fe1c3064c6b 856303797724d Author: Jens Axboe Date: Thu Jun 1 11:12:46 2023 -0600 Merge tag 'nvme-6.4-2023-06-01' of git://git.infradead.org/nvme into block-6.4 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.4 - Fixes for spurious Keep Alive timeouts (Uday) - Fix for command type check on passthrough actions (Min) - Fix for nvme command name for error logging (Christoph)" * tag 'nvme-6.4-2023-06-01' of git://git.infradead.org/nvme: nvme: fix the name of Zone Append for verbose logging nvme: improve handling of long keep alives nvme: check IO start time when deciding to defer KA nvme: double KA polling frequency to avoid KATO with TBKAS on nvme: fix miss command type check commit 9a7e8ec0d4cc64870ea449b4fce5779b77496cbb Author: Ism Hong Date: Thu Jun 1 17:53:55 2023 +0800 riscv: perf: Fix callchain parse error with kernel tracepoint events For RISC-V, when tracing with tracepoint events, the IP and status are set to 0, preventing the perf code parsing the callchain and resolving the symbols correctly. ./ply 'tracepoint:kmem/kmem_cache_alloc { @[stack]=count(); }' @: { }: 1 The fix is to implement perf_arch_fetch_caller_regs for riscv, which fills several necessary registers used for callchain unwinding, including epc, sp, s0 and status. It's similar to commit b3eac0265bf6 ("arm: perf: Fix callchain parse error with kernel tracepoint events") and commit 5b09a094f2fb ("arm64: perf: Fix callchain parse error with kernel tracepoint events"). With this patch, callchain can be parsed correctly as: ./ply 'tracepoint:kmem/kmem_cache_alloc { @[stack]=count(); }' @: { __traceiter_kmem_cache_alloc+68 __traceiter_kmem_cache_alloc+68 kmem_cache_alloc+354 __sigqueue_alloc+94 __send_signal_locked+646 send_signal_locked+154 do_send_sig_info+84 __kill_pgrp_info+130 kill_pgrp+60 isig+150 n_tty_receive_signal_char+36 n_tty_receive_buf_standard+2214 n_tty_receive_buf_common+280 n_tty_receive_buf2+26 tty_ldisc_receive_buf+34 tty_port_default_receive_buf+62 flush_to_ldisc+158 process_one_work+458 worker_thread+138 kthread+178 riscv_cpufeature_patch_func+832 }: 1 Signed-off-by: Ism Hong Link: https://lore.kernel.org/r/20230601095355.1168910-1-ism.hong@gmail.com Fixes: 178e9fc47aae ("perf: riscv: preliminary RISC-V support") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 66dd101487305345fefb359de07ab3101e03eb08 Merge: 3021dbfe3ef0a 55b47ca7d8081 Author: Jakub Kicinski Date: Thu Jun 1 10:04:06 2023 -0700 Merge branch 'mptcp-fixes-for-connect-timeout-access-annotations-and-subflow-init' Mat Martineau says: ==================== mptcp: Fixes for connect timeout, access annotations, and subflow init Patch 1 allows the SO_SNDTIMEO sockopt to correctly change the connect timeout on MPTCP sockets. Patches 2-5 add READ_ONCE()/WRITE_ONCE() annotations to fix KCSAN issues. Patch 6 correctly initializes some subflow fields on outgoing connections. ==================== Link: https://lore.kernel.org/r/20230531-send-net-20230531-v1-0-47750c420571@kernel.org Signed-off-by: Jakub Kicinski commit 55b47ca7d80814ceb63d64e032e96cd6777811e5 Author: Paolo Abeni Date: Wed May 31 12:37:08 2023 -0700 mptcp: fix active subflow finalization Active subflow are inserted into the connection list at creation time. When the MPJ handshake completes successfully, a new subflow creation netlink event is generated correctly, but the current code wrongly avoid initializing a couple of subflow data. The above will cause misbehavior on a few exceptional events: unneeded mptcp-level retransmission on msk-level sequence wrap-around and infinite mapping fallback even when a MPJ socket is present. Address the issue factoring out the needed initialization in a new helper and invoking the latter from __mptcp_finish_join() time for passive subflow and from mptcp_finish_join() for active ones. Fixes: 0530020a7c8f ("mptcp: track and update contiguous data status") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 6b9831bfd9322b297eb6d44257808cc055fdc586 Author: Paolo Abeni Date: Wed May 31 12:37:07 2023 -0700 mptcp: add annotations around sk->sk_shutdown accesses Christoph reported the mptcp variant of a recently addressed plain TCP issue. Similar to commit e14cadfd80d7 ("tcp: add annotations around sk->sk_shutdown accesses") add READ/WRITE ONCE annotations to silence KCSAN reports around lockless sk_shutdown access. Fixes: 71ba088ce0aa ("mptcp: cleanup accept and poll") Reported-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/401 Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 1b1b43ee7a208096ecd79e626f2fc90d4a321111 Author: Paolo Abeni Date: Wed May 31 12:37:06 2023 -0700 mptcp: fix data race around msk->first access The first subflow socket is accessed outside the msk socket lock by mptcp_subflow_fail(), we need to annotate each write access with WRITE_ONCE, but a few spots still lacks it. Fixes: 76a13b315709 ("mptcp: invoke MP_FAIL response when needed") Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 7e8b88ec35eef363040e08d99536d2bebef83774 Author: Paolo Abeni Date: Wed May 31 12:37:05 2023 -0700 mptcp: consolidate passive msk socket initialization When the msk socket is cloned at MPC handshake time, a few fields are initialized in a racy way outside mptcp_sk_clone() and the msk socket lock. The above is due historical reasons: before commit a88d0092b24b ("mptcp: simplify subflow_syn_recv_sock()") as the first subflow socket carrying all the needed date was not available yet at msk creation time We can now refactor the code moving the missing initialization bit under the socket lock, removing the init race and avoiding some code duplication. This will also simplify the next patch, as all msk->first write access are now under the msk socket lock. Fixes: 0397c6d85f9c ("mptcp: keep unaccepted MPC subflow into join list") Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 5b825727d0871b23e8867f6371183e61628b4a26 Author: Paolo Abeni Date: Wed May 31 12:37:04 2023 -0700 mptcp: add annotations around msk->subflow accesses The MPTCP can access the first subflow socket in a few spots outside the socket lock scope. That is actually safe, as MPTCP will delete the socket itself only after the msk sock close(). Still the such accesses causes a few KCSAN splats, as reported by Christoph. Silence the harmless warning adding a few annotation around the relevant accesses. Fixes: 71ba088ce0aa ("mptcp: cleanup accept and poll") Reported-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/402 Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 786fc12457268cc9b555dde6c22ae7300d4b40e1 Author: Paolo Abeni Date: Wed May 31 12:37:03 2023 -0700 mptcp: fix connect timeout handling Ondrej reported a functional issue WRT timeout handling on connect with a nice reproducer. The problem is that the current mptcp connect waits for both the MPTCP socket level timeout, and the first subflow socket timeout. The latter is not influenced/touched by the exposed setsockopt(). Overall the above makes the SO_SNDTIMEO a no-op on connect. Since mptcp_connect is invoked via inet_stream_connect and the latter properly handle the MPTCP level timeout, we can address the issue making the nested subflow level connect always unblocking. This also allow simplifying a bit the code, dropping an ugly hack to handle the fastopen and custom proto_ops connect. The issues predates the blamed commit below, but the current resolution requires the infrastructure introduced there. Fixes: 54f1944ed6d2 ("mptcp: factor out mptcp_connect()") Reported-by: Ondrej Mosnacek Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/399 Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 3021dbfe3ef0aae502347f62824b292697f55f88 Merge: abaf8d51b0ced 65d6914e253f3 Author: Jakub Kicinski Date: Thu Jun 1 09:59:45 2023 -0700 Merge branch 'rtnetlink-a-couple-of-fixes-in-linkmsg-validation' Xin Long says: ==================== rtnetlink: a couple of fixes in linkmsg validation validate_linkmsg() was introduced to do linkmsg validation for existing links. However, the new created links also need this linkmsg validation. Add validate_linkmsg() check for link creating in Patch 1, and add more tb checks into validate_linkmsg() in Patch 2 and 3. ==================== Link: https://lore.kernel.org/r/cover.1685548598.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 65d6914e253f3d83b724a9bbfc889ae95711e512 Author: Xin Long Date: Wed May 31 12:01:44 2023 -0400 rtnetlink: add the missing IFLA_GRO_ tb check in validate_linkmsg This fixes the issue that dev gro_max_size and gso_ipv4_max_size can be set to a huge value: # ip link add dummy1 type dummy # ip link set dummy1 gro_max_size 4294967295 # ip -d link show dummy1 dummy addrgenmode eui64 ... gro_max_size 4294967295 Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") Fixes: 9eefedd58ae1 ("net: add gso_ipv4_max_size and gro_ipv4_max_size per device") Reported-by: Xiumei Mu Signed-off-by: Xin Long Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit fef5b228dd38378148bc850f7e69a7783f3b95a4 Author: Xin Long Date: Wed May 31 12:01:43 2023 -0400 rtnetlink: move IFLA_GSO_ tb check to validate_linkmsg These IFLA_GSO_* tb check should also be done for the new created link, otherwise, they can be set to a huge value when creating links: # ip link add dummy1 gso_max_size 4294967295 type dummy # ip -d link show dummy1 dummy addrgenmode eui64 ... gso_max_size 4294967295 Fixes: 46e6b992c250 ("rtnetlink: allow GSO maximums to be set on device creation") Fixes: 9eefedd58ae1 ("net: add gso_ipv4_max_size and gro_ipv4_max_size per device") Signed-off-by: Xin Long Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit b0ad3c179059089d809b477a1d445c1183a7b8fe Author: Xin Long Date: Wed May 31 12:01:42 2023 -0400 rtnetlink: call validate_linkmsg in rtnl_create_link validate_linkmsg() was introduced by commit 1840bb13c22f5b ("[RTNL]: Validate hardware and broadcast address attribute for RTM_NEWLINK") to validate tb[IFLA_ADDRESS/BROADCAST] for existing links. The same check should also be done for newly created links. This patch adds validate_linkmsg() call in rtnl_create_link(), to avoid the invalid address set when creating some devices like: # ip link add dummy0 type dummy # ip link add link dummy0 name mac0 address 01:02 type macsec Fixes: 0e06877c6fdb ("[RTNETLINK]: rtnl_link: allow specifying initial device address") Signed-off-by: Xin Long Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit abaf8d51b0cedb16af51fb6b2189370d7515977c Author: Maciej Fijalkowski Date: Wed May 31 08:44:57 2023 -0700 ice: recycle/free all of the fragments from multi-buffer frame The ice driver caches next_to_clean value at the beginning of ice_clean_rx_irq() in order to remember the first buffer that has to be freed/recycled after main Rx processing loop. The end boundary is indicated by first descriptor of frame that Rx processing loop has ended its duties. Note that if mentioned loop ended in the middle of gathering multi-buffer frame, next_to_clean would be pointing to the descriptor in the middle of the frame BUT freeing/recycling stage will stop at the first descriptor. This means that next iteration of ice_clean_rx_irq() will miss the (first_desc, next_to_clean - 1) entries. When running various 9K MTU workloads, such splats were observed: [ 540.780716] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 540.787787] #PF: supervisor read access in kernel mode [ 540.793002] #PF: error_code(0x0000) - not-present page [ 540.798218] PGD 0 P4D 0 [ 540.800801] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 540.805231] CPU: 18 PID: 3984 Comm: xskxceiver Tainted: G W 6.3.0-rc7+ #96 [ 540.813619] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 540.824209] RIP: 0010:ice_clean_rx_irq+0x2b6/0xf00 [ice] [ 540.829678] Code: 74 24 10 e9 aa 00 00 00 8b 55 78 41 31 57 10 41 09 c4 4d 85 ff 0f 84 83 00 00 00 49 8b 57 08 41 8b 4f 1c 65 8b 35 1a fa 4b 3f <48> 8b 02 48 c1 e8 3a 39 c6 0f 85 a2 00 00 00 f6 42 08 02 0f 85 98 [ 540.848717] RSP: 0018:ffffc9000f42fc50 EFLAGS: 00010282 [ 540.854029] RAX: 0000000000000004 RBX: 0000000000000002 RCX: 000000000000fffe [ 540.861272] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff [ 540.868519] RBP: ffff88984a05ac00 R08: 0000000000000000 R09: dead000000000100 [ 540.875760] R10: ffff88983fffcd00 R11: 000000000010f2b8 R12: 0000000000000004 [ 540.883008] R13: 0000000000000003 R14: 0000000000000800 R15: ffff889847a10040 [ 540.890253] FS: 00007f6ddf7fe640(0000) GS:ffff88afdf800000(0000) knlGS:0000000000000000 [ 540.898465] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 540.904299] CR2: 0000000000000000 CR3: 000000010d3da001 CR4: 00000000007706e0 [ 540.911542] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 540.918789] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 540.926032] PKRU: 55555554 [ 540.928790] Call Trace: [ 540.931276] [ 540.933418] ice_napi_poll+0x4ca/0x6d0 [ice] [ 540.937804] ? __pfx_ice_napi_poll+0x10/0x10 [ice] [ 540.942716] napi_busy_loop+0xd7/0x320 [ 540.946537] xsk_recvmsg+0x143/0x170 [ 540.950178] sock_recvmsg+0x99/0xa0 [ 540.953729] __sys_recvfrom+0xa8/0x120 [ 540.957543] ? do_futex+0xbd/0x1d0 [ 540.961008] ? __x64_sys_futex+0x73/0x1d0 [ 540.965083] __x64_sys_recvfrom+0x20/0x30 [ 540.969155] do_syscall_64+0x38/0x90 [ 540.972796] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 540.977934] RIP: 0033:0x7f6de5f27934 To fix this, set cached_ntc to first_desc so that at the end, when freeing/recycling buffers, descriptors from first to ntc are not missed. Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") Signed-off-by: Maciej Fijalkowski Reviewed-by: Simon Horman Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230531154457.3216621-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 519d6487640835d19461817c75907e6308074a73 Author: Xu Liang Date: Wed May 31 15:48:22 2023 +0800 net: phy: mxl-gpy: extend interrupt fix to all impacted variants The interrupt fix in commit 97a89ed101bb should be applied on all variants of GPY2xx PHY and GPY115C. Fixes: 97a89ed101bb ("net: phy: mxl-gpy: disable interrupts on GPY215 by default") Signed-off-by: Xu Liang Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230531074822.39136-1-lxu@maxlinear.com Signed-off-by: Jakub Kicinski commit a60caf039e96d806b1ced893242bae82ba3ccf0d Author: Yoshihiro Shimoda Date: Mon May 29 16:38:17 2023 +0900 net: renesas: rswitch: Fix return value in error path of xmit Fix return value in the error path of rswitch_start_xmit(). If TX queues are full, this function should return NETDEV_TX_BUSY. Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20230529073817.1145208-1-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Jakub Kicinski commit 9c29c8c7df0688f358d2df5ddd16c97c2f7292b4 Author: Li Zhijian Date: Tue Apr 25 01:02:43 2023 +0000 RDMA/rtrs: Fix rxe_dealloc_pd warning In current design: 1. PD and clt_path->s.dev are shared among connections. 2. every con[n]'s cleanup phase will call destroy_con_cq_qp() 3. clt_path->s.dev will be always decreased in destroy_con_cq_qp(), and when clt_path->s.dev become zero, it will destroy PD. 4. when con[1] failed to create, con[1] will not take clt_path->s.dev, but it try to decreased clt_path->s.dev So, in case create_cm(con[0]) succeeds but create_cm(con[1]) fails, destroy_con_cq_qp(con[1]) will be called first which will destroy the PD while this PD is still taken by con[0]. Here, we refactor the error path of create_cm() and init_conns(), so that we do the cleanup in the order they are created. The warning occurs when destroying RXE PD whose reference count is not zero. rnbd_client L597: Mapping device /dev/nvme0n1 on session client, (access_mode: rw, nr_poll_queues: 0) ------------[ cut here ]------------ WARNING: CPU: 0 PID: 26407 at drivers/infiniband/sw/rxe/rxe_pool.c:256 __rxe_cleanup+0x13a/0x170 [rdma_rxe] Modules linked in: rpcrdma rdma_ucm ib_iser rnbd_client libiscsi rtrs_client scsi_transport_iscsi rtrs_core rdma_cm iw_cm ib_cm crc32_generic rdma_rxe udp_tunnel ib_uverbs ib_core kmem device_dax nd_pmem dax_pmem nd_vme crc32c_intel fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua dm_mirror dm_region_hash dm_log dm_mod CPU: 0 PID: 26407 Comm: rnbd-client.sh Kdump: loaded Not tainted 6.2.0-rc6-roce-flush+ #53 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__rxe_cleanup+0x13a/0x170 [rdma_rxe] Code: 45 84 e4 0f 84 5a ff ff ff 48 89 ef e8 5f 18 71 f9 84 c0 75 90 be c8 00 00 00 48 89 ef e8 be 89 1f fa 85 c0 0f 85 7b ff ff ff <0f> 0b 41 bc ea ff ff ff e9 71 ff ff ff e8 84 7f 1f fa e9 d0 fe ff RSP: 0018:ffffb09880b6f5f0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99401f15d6a8 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffffbac8234b RDI: 00000000ffffffff RBP: ffff99401f15d6d0 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000002d82 R11: 0000000000000000 R12: 0000000000000001 R13: ffff994101eff208 R14: ffffb09880b6f6a0 R15: 00000000fffffe00 FS: 00007fe113904740(0000) GS:ffff99413bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff6cde656c8 CR3: 000000001f108004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_dealloc_pd+0x16/0x20 [rdma_rxe] ib_dealloc_pd_user+0x4b/0x80 [ib_core] rtrs_ib_dev_put+0x79/0xd0 [rtrs_core] destroy_con_cq_qp+0x8a/0xa0 [rtrs_client] init_path+0x1e7/0x9a0 [rtrs_client] ? __pfx_autoremove_wake_function+0x10/0x10 ? lock_is_held_type+0xd7/0x130 ? rcu_read_lock_sched_held+0x43/0x80 ? pcpu_alloc+0x3dd/0x7d0 ? rtrs_clt_init_stats+0x18/0x40 [rtrs_client] rtrs_clt_open+0x24f/0x5a0 [rtrs_client] ? __pfx_rnbd_clt_link_ev+0x10/0x10 [rnbd_client] rnbd_clt_map_device+0x6a5/0xe10 [rnbd_client] Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") Link: https://lore.kernel.org/r/1682384563-2-4-git-send-email-lizhijian@fujitsu.com Signed-off-by: Li Zhijian Acked-by: Jack Wang Tested-by: Jack Wang Signed-off-by: Jason Gunthorpe commit 3bf3a7c6985c625f64e73baefdaa36f1c2045a29 Author: Li Zhijian Date: Tue Apr 25 01:02:42 2023 +0000 RDMA/rtrs: Fix the last iu->buf leak in err path The last iu->buf will leak if ib_dma_mapping_error() fails. Fixes: c0894b3ea69d ("RDMA/rtrs: core: lib functions shared between client and server modules") Link: https://lore.kernel.org/r/1682384563-2-3-git-send-email-lizhijian@fujitsu.com Signed-off-by: Li Zhijian Acked-by: Guoqing Jiang Acked-by: Jack Wang Signed-off-by: Jason Gunthorpe commit c4d28e30a8d0b979e4029465ab8f312ab6ce2644 Author: Chris Packham Date: Thu May 25 12:31:53 2023 +1200 mtd: rawnand: marvell: don't set the NAND frequency select marvell_nfc_setup_interface() uses the frequency retrieved from the clock associated with the nand interface to determine the timings that will be used. By changing the NAND frequency select without reflecting this in the clock configuration this means that the timings calculated don't correctly meet the requirements of the NAND chip. This hasn't been an issue up to now because of a different bug that was stopping the timings being updated after they were initially set. Fixes: b25251414f6e ("mtd: rawnand: marvell: Stop implementing ->select_chip()") Signed-off-by: Chris Packham Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230525003154.2303012-2-chris.packham@alliedtelesis.co.nz commit 8a6f4d346f3bad9c68b4a87701eb3f7978542d57 Author: Chris Packham Date: Thu May 25 12:31:52 2023 +1200 mtd: rawnand: marvell: ensure timing values are written When new timing values are calculated in marvell_nfc_setup_interface() ensure that they will be applied in marvell_nfc_select_target() by clearing the selected_chip pointer. Fixes: b25251414f6e ("mtd: rawnand: marvell: Stop implementing ->select_chip()") Suggested-by: Miquel Raynal Signed-off-by: Chris Packham Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230525003154.2303012-1-chris.packham@alliedtelesis.co.nz commit 0ea923f443350c8c5cca6eef5b748d52b903f46c Author: Arnd Bergmann Date: Mon Apr 17 22:56:50 2023 +0200 mtdchar: mark bits of ioctl handler noinline The addition of the mtdchar_read_ioctl() function caused the stack usage of mtdchar_ioctl() to grow beyond the warning limit on 32-bit architectures with gcc-13: drivers/mtd/mtdchar.c: In function 'mtdchar_ioctl': drivers/mtd/mtdchar.c:1229:1: error: the frame size of 1488 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Mark both the read and write portions as noinline_for_stack to ensure they don't get inlined and use separate stack slots to reduce the maximum usage, both in the mtdchar_ioctl() and combined with any of its callees. Fixes: 095bb6e44eb1 ("mtdchar: add MEMREAD ioctl") Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Richard Weinberger Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230417205654.1982368-1-arnd@kernel.org commit 444c17cfbc855bf6c1524f3813f6f667d9b708ff Author: Michal Simek Date: Fri May 26 19:41:54 2023 +0200 MAINTAINERS: Add myself as reviewer instead of Naga Naga no longer works for AMD/Xilinx and there is no activity from him to continue to maintain Xilinx related drivers. Add myself instead to be kept in loop if there is any need for testing. Signed-off-by: Michal Simek Signed-off-by: Miquel Raynal [: Manually apply on top of the latest -rc which where the MAINTAINERS file got sorted] Link: https://lore.kernel.org/linux-mtd/06df49c300c53a27423260e99acc217b06d4e588.1684827820.git.michal.simek@amd.com commit ce789307107e5344546ad196e3631c007b39b243 Merge: 524306c376427 dc93f0dcb436d Author: Mark Brown Date: Thu Jun 1 16:43:38 2023 +0100 ASoC: mediatek: fix use-after-free in driver remove Merge series from Trevor Wu : These patches concern modifications made in mt8186[1]. The clock unregistration mechanism used in mt8188 and mt8195 is similar with mt8186, resulting in the same problem existing within the driver. Therefore, the solution has also been applied to these two platforms. [1] https://lore.kernel.org/all/20230511092437.1.I31cceffc8c45bb1af16eb613e197b3df92cdc19e@changeid/ commit 1874a42a7d74ea85a63673875f4242722a9f624b Merge: cd69bf361e180 4420528254153 Author: Linus Torvalds Date: Thu Jun 1 11:18:20 2023 -0400 Merge tag 'firewire-fixes-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "A single patch to use a flexible array rather than a zero-length one" * tag 'firewire-fixes-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: Replace zero-length array with flexible-array member commit cd69bf361e18091bff20c6f80670911682803650 Merge: f39dda98bc7c3 8fe72b76db79d Author: Linus Torvalds Date: Thu Jun 1 11:13:10 2023 -0400 Merge tag 'mailbox-fixes-6.4-rc5' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox fix from Jassi Brar: "Fix missing mutex unlock in mailbox-test" * tag 'mailbox-fixes-6.4-rc5' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() commit 03c5c83b70dca3729a3eb488e668e5044bd9a5ea Author: Alexander Gordeev Date: Thu May 25 19:41:45 2023 +0200 s390/purgatory: disable branch profiling Avoid linker error for randomly generated config file that has CONFIG_BRANCH_PROFILE_NONE enabled and make it similar to riscv, x86 and also to commit 4bf3ec384edf ("s390: disable branch profiling for vdso"). Reviewed-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit 3c27f3d53d588618d81d30d6712459a3cc9489b8 Author: Andreas Svensson Date: Tue May 30 16:52:23 2023 +0200 net: dsa: mv88e6xxx: Increase wait after reset deactivation A switch held in reset by default needs to wait longer until we can reliably detect it. An issue was observed when testing on the Marvell 88E6393X (Link Street). The driver failed to detect the switch on some upstarts. Increasing the wait time after reset deactivation solves this issue. The updated wait time is now also the same as the wait time in the mv88e6xxx_hardware_reset function. Fixes: 7b75e49de424 ("net: dsa: mv88e6xxx: wait after reset deactivation") Signed-off-by: Andreas Svensson Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230530145223.1223993-1-andreas.svensson@axis.com Signed-off-by: Paolo Abeni commit 4420528254153189c70b6267593e445dc8654e37 Author: Gustavo A. R. Silva Date: Mon May 29 12:52:07 2023 -0600 firewire: Replace zero-length array with flexible-array member Zero-length and one-element arrays are deprecated, and we are moving towards adopting C99 flexible-array members, instead. Address the following warnings found with GCC-13 and -fstrict-flex-arrays=3 enabled: sound/firewire/amdtp-stream.c: In function ‘build_it_pkt_header’: sound/firewire/amdtp-stream.c:694:17: warning: ‘generate_cip_header’ accessing 8 bytes in a region of size 0 [-Wstringop-overflow=] 694 | generate_cip_header(s, cip_header, data_block_counter, syt); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/firewire/amdtp-stream.c:694:17: note: referencing argument 2 of type ‘__be32[2]’ {aka ‘unsigned int[2]’} sound/firewire/amdtp-stream.c:667:13: note: in a call to function ‘generate_cip_header’ 667 | static void generate_cip_header(struct amdtp_stream *s, __be32 cip_header[2], | ^~~~~~~~~~~~~~~~~~~ This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. Link: https://github.com/KSPP/linux/issues/21 Link: https://github.com/KSPP/linux/issues/303 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/ZHT0V3SpvHyxCv5W@work Signed-off-by: Takashi Sakamoto commit ead449023d3acb1424886d7b8cc672ed69bdd27e Author: Lorenzo Bianconi Date: Sun May 28 12:28:49 2023 +0200 wifi: mt76: mt7996: fix possible NULL pointer dereference in mt7996_mac_write_txwi() Fix possible NULL pointer dereference on mvif pointer in mt7996_mac_write_txwi routine. Fixes: 15ee62e73705 ("wifi: mt76: mt7996: enable BSS_CHANGED_BASIC_RATES support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/2637628a84f42ad6d7b774e706f041d5b45c8cb5.1685269638.git.lorenzo@kernel.org commit b408f33b35a4de606bfbd0de33b8f971bc5488ba Author: Ping-Ke Shih Date: Sat May 27 16:29:39 2023 +0800 wifi: rtw89: remove redundant check of entering LPS Originally, add this check rule to prevent entering LPS if more than one vif (in station mode) connect to AP. Since we have checked this by previous commit, remove this redundant check. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230527082939.11206-4-pkshih@realtek.com commit 26a125f550a3bf86ac91d38752f4d446426dfe1c Author: Ping-Ke Shih Date: Sat May 27 16:29:38 2023 +0800 wifi: rtw89: correct PS calculation for SUPPORTS_DYNAMIC_PS This driver relies on IEEE80211_CONF_PS of hw->conf.flags to turn off PS or turn on dynamic PS controlled by driver and firmware. Though this would be incorrect, it did work before because the flag is always recalculated until the commit 28977e790b5d ("wifi: mac80211: skip powersave recalc if driver SUPPORTS_DYNAMIC_PS") is introduced by kernel 5.20 to skip to recalculate IEEE80211_CONF_PS of hw->conf.flags if driver sets SUPPORTS_DYNAMIC_PS. Correct this by doing recalculation while BSS_CHANGED_PS is changed and interface is added or removed. For now, it is allowed to enter PS only if single one station vif is working, and it could possible to have PS per vif after firmware can support it. Without this fix, driver doesn't enter PS anymore that causes higher power consumption. Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") Cc: stable@vger.kernel.org # 6.1+ Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230527082939.11206-3-pkshih@realtek.com commit 3918dd0177ee08970683a2c22a3388825d82fd79 Author: Ping-Ke Shih Date: Sat May 27 16:29:37 2023 +0800 wifi: rtw88: correct PS calculation for SUPPORTS_DYNAMIC_PS This driver relies on IEEE80211_CONF_PS of hw->conf.flags to turn off PS or turn on dynamic PS controlled by driver and firmware. Though this would be incorrect, it did work before because the flag is always recalculated until the commit 28977e790b5d ("wifi: mac80211: skip powersave recalc if driver SUPPORTS_DYNAMIC_PS") is introduced by kernel 5.20 to skip to recalculate IEEE80211_CONF_PS of hw->conf.flags if driver sets SUPPORTS_DYNAMIC_PS. Correct this by doing recalculation while BSS_CHANGED_PS is changed and interface is added or removed. It is allowed to enter PS only if single one station vif is working. Without this fix, driver doesn't enter PS anymore that causes higher power consumption. Fixes: bcde60e599fb ("rtw88: remove misleading module parameter rtw_fw_support_lps") Cc: stable@vger.kernel.org # 6.1+ Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230527082939.11206-2-pkshih@realtek.com commit b675df0257bb717082f592626da3ddfc5bdc2b6b Author: Qu Wenruo Date: Thu Jun 1 18:51:34 2023 +0800 btrfs: zoned: fix dev-replace after the scrub rework [BUG] After commit e02ee89baa66 ("btrfs: scrub: switch scrub_simple_mirror() to scrub_stripe infrastructure"), scrub no longer works for zoned device at all. Even an empty zoned btrfs cannot be replaced: # mkfs.btrfs -f /dev/nvme0n1 # mount /dev/nvme0n1 /mnt/btrfs # btrfs replace start -Bf 1 /dev/nvme0n2 /mnt/btrfs Resetting device zones /dev/nvme1n1 (160 zones) ... ERROR: ioctl(DEV_REPLACE_START) failed on "/mnt/btrfs/": Input/output error And we can hit kernel crash related to that: BTRFS info (device nvme1n1): host-managed zoned block device /dev/nvme3n1, 160 zones of 134217728 bytes BTRFS info (device nvme1n1): dev_replace from /dev/nvme2n1 (devid 2) to /dev/nvme3n1 started nvme3n1: Zone Management Append(0x7d) @ LBA 65536, 4 blocks, Zone Is Full (sct 0x1 / sc 0xb9) DNR I/O error, dev nvme3n1, sector 786432 op 0xd:(ZONE_APPEND) flags 0x4000 phys_seg 3 prio class 2 BTRFS error (device nvme1n1): bdev /dev/nvme3n1 errs: wr 1, rd 0, flush 0, corrupt 0, gen 0 BUG: kernel NULL pointer dereference, address: 00000000000000a8 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:_raw_spin_lock_irqsave+0x1e/0x40 Call Trace: btrfs_lookup_ordered_extent+0x31/0x190 btrfs_record_physical_zoned+0x18/0x40 btrfs_simple_end_io+0xaf/0xc0 blk_update_request+0x153/0x4c0 blk_mq_end_request+0x15/0xd0 nvme_poll_cq+0x1d3/0x360 nvme_irq+0x39/0x80 __handle_irq_event_percpu+0x3b/0x190 handle_irq_event+0x2f/0x70 handle_edge_irq+0x7c/0x210 __common_interrupt+0x34/0xa0 common_interrupt+0x7d/0xa0 asm_common_interrupt+0x22/0x40 [CAUSE] Dev-replace reuses scrub code to iterate all extents and write the existing content back to the new device. And for zoned devices, we call fill_writer_pointer_gap() to make sure all the writes into the zoned device is sequential, even if there may be some gaps between the writes. However we have several different bugs all related to zoned dev-replace: - We are using ZONE_APPEND operation for metadata style write back For zoned devices, btrfs has two ways to write data: * ZONE_APPEND for data This allows higher queue depth, but will not be able to know where the write would land. Thus needs to grab the real on-disk physical location in it's endio. * WRITE for metadata This requires single queue depth (new writes can only be submitted after previous one finished), and all writes must be sequential. For scrub, we go single queue depth, but still goes with ZONE_APPEND, which requires btrfs_bio::inode being populated. This is the cause of that crash. - No correct tracing of write_pointer After a write finished, we should forward sctx->write_pointer, or fill_writer_pointer_gap() would not work properly and cause more than necessary zero out, and fill the whole zone prematurely. - Incorrect physical bytenr passed to fill_writer_pointer_gap() In scrub_write_sectors(), one call site passes logical address, which is completely wrong. The other call site passes physical address of current sector, but we should pass the physical address of the btrfs_bio we're submitting. This is the cause of the -EIO errors. [FIX] - Do not use ZONE_APPEND for btrfs_submit_repair_write(). - Manually forward sctx->write_pointer after successful writeback - Use the physical address of the to-be-submitted btrfs_bio for fill_writer_pointer_gap() Now zoned device replace would work as expected. Reported-by: Christoph Hellwig Fixes: e02ee89baa66 ("btrfs: scrub: switch scrub_simple_mirror() to scrub_stripe infrastructure") Reviewed-by: Christoph Hellwig Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 524306c3764276ce6cc7509908934982ce167039 Author: Richard Fitzgerald Date: Thu Jun 1 13:49:07 2023 +0100 ASoC: cs35l56: Remove NULL check from cs35l56_sdw_dai_set_stream() The dma pointer must be set to the passed stream pointer, even if that pointer is NULL. Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56") Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20230601124907.3128170-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 3a67ad17b47ed111bda692238b6a19420e6934c8 Author: Ryan Lee Date: Thu Jun 1 06:06:00 2023 -0700 ASoC: max98363: limit the number of channel to 1 MAX98363 is a mono amplifier. The number of channel needs to be always 1. Signed-off-by: Ryan Lee Link: https://lore.kernel.org/r/20230601130600.25344-2-ryan.lee.analog@gmail.com Signed-off-by: Mark Brown commit 0e2ee345856454632dcd2f3ee2ba4bb3f8632f74 Author: Ryan Lee Date: Thu Jun 1 06:05:59 2023 -0700 ASoC: max98363: Removed 32bit support MAX98363 does not support 32bit depth audio. Removed 32bit from the supported format list. Instead, added 16bit and 24bit to the list. Signed-off-by: Ryan Lee Link: https://lore.kernel.org/r/20230601130600.25344-1-ryan.lee.analog@gmail.com Signed-off-by: Mark Brown commit f39dda98bc7c30c42a0c2c6a51ac726437524583 Merge: ba059590ec97d 6199d23c91ce5 Author: Linus Torvalds Date: Thu Jun 1 09:02:04 2023 -0400 Merge tag 'for-linus-2023060101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - Regression fix for overlong long timeouts during initialization on some Logitech Unifying devices (Bastien Nocera) - error handling and overflow fixes for Wacom driver (Denis Arefev, Jason Gerecke, Nikita Zhandarovich) * tag 'for-linus-2023060101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: logitech-hidpp: Handle timeout differently from busy HID: wacom: Add error check to wacom_parse_and_register() HID: google: add jewel USB id HID: wacom: avoid integer overflow in wacom_intuos_inout() HID: wacom: Check for string overflow from strscpy calls commit fa58cc888d67e640e354d8b3ceef877ea167b0cf Author: Andreas Gruenbacher Date: Wed May 31 21:08:26 2023 +0200 gfs2: Don't get stuck writing page onto itself under direct I/O When a direct I/O write is performed, iomap_dio_rw() invalidates the part of the page cache which the write is going to before carrying out the write. In the odd case, the direct I/O write will be reading from the same page it is writing to. gfs2 carries out writes with page faults disabled, so it should have been obvious that this page invalidation can cause iomap_dio_rw() to never make any progress. Currently, gfs2 will end up in an endless retry loop in gfs2_file_direct_write() instead, though. Break this endless loop by limiting the number of retries and falling back to buffered I/O after that. Also simplify should_fault_in_pages() sightly and add a comment to make the above case easier to understand. Reported-by: Jan Kara Signed-off-by: Andreas Gruenbacher commit b320a45638296b63be8d9a901ca8bc43716b1ae1 Author: Eric Dumazet Date: Tue May 30 19:51:49 2023 +0000 bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready() syzbot found sk_psock(sk) could return NULL when called from sk_psock_verdict_data_ready(). Just make sure to handle this case. [1] general protection fault, probably for non-canonical address 0xdffffc000000005c: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000002e0-0x00000000000002e7] CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.4.0-rc3-syzkaller-00588-g4781e965e655 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/16/2023 RIP: 0010:sk_psock_verdict_data_ready+0x19f/0x3c0 net/core/skmsg.c:1213 Code: 4c 89 e6 e8 63 70 5e f9 4d 85 e4 75 75 e8 19 74 5e f9 48 8d bb e0 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 07 02 00 00 48 89 ef ff 93 e0 02 00 00 e8 29 fd RSP: 0018:ffffc90000147688 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000100 RDX: 000000000000005c RSI: ffffffff8825ceb7 RDI: 00000000000002e0 RBP: ffff888076518c40 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000008000 R15: ffff888076518c40 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901375bab0 CR3: 000000004bf26000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcp_data_ready+0x10a/0x520 net/ipv4/tcp_input.c:5006 tcp_data_queue+0x25d3/0x4c50 net/ipv4/tcp_input.c:5080 tcp_rcv_established+0x829/0x1f90 net/ipv4/tcp_input.c:6019 tcp_v4_do_rcv+0x65a/0x9c0 net/ipv4/tcp_ipv4.c:1726 tcp_v4_rcv+0x2cbf/0x3340 net/ipv4/tcp_ipv4.c:2148 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2ec/0x520 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:468 [inline] ip_rcv_finish+0x1cf/0x2f0 net/ipv4/ip_input.c:449 NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ip_rcv+0xae/0xd0 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5491 __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5605 process_backlog+0x101/0x670 net/core/dev.c:5933 __napi_poll+0xb7/0x6f0 net/core/dev.c:6499 napi_poll net/core/dev.c:6566 [inline] net_rx_action+0x8a9/0xcb0 net/core/dev.c:6699 __do_softirq+0x1d4/0x905 kernel/softirq.c:571 run_ksoftirqd kernel/softirq.c:939 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:931 smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164 kthread+0x344/0x440 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Fixes: 6df7f764cd3c ("bpf, sockmap: Wake up polling after data copy") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: Daniel Borkmann Reviewed-by: John Fastabend Link: https://lore.kernel.org/bpf/20230530195149.68145-1-edumazet@google.com commit ba059590ec97ddf137ac7f200bfc5c8ce90c0237 Merge: 8828003759391 7f875850f20a4 Author: Linus Torvalds Date: Thu Jun 1 08:41:33 2023 -0400 Merge tag 'ata-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fix from Damien Le Moal: - Fix ata_find_dev() use of the device number to find a struct ata_device for a port. This addresses issues with some passthrough commands with libsas managed devices. * tag 'ata-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: libata-scsi: Use correct device no in ata_find_dev() commit 8828003759391029fc45c15ac346622cdae19b6d Merge: 929ed21dfdb6e 6fe55c2799bc2 Author: Linus Torvalds Date: Thu Jun 1 08:27:34 2023 -0400 Merge tag '6.4-rc4-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: "Eight server fixes (most also for stable): - Two fixes for uninitialized pointer reads (rename and link) - Fix potential UAF in oplock break - Two fixes for potential out of bound reads in negotiate - Fix crediting bug - Two fixes for xfstests (allocation size fix for test 694 and lookup issue shown by test 464)" * tag '6.4-rc4-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: call putname after using the last component ksmbd: fix incorrect AllocationSize set in smb2_get_info ksmbd: fix UAF issue from opinfo->conn ksmbd: fix multiple out-of-bounds read during context decoding ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate ksmbd: fix credit count leakage ksmbd: fix uninitialized pointer read in smb2_create_link() ksmbd: fix uninitialized pointer read in ksmbd_vfs_rename() commit dc93f0dcb436dfd24a06c5b3c0f4c5cd9296e8e5 Author: Trevor Wu Date: Thu Jun 1 11:33:18 2023 +0800 ASoC: mediatek: mt8195: fix use-after-free in driver remove path During mt8195_afe_init_clock(), mt8195_audsys_clk_register() was called followed by several other devm functions. At mt8195_afe_deinit_clock() located at mt8195_afe_pcm_dev_remove(), mt8195_audsys_clk_unregister() was called. However, there was an issue with the order in which these functions were called. Specifically, the remove callback of platform_driver was called before devres released the resource, resulting in a use-after-free issue during remove time. At probe time, the order of calls was: 1. mt8195_audsys_clk_register 2. afe_priv->clk = devm_kcalloc 3. afe_priv->clk[i] = devm_clk_get At remove time, the order of calls was: 1. mt8195_audsys_clk_unregister 3. free afe_priv->clk[i] 2. free afe_priv->clk To resolve the problem, we can utilize devm_add_action_or_reset() in mt8195_audsys_clk_register() so that the remove order can be changed to 3->2->1. Fixes: 6746cc858259 ("ASoC: mediatek: mt8195: add platform driver") Signed-off-by: Trevor Wu Reviewed-by: Douglas Anderson Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230601033318.10408-3-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit fd67a7a1a22ce47fcbc094c4b6e164c34c652cbe Author: Trevor Wu Date: Thu Jun 1 11:33:17 2023 +0800 ASoC: mediatek: mt8188: fix use-after-free in driver remove path During mt8188_afe_init_clock(), mt8188_audsys_clk_register() was called followed by several other devm functions. The caller of mt8188_afe_init_clock() utilized devm_add_action_or_reset() to call mt8188_afe_deinit_clock(). However, the order was incorrect, causing a use-after-free issue during remove time. At probe time, the order of calls was: 1. mt8188_audsys_clk_register 2. afe_priv->clk = devm_kcalloc 3. afe_priv->clk[i] = devm_clk_get At remove time, the order of calls was: 1. mt8188_audsys_clk_unregister 3. free afe_priv->clk[i] 2. free afe_priv->clk To resolve the problem, it's necessary to move devm_add_action_or_reset() to the appropriate position so that the remove order can be 3->2->1. Fixes: f6b026479b13 ("ASoC: mediatek: mt8188: support audio clock control") Signed-off-by: Trevor Wu Reviewed-by: Douglas Anderson Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230601033318.10408-2-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit be7f8012a513f5099916ee2da28420156cbb8cf3 Author: Bert Karwatzki Date: Wed May 31 12:36:19 2023 +0200 net: ipa: Use correct value for IPA_STATUS_SIZE IPA_STATUS_SIZE was introduced in commit b8dc7d0eea5a as a replacement for the size of the removed struct ipa_status which had size sizeof(__le32[8]). Use this value as IPA_STATUS_SIZE. Fixes: b8dc7d0eea5a ("net: ipa: stop using sizeof(status)") Signed-off-by: Bert Karwatzki Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230531103618.102608-1-spasswolf@web.de Signed-off-by: Paolo Abeni commit 30c6f0bf9579debce27e45fac34fdc97e46acacc Author: fuyuanli Date: Wed May 31 16:01:50 2023 +0800 tcp: fix mishandling when the sack compression is deferred. In this patch, we mainly try to handle sending a compressed ack correctly if it's deferred. Here are more details in the old logic: When sack compression is triggered in the tcp_compressed_ack_kick(), if the sock is owned by user, it will set TCP_DELACK_TIMER_DEFERRED and then defer to the release cb phrase. Later once user releases the sock, tcp_delack_timer_handler() should send a ack as expected, which, however, cannot happen due to lack of ICSK_ACK_TIMER flag. Therefore, the receiver would not sent an ack until the sender's retransmission timeout. It definitely increases unnecessary latency. Fixes: 5d9f4262b7ea ("tcp: add SACK compression") Suggested-by: Eric Dumazet Signed-off-by: fuyuanli Signed-off-by: Jason Xing Link: https://lore.kernel.org/netdev/20230529113804.GA20300@didi-ThinkCentre-M920t-N000/ Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230531080150.GA20424@didi-ThinkCentre-M920t-N000 Signed-off-by: Paolo Abeni commit 4d56304e5827c8cc8cc18c75343d283af7c4825c Author: Hangyu Hua Date: Wed May 31 18:28:04 2023 +0800 net/sched: flower: fix possible OOB write in fl_set_geneve_opt() If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total size is 252 bytes(key->enc_opts.len = 252) then key->enc_opts.len = opt->length = data_len / 4 = 0 when the third TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This bypasses the next bounds check and results in an out-of-bounds. Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") Signed-off-by: Hangyu Hua Reviewed-by: Simon Horman Reviewed-by: Pieter Jansen van Vuuren Link: https://lore.kernel.org/r/20230531102805.27090-1-hbh25y@gmail.com Signed-off-by: Paolo Abeni commit b3fc95709c54ffbe80f16801e0a792a4d2b3d55e Author: Chen-Yu Tsai Date: Fri May 26 16:53:59 2023 +0800 iommu/mediatek: Flush IOTLB completely only if domain has been attached If an IOMMU domain was never attached, it lacks any linkage to the actual IOMMU hardware. Attempting to do flush_iotlb_all() on it will result in a NULL pointer dereference. This seems to happen after the recent IOMMU core rework in v6.4-rc1. Unable to handle kernel read from unreadable memory at virtual address 0000000000000018 Call trace: mtk_iommu_flush_iotlb_all+0x20/0x80 iommu_create_device_direct_mappings.part.0+0x13c/0x230 iommu_setup_default_domain+0x29c/0x4d0 iommu_probe_device+0x12c/0x190 of_iommu_configure+0x140/0x208 of_dma_configure_id+0x19c/0x3c0 platform_dma_configure+0x38/0x88 really_probe+0x78/0x2c0 Check if the "bank" field has been filled in before actually attempting the IOTLB flush to avoid it. The IOTLB is also flushed when the device comes out of runtime suspend, so it should have a clean initial state. Fixes: 08500c43d4f7 ("iommu/mediatek: Adjust the structure") Signed-off-by: Chen-Yu Tsai Reviewed-by: Yong Wu Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230526085402.394239-1-wenst@chromium.org Signed-off-by: Joerg Roedel commit 3692ababa322b4d9ffbd973865bc88018e896fcd Author: Jammy Huang Date: Thu Jun 1 08:48:47 2023 +0800 drm/ast: Fix modeset failed on DisplayPort If we switch display and update cursor together, it could lead to modeset failed because of concurrent access to IO registers. Add lock protection in DP's edid access to avoid this problem. Reviewed-by: Thomas Zimmermann Signed-off-by: Jammy Huang Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230601004847.1115-1-jammy_huang@aspeedtech.com commit 62fe398761cd06a428e6f367aba84732a2f1c268 Author: Ashutosh Dixit Date: Tue May 23 13:40:42 2023 -0700 drm/i915/perf: Clear out entire reports after reading if not power of 2 size Clearing out report id and timestamp as means to detect unlanded reports only works if report size is power of 2. That is, only when report size is a sub-multiple of the OA buffer size can we be certain that reports will land at the same place each time in the OA buffer (after rewind). If report size is not a power of 2, we need to zero out the entire report to be able to detect unlanded reports reliably. v2: Add Fixes tag (Umesh) Fixes: 1cc064dce4ed ("drm/i915/perf: Add support for OA media units") Reviewed-by: Umesh Nerlige Ramappa Reviewed-by: Lionel Landwerlin Signed-off-by: Ashutosh Dixit Link: https://patchwork.freedesktop.org/patch/msgid/20230523204042.4180641-1-ashutosh.dixit@intel.com (cherry picked from commit 09a36015d9a0940214c080f95afc605c47648bbd) Signed-off-by: Joonas Lahtinen commit 622ab656344a288acf4fb03d628c3bb5dd241f34 Author: Edward Cree Date: Tue May 30 21:25:27 2023 +0100 sfc: fix error unwinds in TC offload Failure ladders weren't exactly unwinding what the function had done up to that point; most seriously, when we encountered an already offloaded rule, the failure path tried to remove the new rule from the hashtable, which would in fact remove the already-present 'old' rule (since it has the same key) from the table, and leak its resources. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202305200745.xmIlkqjH-lkp@intel.com/ Fixes: d902e1a737d4 ("sfc: bare bones TC offload on EF100") Fixes: 17654d84b47c ("sfc: add offloading of 'foreign' TC (decap) rules") Signed-off-by: Edward Cree Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230530202527.53115-1-edward.cree@amd.com Signed-off-by: Jakub Kicinski commit bbfa4b58997e3d38ba629c9f6fc0bd1c163aaf43 Author: Moshe Shemesh Date: Fri Apr 28 13:48:13 2023 +0300 net/mlx5: Read embedded cpu after init bit cleared During driver load it reads embedded_cpu bit from initialization segment, but the initialization segment is readable only after initialization bit is cleared. Move the call to mlx5_read_embedded_cpu() right after initialization bit cleared. Signed-off-by: Moshe Shemesh Fixes: 591905ba9679 ("net/mlx5: Introduce Mellanox SmartNIC and modify page management logic") Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit b6193d7030e3c59f1d4c75648c9c8fa40cad2bcd Author: Saeed Mahameed Date: Sat May 27 23:07:08 2023 -0700 net/mlx5e: Fix error handling in mlx5e_refresh_tirs Allocation failure is outside the critical lock section and should return immediately rather than jumping to the unlock section. Also unlock as soon as required and remove the now redundant jump label. Fixes: 80a2a9026b24 ("net/mlx5e: Add a lock on tir list") Signed-off-by: Saeed Mahameed commit 368591995d010e639ad8f28b27f1b721f0872342 Author: Chuck Lever Date: Wed May 31 15:48:25 2023 -0400 net/mlx5: Ensure af_desc.mask is properly initialized [ 9.837087] mlx5_core 0000:02:00.0: firmware version: 16.35.2000 [ 9.843126] mlx5_core 0000:02:00.0: 126.016 Gb/s available PCIe bandwidth (8.0 GT/s PCIe x16 link) [ 10.311515] mlx5_core 0000:02:00.0: Rate limit: 127 rates are supported, range: 0Mbps to 97656Mbps [ 10.321948] mlx5_core 0000:02:00.0: E-Switch: Total vports 2, per vport: max uc(128) max mc(2048) [ 10.344324] mlx5_core 0000:02:00.0: mlx5_pcie_event:301:(pid 88): PCIe slot advertised sufficient power (27W). [ 10.354339] BUG: unable to handle page fault for address: ffffffff8ff0ade0 [ 10.361206] #PF: supervisor read access in kernel mode [ 10.366335] #PF: error_code(0x0000) - not-present page [ 10.371467] PGD 81ec39067 P4D 81ec39067 PUD 81ec3a063 PMD 114b07063 PTE 800ffff7e10f5062 [ 10.379544] Oops: 0000 [#1] PREEMPT SMP PTI [ 10.383721] CPU: 0 PID: 117 Comm: kworker/0:6 Not tainted 6.3.0-13028-g7222f123c983 #1 [ 10.391625] Hardware name: Supermicro X10SRA-F/X10SRA-F, BIOS 2.0b 06/12/2017 [ 10.398750] Workqueue: events work_for_cpu_fn [ 10.403108] RIP: 0010:__bitmap_or+0x10/0x26 [ 10.407286] Code: 85 c0 0f 95 c0 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 89 c9 31 c0 48 83 c1 3f 48 c1 e9 06 39 c> [ 10.426024] RSP: 0000:ffffb45a0078f7b0 EFLAGS: 00010097 [ 10.431240] RAX: 0000000000000000 RBX: ffffffff8ff0adc0 RCX: 0000000000000004 [ 10.438365] RDX: ffff9156801967d0 RSI: ffffffff8ff0ade0 RDI: ffff9156801967b0 [ 10.445489] RBP: ffffb45a0078f7e8 R08: 0000000000000030 R09: 0000000000000000 [ 10.452613] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000000ec [ 10.459737] R13: ffffffff8ff0ade0 R14: 0000000000000001 R15: 0000000000000020 [ 10.466862] FS: 0000000000000000(0000) GS:ffff9165bfc00000(0000) knlGS:0000000000000000 [ 10.474936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 10.480674] CR2: ffffffff8ff0ade0 CR3: 00000001011ae003 CR4: 00000000003706f0 [ 10.487800] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 10.494922] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 10.502046] Call Trace: [ 10.504493] [ 10.506589] ? matrix_alloc_area.constprop.0+0x43/0x9a [ 10.511729] ? prepare_namespace+0x84/0x174 [ 10.515914] irq_matrix_reserve_managed+0x56/0x10c [ 10.520699] x86_vector_alloc_irqs+0x1d2/0x31e [ 10.525146] irq_domain_alloc_irqs_hierarchy+0x39/0x3f [ 10.530284] irq_domain_alloc_irqs_parent+0x1a/0x2a [ 10.535155] intel_irq_remapping_alloc+0x59/0x5e9 [ 10.539859] ? kmem_cache_debug_flags+0x11/0x26 [ 10.544383] ? __radix_tree_lookup+0x39/0xb9 [ 10.548649] irq_domain_alloc_irqs_hierarchy+0x39/0x3f [ 10.553779] irq_domain_alloc_irqs_parent+0x1a/0x2a [ 10.558650] msi_domain_alloc+0x8c/0x120 [ 10.567697] irq_domain_alloc_irqs_locked+0x11d/0x286 [ 10.572741] __irq_domain_alloc_irqs+0x72/0x93 [ 10.577179] __msi_domain_alloc_irqs+0x193/0x3f1 [ 10.581789] ? __xa_alloc+0xcf/0xe2 [ 10.585273] msi_domain_alloc_irq_at+0xa8/0xfe [ 10.589711] pci_msix_alloc_irq_at+0x47/0x5c The crash is due to matrix_alloc_area() attempting to access per-CPU memory for CPUs that are not present on the system. The CPU mask passed into reserve_managed_vector() via it's @irqd parameter is corrupted because it contains uninitialized stack data. Fixes: bbac70c74183 ("net/mlx5: Use newer affinity descriptor") Reviewed-by: Thomas Gleixner Signed-off-by: Chuck Lever Signed-off-by: Saeed Mahameed commit 8764bd0fa5d402c51b136f6aeaba20fc16961ba1 Author: Niklas Schnelle Date: Wed May 31 10:48:56 2023 +0200 net/mlx5: Fix setting of irq->map.index for static IRQ case When dynamic IRQ allocation is not supported all IRQs are allocated up front in mlx5_irq_table_create() instead of dynamically as part of mlx5_irq_alloc(). In the latter dynamic case irq->map.index is set via the mapping returned by pci_msix_alloc_irq_at(). In the static case and prior to commit 1da438c0ae02 ("net/mlx5: Fix indexing of mlx5_irq") irq->map.index was set in mlx5_irq_alloc() twice once initially to 0 and then to the requested index before storing in the xarray. After this commit it is only set to 0 which breaks all other IRQ mappings. Fix this by setting irq->map.index to the requested index together with irq->map.virq and improve the related comment to make it clearer which cases it deals with. Cc: Chuck Lever III Tested-by: Mark Brown Reviewed-by: Mark Brown Reviewed-by: Simon Horman Reviewed-by: Eli Cohen Fixes: 1da438c0ae02 ("net/mlx5: Fix indexing of mlx5_irq") Signed-off-by: Niklas Schnelle Tested-by: Cédric Le Goater Signed-off-by: Saeed Mahameed commit 1c4c769cdf682c63d3b10cb241f4a96ebad2f215 Author: Shay Drory Date: Tue May 30 11:59:34 2023 +0300 net/mlx5: Remove rmap also in case dynamic MSIX not supported mlx5 add IRQs to rmap upon MSIX request, and mlx5 remove rmap from MSIX only if msi_map.index is populated. However, msi_map.index is populated only when dynamic MSIX is supported. This results in freeing IRQs without removing them from rmap, which triggers the bellow WARN_ON[1]. rmap is a feature which have no relation to dynamic MSIX. Hence, remove the check of msi_map.index when removing IRQ from rmap. [1] [ 200.307160 ] WARNING: CPU: 20 PID: 1702 at kernel/irq/manage.c:2034 free_irq+0x2ac/0x358 [ 200.316990 ] CPU: 20 PID: 1702 Comm: modprobe Not tainted 6.4.0-rc3_for_upstream_min_debug_2023_05_24_14_02 #1 [ 200.318939 ] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 200.321659 ] pc : free_irq+0x2ac/0x358 [ 200.322400 ] lr : free_irq+0x20/0x358 [ 200.337865 ] Call trace: [ 200.338360 ] free_irq+0x2ac/0x358 [ 200.339029 ] irq_release+0x58/0xd0 [mlx5_core] [ 200.340093 ] mlx5_irqs_release_vectors+0x80/0xb0 [mlx5_core] [ 200.341344 ] destroy_comp_eqs+0x120/0x170 [mlx5_core] [ 200.342469 ] mlx5_eq_table_destroy+0x1c/0x38 [mlx5_core] [ 200.343645 ] mlx5_unload+0x8c/0xc8 [mlx5_core] [ 200.344652 ] mlx5_uninit_one+0x78/0x118 [mlx5_core] [ 200.345745 ] remove_one+0x80/0x108 [mlx5_core] [ 200.346752 ] pci_device_remove+0x40/0xd8 [ 200.347554 ] device_remove+0x50/0x88 [ 200.348272 ] device_release_driver_internal+0x1c4/0x228 [ 200.349312 ] driver_detach+0x54/0xa0 [ 200.350030 ] bus_remove_driver+0x74/0x100 [ 200.350833 ] driver_unregister+0x34/0x68 [ 200.351619 ] pci_unregister_driver+0x28/0xa0 [ 200.352476 ] mlx5_cleanup+0x14/0x2210 [mlx5_core] [ 200.353536 ] __arm64_sys_delete_module+0x190/0x2e8 [ 200.354495 ] el0_svc_common.constprop.0+0x6c/0x1d0 [ 200.355455 ] do_el0_svc+0x38/0x98 [ 200.356122 ] el0_svc+0x1c/0x80 [ 200.356739 ] el0t_64_sync_handler+0xb4/0x130 [ 200.357604 ] el0t_64_sync+0x174/0x178 [ 200.358345 ] ---[ end trace 0000000000000000 ]--- Fixes: 3354822cde5a ("net/mlx5: Use dynamic msix vectors allocation") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 663b930e24842f3d3bb79418bb5cd8d01b40c559 Author: Ikshwaku Chauhan Date: Thu May 25 10:57:26 2023 +0530 drm/amdgpu: enable tmz by default for GC 11.0.1 Add IP GC 11.0.1 in the list of target to have tmz enabled by default. Signed-off-by: Ikshwaku Chauhan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 929ed21dfdb6ee94391db51c9eedb63314ef6847 Merge: 884fe9da1b7cc fdd7d1fff4e3b Author: Linus Torvalds Date: Wed May 31 19:24:01 2023 -0400 Merge tag '6.4-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Four small smb3 client fixes: - two small fixes suggested by kernel test robot - small cleanup fix - update Paulo's email address in the maintainer file" * tag '6.4-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: address unused variable warning smb: delete an unnecessary statement smb3: missing null check in SMB2_change_notify smb3: update a reviewer email in MAINTAINERS file commit e490d60a2f76bff636c68ce4fe34c1b6c34bbd86 Author: Guchun Chen Date: Wed May 24 15:03:02 2023 +0800 drm/amd/pm: resolve reboot exception for si oland During reboot test on arm64 platform, it may failure on boot. The error message are as follows: [ 1.706570][ 3] [ T273] [drm:si_thermal_enable_alert [amdgpu]] *ERROR* Could not enable thermal interrupts. [ 1.716547][ 3] [ T273] [drm:amdgpu_device_ip_late_init [amdgpu]] *ERROR* late_init of IP block failed -22 [ 1.727064][ 3] [ T273] amdgpu 0000:02:00.0: amdgpu_device_ip_late_init failed [ 1.734367][ 3] [ T273] amdgpu 0000:02:00.0: Fatal error during GPU init v2: squash in built warning fix (Alex) Signed-off-by: Zhenneng Li Reviewed-by: Guchun Chen Signed-off-by: Guchun Chen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit bc3e1d60f933f823599376f830eb99451afb995a Author: Horatio Zhang Date: Mon May 15 23:02:10 2023 -0400 drm/amdgpu: add RAS POISON interrupt funcs for jpeg_v4_0 Add ras_poison_irq and functions. And fix the amdgpu_irq_put call trace in jpeg_v4_0_hw_fini. [ 50.497562] RIP: 0010:amdgpu_irq_put+0xa4/0xc0 [amdgpu] [ 50.497619] RSP: 0018:ffffaa2400fcfcb0 EFLAGS: 00010246 [ 50.497620] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [ 50.497621] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 50.497621] RBP: ffffaa2400fcfcd0 R08: 0000000000000000 R09: 0000000000000000 [ 50.497622] R10: 0000000000000000 R11: 0000000000000000 R12: ffff99b2105242d8 [ 50.497622] R13: 0000000000000000 R14: ffff99b210500000 R15: ffff99b210500000 [ 50.497623] FS: 0000000000000000(0000) GS:ffff99b518480000(0000) knlGS:0000000000000000 [ 50.497623] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.497624] CR2: 00007f9d32aa91e8 CR3: 00000001ba210000 CR4: 0000000000750ee0 [ 50.497624] PKRU: 55555554 [ 50.497625] Call Trace: [ 50.497625] [ 50.497627] jpeg_v4_0_hw_fini+0x43/0xc0 [amdgpu] [ 50.497693] jpeg_v4_0_suspend+0x13/0x30 [amdgpu] [ 50.497751] amdgpu_device_ip_suspend_phase2+0x240/0x470 [amdgpu] [ 50.497802] amdgpu_device_ip_suspend+0x41/0x80 [amdgpu] [ 50.497854] amdgpu_device_pre_asic_reset+0xd9/0x4a0 [amdgpu] [ 50.497905] amdgpu_device_gpu_recover.cold+0x548/0xcf1 [amdgpu] [ 50.498005] amdgpu_debugfs_reset_work+0x4c/0x80 [amdgpu] [ 50.498060] process_one_work+0x21f/0x400 [ 50.498063] worker_thread+0x200/0x3f0 [ 50.498064] ? process_one_work+0x400/0x400 [ 50.498065] kthread+0xee/0x120 [ 50.498067] ? kthread_complete_and_exit+0x20/0x20 [ 50.498068] ret_from_fork+0x22/0x30 Suggested-by: Hawking Zhang Signed-off-by: Horatio Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 30b2d778f629d51e2ff30beb6d060a0bd7f70104 Author: Horatio Zhang Date: Mon May 15 22:59:54 2023 -0400 drm/amdgpu: add RAS POISON interrupt funcs for jpeg_v2_6 Add ras_poison_irq and functions. Suggested-by: Hawking Zhang Signed-off-by: Horatio Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit ce784421a3e15fd89d5fc1b9da7d846dd8309661 Author: Horatio Zhang Date: Mon May 15 22:57:19 2023 -0400 drm/amdgpu: separate ras irq from jpeg instance irq for UVD_POISON Separate jpegbRAS poison consumption handling from the instance irq, and register dedicated ras_poison_irq src and funcs for UVD_POISON. v2: - Separate ras irq from jpeg instance irq - Improve the subject and code comments v3: - Split the patch into three parts - Improve the code comments Suggested-by: Hawking Zhang Signed-off-by: Horatio Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 020c76d983151f6f6c9493a3bbe83c1ec927617a Author: Horatio Zhang Date: Mon May 15 22:09:43 2023 -0400 drm/amdgpu: add RAS POISON interrupt funcs for vcn_v4_0 Add ras_poison_irq and functions. And fix the amdgpu_irq_put call trace in vcn_v4_0_hw_fini. [ 44.563572] RIP: 0010:amdgpu_irq_put+0xa4/0xc0 [amdgpu] [ 44.563629] RSP: 0018:ffffb36740edfc90 EFLAGS: 00010246 [ 44.563630] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [ 44.563630] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 44.563631] RBP: ffffb36740edfcb0 R08: 0000000000000000 R09: 0000000000000000 [ 44.563631] R10: 0000000000000000 R11: 0000000000000000 R12: ffff954c568e2ea8 [ 44.563631] R13: 0000000000000000 R14: ffff954c568c0000 R15: ffff954c568e2ea8 [ 44.563632] FS: 0000000000000000(0000) GS:ffff954f584c0000(0000) knlGS:0000000000000000 [ 44.563632] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.563633] CR2: 00007f028741ba70 CR3: 000000026ca10000 CR4: 0000000000750ee0 [ 44.563633] PKRU: 55555554 [ 44.563633] Call Trace: [ 44.563634] [ 44.563634] vcn_v4_0_hw_fini+0x62/0x160 [amdgpu] [ 44.563700] vcn_v4_0_suspend+0x13/0x30 [amdgpu] [ 44.563755] amdgpu_device_ip_suspend_phase2+0x240/0x470 [amdgpu] [ 44.563806] amdgpu_device_ip_suspend+0x41/0x80 [amdgpu] [ 44.563858] amdgpu_device_pre_asic_reset+0xd9/0x4a0 [amdgpu] [ 44.563909] amdgpu_device_gpu_recover.cold+0x548/0xcf1 [amdgpu] [ 44.564006] amdgpu_debugfs_reset_work+0x4c/0x80 [amdgpu] [ 44.564061] process_one_work+0x21f/0x400 [ 44.564062] worker_thread+0x200/0x3f0 [ 44.564063] ? process_one_work+0x400/0x400 [ 44.564064] kthread+0xee/0x120 [ 44.564065] ? kthread_complete_and_exit+0x20/0x20 [ 44.564066] ret_from_fork+0x22/0x30 Suggested-by: Hawking Zhang Signed-off-by: Horatio Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 6889f28c736c357700f5755fed852a2badc15a7b Author: Horatio Zhang Date: Mon May 15 21:52:00 2023 -0400 drm/amdgpu: add RAS POISON interrupt funcs for vcn_v2_6 Add ras_poison_irq and functions. Suggested-by: Hawking Zhang Signed-off-by: Horatio Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit ac1d8e2f074d9bffc2d368ad0720cdbb4c938fa5 Author: Horatio Zhang Date: Mon May 15 21:45:51 2023 -0400 drm/amdgpu: separate ras irq from vcn instance irq for UVD_POISON Separate vcn RAS poison consumption handling from the instance irq, and register dedicated ras_poison_irq src and funcs for UVD_POISON. v2: - Separate ras irq from vcn instance irq - Improve the subject and code comments v3: - Split the patch into three parts - Improve the code comments Suggested-by: Hawking Zhang Signed-off-by: Horatio Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 8e1b45c578b799510f9a01a9745a737e74f43cb1 Author: Michel Dänzer Date: Mon May 22 15:08:23 2023 +0200 Revert "drm/amd/display: Do not set drr on pipe commit" This reverts commit 474f01015ffdb74e01c2eb3584a2822c64e7b2be. Caused a regression: Samsung Odyssey Neo G9, running at 5120x1440@240/VRR, connected to Navi 21 via DisplayPort, blanks and the GPU hangs while starting the Steam game Assetto Corsa Competizione (via Proton 7.0). Example dmesg excerpt: amdgpu 0000:0c:00.0: [drm] ERROR [CRTC:82:crtc-0] flip_done timed out NMI watchdog: Watchdog detected hard LOCKUP on cpu 6 [...] RIP: 0010:amdgpu_device_rreg.part.0+0x2f/0xf0 [amdgpu] Code: 41 54 44 8d 24 b5 00 00 00 00 55 89 f5 53 48 89 fb 4c 3b a7 60 0b 00 00 73 6a 83 e2 02 74 29 4c 03 a3 68 0b 00 00 45 8b 24 24 <48> 8b 43 08 0f b7 70 3e 66 90 44 89 e0 5b 5d 41 5c 31 d2 31 c9 31 RSP: 0000:ffffb39a119dfb88 EFLAGS: 00000086 RAX: ffffffffc0eb96a0 RBX: ffff9e7963dc0000 RCX: 0000000000007fff RDX: 0000000000000000 RSI: 0000000000004ff6 RDI: ffff9e7963dc0000 RBP: 0000000000004ff6 R08: ffffb39a119dfc40 R09: 0000000000000010 R10: ffffb39a119dfc40 R11: ffffb39a119dfc44 R12: 00000000000e05ae R13: 0000000000000000 R14: ffff9e7963dc0010 R15: 0000000000000000 FS: 000000001012f6c0(0000) GS:ffff9e805eb80000(0000) knlGS:000000007fd40000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000461ca000 CR3: 00000002a8a20000 CR4: 0000000000350ee0 Call Trace: dm_read_reg_func+0x37/0xc0 [amdgpu] generic_reg_get2+0x22/0x60 [amdgpu] optc1_get_crtc_scanoutpos+0x6a/0xc0 [amdgpu] dc_stream_get_scanoutpos+0x74/0x90 [amdgpu] dm_crtc_get_scanoutpos+0x82/0xf0 [amdgpu] amdgpu_display_get_crtc_scanoutpos+0x91/0x190 [amdgpu] ? dm_read_reg_func+0x37/0xc0 [amdgpu] amdgpu_get_vblank_counter_kms+0xb4/0x1a0 [amdgpu] dm_pflip_high_irq+0x213/0x2f0 [amdgpu] amdgpu_dm_irq_handler+0x8a/0x200 [amdgpu] amdgpu_irq_dispatch+0xd4/0x220 [amdgpu] amdgpu_ih_process+0x7f/0x110 [amdgpu] amdgpu_irq_handler+0x1f/0x70 [amdgpu] __handle_irq_event_percpu+0x46/0x1b0 handle_irq_event+0x34/0x80 handle_edge_irq+0x9f/0x240 __common_interrupt+0x66/0x110 common_interrupt+0x5c/0xd0 asm_common_interrupt+0x22/0x40 Reviewed-by: Aurabindo Pillai Acked-by: Alex Deucher Signed-off-by: Michel Dänzer Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit c14fb01c4629b96b64ab54caea7e543a0239f14e Author: Michel Dänzer Date: Mon May 22 15:08:22 2023 +0200 Revert "drm/amd/display: Block optimize on consecutive FAMS enables" This reverts commit ce560ac40272a5c8b5b68a9d63a75edd9e66aed2. It depends on its parent commit, which we want to revert. Acked-by: Alex Deucher Signed-off-by: Michel Dänzer [Hamza: fix a whitespace issue in dcn30_prepare_bandwidth()] Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit 55e02c14f9b5fd973ba32a16a715baa42617f9c6 Author: Tim Huang Date: Mon May 22 23:17:28 2023 +0800 drm/amd/pm: reverse mclk and fclk clocks levels for renoir This patch reverses the DPM clocks levels output of pp_dpm_mclk and pp_dpm_fclk for renoir. On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk. It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic. So we need to reverse them to expose the clocks levels from the driver consistently. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit bfc03568d9d81332382c73a1985a90c4506bd36c Author: Tim Huang Date: Sun May 21 11:10:19 2023 +0800 drm/amd/pm: reverse mclk and fclk clocks levels for vangogh This patch reverses the DPM clocks levels output of pp_dpm_mclk and pp_dpm_fclk. On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels that from the DFPstateTable are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk. It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic. So we need to reverse them to expose the clocks levels from the driver consistently. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit f1373a97a41f429e0095d4be388092ffa3c1a157 Author: Tim Huang Date: Sun May 21 10:35:59 2023 +0800 drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp This patch reverses the DPM clocks levels output of pp_dpm_mclk and pp_dpm_fclk. On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels that from the DFPstateTable are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk. It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic. So we need to reverse them to expose the clocks levels from the driver consistently. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c1d35412b3e826ae8119e3fb5f51dd0fa5b6b567 Author: Tim Huang Date: Sun May 21 10:28:05 2023 +0800 drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5 This patch reverses the DPM clocks levels output of pp_dpm_mclk. On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels that from the DFPstateTable are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk. It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic. So we need to reverse them to expose the clocks levels from the driver consistently. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 6a07826f2057b5fa1c479ba56460195882464270 Author: Tim Huang Date: Sun May 21 09:24:00 2023 +0800 drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4 This patch reverses the DPM clocks levels output of pp_dpm_mclk and pp_dpm_fclk. On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels that from the DFPstateTable are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk. It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic. So we need to reverse them to expose the clocks levels from the driver consistently. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c26fabe73330d983c7ce822c6b6ec0879b4da61f Author: K Prateek Nayak Date: Mon May 8 14:11:15 2023 +0530 drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug Until commit 5c2712387d48 ("cacheinfo: Fix LLC is not exported through sysfs"), cacheinfo called populate_cache_leaves() for CPU coming online which let the arch specific functions handle (at least on x86) populating the shared_cpu_map. However, with the changes in the aforementioned commit, populate_cache_leaves() is not called when a CPU comes online as a result of hotplug since last_level_cache_is_valid() returns true as the cacheinfo data is not discarded. The CPU coming online is not present in shared_cpu_map, however, it will not be added since the cpu_cacheinfo->cpu_map_populated flag is set (it is set in populate_cache_leaves() when cacheinfo is first populated for x86) This can lead to inconsistencies in the shared_cpu_map when an offlined CPU comes online again. Example below depicts the inconsistency in the shared_cpu_list in cacheinfo when CPU8 is offlined and onlined again on a 3rd Generation EPYC processor: # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143 # echo 0 > /sys/devices/system/cpu/cpu8/online # echo 1 > /sys/devices/system/cpu/cpu8/online # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8 /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8 /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8 /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8 # cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list 136 # cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list 9-15,136-143 Clear the flag when the CPU is removed from shared_cpu_map when cache_shared_cpu_map_remove() is called during CPU hotplug. This will allow cache_shared_cpu_map_setup() to add the CPU coming back online in the shared_cpu_map. Set the flag again when the shared_cpu_map is setup. Following are results of performing the same test as described above with the changes: # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143 # echo 0 > /sys/devices/system/cpu/cpu8/online # echo 1 > /sys/devices/system/cpu/cpu8/online # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143 # cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list 8,136 # cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list 8-15,136-143 Fixes: 5c2712387d48 ("cacheinfo: Fix LLC is not exported through sysfs") Signed-off-by: K Prateek Nayak Reviewed-by: Yicong Yang Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20230508084115.1157-3-kprateek.nayak@amd.com Signed-off-by: Greg Kroah-Hartman commit 126310c9f669c9a8c875a3e5c2292299ca90225d Author: K Prateek Nayak Date: Mon May 8 14:11:14 2023 +0530 drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug While building the shared_cpu_map, check if the cache level and cache type matches. On certain systems that build the cache topology based on the instance ID, there are cases where the same ID may repeat across multiple cache levels, leading inaccurate topology. In event of CPU offlining, the cache_shared_cpu_map_remove() does not consider if IDs at same level are being compared. As a result, when same IDs repeat across different cache levels, the CPU going offline is not removed from all the shared_cpu_map. Below is the output of cache topology of CPU8 and it's SMT sibling after CPU8 is offlined on a dual socket 3rd Generation AMD EPYC processor (2 x 64C/128T) running kernel release v6.3: # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143 # echo 0 > /sys/devices/system/cpu/cpu8/online # for i in /sys/devices/system/cpu/cpu136/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list: 136 /sys/devices/system/cpu/cpu136/cache/index1/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu136/cache/index2/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list: 9-15,136-143 CPU8 is removed from index0 (L1i) but remains in the shared_cpu_list of index1 (L1d) and index2 (L2). Since L1i, L1d, and L2 are shared by the SMT siblings, and they have the same cache instance ID, CPU 2 is only removed from the first index with matching ID which is index1 (L1i) in this case. With this fix, the results are as expected when performing the same experiment on the same system: # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136 /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143 # echo 0 > /sys/devices/system/cpu/cpu8/online # for i in /sys/devices/system/cpu/cpu136/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list: 136 /sys/devices/system/cpu/cpu136/cache/index1/shared_cpu_list: 136 /sys/devices/system/cpu/cpu136/cache/index2/shared_cpu_list: 136 /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list: 9-15,136-143 When rebuilding topology, the same problem appears as cache_shared_cpu_map_setup() implements a similar logic. Consider the same 3rd Generation EPYC processor: CPUs in Core 1, that share the L1 and L2 caches, have L1 and L2 instance ID as 1. For all the CPUs on the second chiplet, the L3 ID is also 1 leading to grouping on CPUs from Core 1 (1, 17) and the entire second chiplet (8-15, 24-31) as CPUs sharing one cache domain. This went undetected since x86 processors depended on arch specific populate_cache_leaves() method to repopulate the shared_cpus_map when CPU came back online until kernel release v6.3-rc5. Fixes: 198102c9103f ("cacheinfo: Fix shared_cpu_map to handle shared caches at different levels") Signed-off-by: K Prateek Nayak Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20230508084115.1157-2-kprateek.nayak@amd.com Signed-off-by: Greg Kroah-Hartman commit 48e156023059e57a8fc68b498439832f7600ffff Author: Mirsad Goran Todorovac Date: Tue May 9 10:47:49 2023 +0200 test_firmware: fix the memory leak of the allocated firmware buffer The following kernel memory leak was noticed after running tools/testing/selftests/firmware/fw_run_tests.sh: [root@pc-mtodorov firmware]# cat /sys/kernel/debug/kmemleak . . . unreferenced object 0xffff955389bc3400 (size 1024): comm "test_firmware-0", pid 5451, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] slab_post_alloc_hook+0x8c/0x3c0 [] __kmem_cache_alloc_node+0x184/0x240 [] kmalloc_trace+0x2e/0xc0 [] test_fw_run_batch_request+0x9d/0x180 [] kthread+0x10b/0x140 [] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c334b400 (size 1024): comm "test_firmware-1", pid 5452, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] slab_post_alloc_hook+0x8c/0x3c0 [] __kmem_cache_alloc_node+0x184/0x240 [] kmalloc_trace+0x2e/0xc0 [] test_fw_run_batch_request+0x9d/0x180 [] kthread+0x10b/0x140 [] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c334f000 (size 1024): comm "test_firmware-2", pid 5453, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] slab_post_alloc_hook+0x8c/0x3c0 [] __kmem_cache_alloc_node+0x184/0x240 [] kmalloc_trace+0x2e/0xc0 [] test_fw_run_batch_request+0x9d/0x180 [] kthread+0x10b/0x140 [] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c3348400 (size 1024): comm "test_firmware-3", pid 5454, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] slab_post_alloc_hook+0x8c/0x3c0 [] __kmem_cache_alloc_node+0x184/0x240 [] kmalloc_trace+0x2e/0xc0 [] test_fw_run_batch_request+0x9d/0x180 [] kthread+0x10b/0x140 [] ret_from_fork+0x29/0x50 [root@pc-mtodorov firmware]# Note that the size 1024 corresponds to the size of the test firmware buffer. The actual number of the buffers leaked is around 70-110, depending on the test run. The cause of the leak is the following: request_partial_firmware_into_buf() and request_firmware_into_buf() provided firmware buffer isn't released on release_firmware(), we have allocated it and we are responsible for deallocating it manually. This is introduced in a number of context where previously only release_firmware() was called, which was insufficient. Reported-by: Mirsad Goran Todorovac Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf") Cc: Greg Kroah-Hartman Cc: Dan Carpenter Cc: Takashi Iwai Cc: Luis Chamberlain Cc: Russ Weight Cc: Tianfei zhang Cc: Christophe JAILLET Cc: Zhengchao Shao Cc: Colin Ian King Cc: linux-kernel@vger.kernel.org Cc: Kees Cook Cc: Scott Branden Cc: Luis R. Rodriguez Cc: linux-kselftest@vger.kernel.org Cc: stable@vger.kernel.org # v5.4 Signed-off-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/r/20230509084746.48259-3-mirsad.todorovac@alu.unizg.hr Signed-off-by: Greg Kroah-Hartman commit be37bed754ed90b2655382f93f9724b3c1aae847 Author: Mirsad Goran Todorovac Date: Tue May 9 10:47:47 2023 +0200 test_firmware: fix a memory leak with reqs buffer Dan Carpenter spotted that test_fw_config->reqs will be leaked if trigger_batched_requests_store() is called two or more times. The same appears with trigger_batched_requests_async_store(). This bug wasn't trigger by the tests, but observed by Dan's visual inspection of the code. The recommended workaround was to return -EBUSY if test_fw_config->reqs is already allocated. Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf") Cc: Luis Chamberlain Cc: Greg Kroah-Hartman Cc: Russ Weight Cc: Tianfei Zhang Cc: Shuah Khan Cc: Colin Ian King Cc: Randy Dunlap Cc: linux-kselftest@vger.kernel.org Cc: stable@vger.kernel.org # v5.4 Suggested-by: Dan Carpenter Suggested-by: Takashi Iwai Signed-off-by: Mirsad Goran Todorovac Reviewed-by: Dan Carpenter Acked-by: Luis Chamberlain Link: https://lore.kernel.org/r/20230509084746.48259-2-mirsad.todorovac@alu.unizg.hr Signed-off-by: Greg Kroah-Hartman commit 4acfe3dfde685a5a9eaec5555351918e2d7266a1 Author: Mirsad Goran Todorovac Date: Tue May 9 10:47:45 2023 +0200 test_firmware: prevent race conditions by a correct implementation of locking Dan Carpenter spotted a race condition in a couple of situations like these in the test_firmware driver: static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) { u8 val; int ret; ret = kstrtou8(buf, 10, &val); if (ret) return ret; mutex_lock(&test_fw_mutex); *(u8 *)cfg = val; mutex_unlock(&test_fw_mutex); /* Always return full write size even if we didn't consume all */ return size; } static ssize_t config_num_requests_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { int rc; mutex_lock(&test_fw_mutex); if (test_fw_config->reqs) { pr_err("Must call release_all_firmware prior to changing config\n"); rc = -EINVAL; mutex_unlock(&test_fw_mutex); goto out; } mutex_unlock(&test_fw_mutex); rc = test_dev_config_update_u8(buf, count, &test_fw_config->num_requests); out: return rc; } static ssize_t config_read_fw_idx_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { return test_dev_config_update_u8(buf, count, &test_fw_config->read_fw_idx); } The function test_dev_config_update_u8() is called from both the locked and the unlocked context, function config_num_requests_store() and config_read_fw_idx_store() which can both be called asynchronously as they are driver's methods, while test_dev_config_update_u8() and siblings change their argument pointed to by u8 *cfg or similar pointer. To avoid deadlock on test_fw_mutex, the lock is dropped before calling test_dev_config_update_u8() and re-acquired within test_dev_config_update_u8() itself, but alas this creates a race condition. Having two locks wouldn't assure a race-proof mutual exclusion. This situation is best avoided by the introduction of a new, unlocked function __test_dev_config_update_u8() which can be called from the locked context and reducing test_dev_config_update_u8() to: static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) { int ret; mutex_lock(&test_fw_mutex); ret = __test_dev_config_update_u8(buf, size, cfg); mutex_unlock(&test_fw_mutex); return ret; } doing the locking and calling the unlocked primitive, which enables both locked and unlocked versions without duplication of code. The similar approach was applied to all functions called from the locked and the unlocked context, which safely mitigates both deadlocks and race conditions in the driver. __test_dev_config_update_bool(), __test_dev_config_update_u8() and __test_dev_config_update_size_t() unlocked versions of the functions were introduced to be called from the locked contexts as a workaround without releasing the main driver's lock and thereof causing a race condition. The test_dev_config_update_bool(), test_dev_config_update_u8() and test_dev_config_update_size_t() locked versions of the functions are being called from driver methods without the unnecessary multiplying of the locking and unlocking code for each method, and complicating the code with saving of the return value across lock. Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf") Cc: Luis Chamberlain Cc: Greg Kroah-Hartman Cc: Russ Weight Cc: Takashi Iwai Cc: Tianfei Zhang Cc: Shuah Khan Cc: Colin Ian King Cc: Randy Dunlap Cc: linux-kselftest@vger.kernel.org Cc: stable@vger.kernel.org # v5.4 Suggested-by: Dan Carpenter Signed-off-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/r/20230509084746.48259-1-mirsad.todorovac@alu.unizg.hr Signed-off-by: Greg Kroah-Hartman commit ffa28312e2837ae788855840e126fa6f8a1ac35d Author: Dan Carpenter Date: Tue May 16 11:12:51 2023 +0300 firmware_loader: Fix a NULL vs IS_ERR() check The crypto_alloc_shash() function doesn't return NULL, it returns error pointers. Update the check accordingly. Fixes: 02fe26f25325 ("firmware_loader: Add debug message with checksum for FW file") Signed-off-by: Dan Carpenter Reviewed-by: Cezary Rojewski Acked-by: Luis Chamberlain Link: https://lore.kernel.org/r/36ef6042-ce74-4e8e-9e2c-5b5c28940610@kili.mountain Signed-off-by: Greg Kroah-Hartman commit 8fe72b76db79d694858e872370df49676bc3be8c Author: Dan Carpenter Date: Fri May 5 12:22:09 2023 +0300 mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() There was a bug where this code forgot to unlock the tdev->mutex if the kzalloc() failed. Fix this issue, by moving the allocation outside the lock. Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()") Signed-off-by: Dan Carpenter Reviewed-by: Lee Jones Signed-off-by: Jassi Brar commit 884fe9da1b7ccbea31b118f902fbc78f58366b4a Merge: fd2186d1c708f 5842d1d9c1b0d Author: Linus Torvalds Date: Wed May 31 14:13:09 2023 -0400 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - Fix 64K ARM page size support in bnxt_re and efa - bnxt_re fixes for a memory leak, incorrect error handling and a remove a bogus FW failure when running on a VF - Update MAINTAINERS for hns and efa - Fix two rxe regressions added this merge window in error unwind and incorrect spinlock primitives - hns gets a better algorithm for allocating page tables to avoid running out of resources, and a timeout adjustment - Fix a text case failure in hns - Use after free in irdma and fix incorrect construction of a WQE causing mis-execution * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/irdma: Fix Local Invalidate fencing RDMA/irdma: Prevent QP use after free MAINTAINERS: Update maintainer of Amazon EFA driver RDMA/bnxt_re: Do not enable congestion control on VFs RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx RDMA/bnxt_re: Fix a possible memory leak RDMA/hns: Modify the value of long message loopback slice RDMA/hns: Fix base address table allocation RDMA/hns: Fix timeout attr in query qp for HIP08 RDMA/efa: Fix unsupported page sizes in device RDMA/rxe: Convert spin_{lock_bh,unlock_bh} to spin_{lock_irqsave,unlock_irqrestore} RDMA/rxe: Fix double unlock in rxe_qp.c MAINTAINERS: Update maintainers of HiSilicon RoCE RDMA/bnxt_re: Fix the page_size used during the MR creation commit fd2186d1c708fa0ec64291da5aa6b26fb44197c3 Merge: 48b1320a674e1 eb1f822c76bee Author: Linus Torvalds Date: Wed May 31 14:06:01 2023 -0400 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Fix two regressions in ext4 and a number of issues reported by syzbot" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: enable the lazy init thread when remounting read/write ext4: fix fsync for non-directories ext4: add lockdep annotations for i_data_sem for ea_inode's ext4: disallow ea_inodes with extended attributes ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() ext4: add EA_INODE checking to ext4_iget() commit 2d5b205dfa32b5f0f357ebc9db73931d2186391e Merge: 4115af49d2c24 91539341a3b6e Author: Thomas Gleixner Date: Wed May 31 19:42:53 2023 +0200 Merge tag 'irqchip-fixes-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull an irqchip fix from Marc Zyngier: - Fix regression introduced by the Mediatek workaround. Link: https://lore.kernel.org/lkml/20230531160549.433528-1-maz@kernel.org commit 40994ce0ea010b1843e620bacc26d29ddebfc08d Author: Zhu YiXin Date: Fri May 19 12:45:55 2023 +0800 MAINTAINERS: Add Chuanhua Lei as Intel LGM GW PCIe maintainer Rahul Tanwar is no longer at Maxlinear, so update the MAINTAINERS entry for the PCIe driver for Intel LGM GW SoC. Link: https://lore.kernel.org/r/20230519044555.3750-2-yzhu@maxlinear.com Signed-off-by: Zhu YiXin Signed-off-by: Bjorn Helgaas Acked-by: Rahul Tanwar Acked-by: Lei Chuanhua commit 856303797724d28f1d65b702f0eadcee1ea7abf5 Author: Christoph Hellwig Date: Wed May 31 14:54:54 2023 +0200 nvme: fix the name of Zone Append for verbose logging No Management involved in Zone Appened. Fixes: bd83fe6f2cd2 ("nvme: add verbose error logging") Signed-off-by: Christoph Hellwig Reviewed-by: Alan Adamson Signed-off-by: Keith Busch commit 6d074ce231772c66e648a61f6bd2245e7129d1f5 Author: Bart Van Assche Date: Mon May 29 12:50:34 2023 -0700 scsi: stex: Fix gcc 13 warnings gcc 13 may assign another type to enumeration constants than gcc 12. Split the large enum at the top of source file stex.c such that the type of the constants used in time expressions is changed back to the same type chosen by gcc 12. This patch suppresses compiler warnings like this one: In file included from ./include/linux/bitops.h:7, from ./include/linux/kernel.h:22, from drivers/scsi/stex.c:13: drivers/scsi/stex.c: In function ‘stex_common_handshake’: ./include/linux/typecheck.h:12:25: error: comparison of distinct pointer types lacks a cast [-Werror] 12 | (void)(&__dummy == &__dummy2); \ | ^~ ./include/linux/jiffies.h:106:10: note: in expansion of macro ‘typecheck’ 106 | typecheck(unsigned long, b) && \ | ^~~~~~~~~ drivers/scsi/stex.c:1035:29: note: in expansion of macro ‘time_after’ 1035 | if (time_after(jiffies, before + MU_MAX_DELAY * HZ)) { | ^~~~~~~~~~ See also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107405. Cc: stable@vger.kernel.org Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20230529195034.3077-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 6199d23c91ce53bfed455f09a8c5ed170d516824 Author: Bastien Nocera Date: Wed May 31 10:24:28 2023 +0200 HID: logitech-hidpp: Handle timeout differently from busy If an attempt at contacting a receiver or a device fails because the receiver or device never responds, don't restart the communication, only restart it if the receiver or device answers that it's busy, as originally intended. This was the behaviour on communication timeout before commit 586e8fede795 ("HID: logitech-hidpp: Retry commands when device is busy"). This fixes some overly long waits in a critical path on boot, when checking whether the device is connected by getting its HID++ version. Signed-off-by: Bastien Nocera Suggested-by: Mark Lord Fixes: 586e8fede795 ("HID: logitech-hidpp: Retry commands when device is busy") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412 Signed-off-by: Jiri Kosina commit 8dc2a7e8027fbeca0c7df81d4c82e735a59b5741 Author: Alexandre Ghiti Date: Fri May 26 17:46:30 2023 +0200 riscv: Fix relocatable kernels with early alternatives using -fno-pie Early alternatives are called with the mmu disabled, and then should not access any global symbols through the GOT since it requires relocations, relocations that we do before but *virtually*. So only use medany code model for this early code. Signed-off-by: Alexandre Ghiti Tested-by: Conor Dooley # booted on nezha & unmatched Fixes: 39b33072941f ("riscv: Introduce CONFIG_RELOCATABLE") Link: https://lore.kernel.org/r/20230526154630.289374-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit c034203b6a9dae6751ef4371c18cb77983e30c28 Author: Dan Carpenter Date: Mon May 29 14:35:55 2023 +0300 nfsd: fix double fget() bug in __write_ports_addfd() The bug here is that you cannot rely on getting the same socket from multiple calls to fget() because userspace can influence that. This is a kind of double fetch bug. The fix is to delete the svc_alien_sock() function and instead do the checking inside the svc_addsock() function. Fixes: 3064639423c4 ("nfsd: check passed socket's net matches NFSd superblock's one") Signed-off-by: Dan Carpenter Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 57d1e8900495cf1751cec74db16fe1a0fe47efbb Author: Sicong Jiang Date: Wed May 31 21:06:35 2023 +1200 ASoC: amd: yc: Add Thinkpad Neo14 to quirks list for acp6x Thinkpad Neo14 Ryzen Edition uses Ryzen 6800H processor, and adding to quirks list for acp6x will enable internal mic. Signed-off-by: Sicong Jiang Link: https://lore.kernel.org/r/20230531090635.89565-1-kevin.jiangsc@gmail.com Signed-off-by: Mark Brown commit bed61c8fc7ba17d0f259c674137a5198fd2e3334 Author: Jammy Huang Date: Tue May 30 12:12:40 2023 +0800 drm/ast: Fix long time waiting on s3/s4 resume In resume, DP's launch function, ast_dp_launch, could wait at most 30 seconds before timeout to check if DP is enabled. It could lead to 'DPM device timeout' and trigger unrecoverable kernel panic. To avoid this problem, we check if DP enable or not at driver probe only. Reported-and-tested-by: Wendy Wang Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217278 Acked-by: Thomas Zimmermann Signed-off-by: Jammy Huang Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230530041240.13427-1-jammy_huang@aspeedtech.com commit 81d0fa4cb4fc0e1a49c2b22f92c43d9fe972ebcf Author: Pietro Borrello Date: Sat Jan 28 16:23:41 2023 +0000 tracing/probe: trace_probe_primary_from_call(): checked list_first_entry All callers of trace_probe_primary_from_call() check the return value to be non NULL. However, the function returns list_first_entry(&tpe->probes, ...) which can never be NULL. Additionally, it does not check for the list being possibly empty, possibly causing a type confusion on empty lists. Use list_first_entry_or_null() which solves both problems. Link: https://lore.kernel.org/linux-trace-kernel/20230128-list-entry-null-check-v1-1-8bde6a3da2ef@diag.uniroma1.it/ Fixes: 60d53e2c3b75 ("tracing/probe: Split trace_event related data from trace_probe") Signed-off-by: Pietro Borrello Reviewed-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Acked-by: Mukesh Ojha Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit 448a5ce1120c5bdbce1f1ccdabcd31c7d029f328 Author: Vladislav Efanov Date: Tue May 30 14:39:41 2023 +0300 udp6: Fix race condition in udp6_sendmsg & connect Syzkaller got the following report: BUG: KASAN: use-after-free in sk_setup_caps+0x621/0x690 net/core/sock.c:2018 Read of size 8 at addr ffff888027f82780 by task syz-executor276/3255 The function sk_setup_caps (called by ip6_sk_dst_store_flow-> ip6_dst_store) referenced already freed memory as this memory was freed by parallel task in udpv6_sendmsg->ip6_sk_dst_lookup_flow-> sk_dst_check. task1 (connect) task2 (udp6_sendmsg) sk_setup_caps->sk_dst_set | | sk_dst_check-> | sk_dst_set | dst_release sk_setup_caps references | to already freed dst_entry| The reason for this race condition is: sk_setup_caps() keeps using the dst after transferring the ownership to the dst cache. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Vladislav Efanov Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 40e54cad454076172cc3e2bca60aa924650a3e4b Author: Oliver Upton Date: Thu May 25 21:27:22 2023 +0000 KVM: arm64: Document default vPMU behavior on heterogeneous systems KVM maintains a mask of supported CPUs when a vPMU type is explicitly selected by userspace and is used to reject any attempt to run the vCPU on an unsupported CPU. This is great, but we're still beholden to the default behavior where vCPUs can be scheduled anywhere and guest counters may silently stop working. Avoid confusing the next poor sod to look at this code and document the intended behavior. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230525212723.3361524-3-oliver.upton@linux.dev commit 1c913a1c35aa61cf280173b2bcc133c3953c38fc Author: Oliver Upton Date: Thu May 25 21:27:21 2023 +0000 KVM: arm64: Iterate arm_pmus list to probe for default PMU To date KVM has relied on using a perf event to probe the core PMU at the time of vPMU initialization. Behind the scenes perf_event_init() would iteratively walk the PMUs of the system and return the PMU that could handle the event. However, an upcoming change in perf core will drop the iterative walk, thereby breaking the fragile dance we do on the KVM side. Avoid the problem altogether by iterating over the list of supported PMUs maintained in KVM, returning the core PMU that matches the CPU we were called on. Tested-by: Nathan Chancellor Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230525212723.3361524-2-oliver.upton@linux.dev commit 9f9666e65359d5047089aef97ac87c50f624ecb0 Author: Mika Westerberg Date: Tue May 30 08:48:29 2023 +0300 thunderbolt: Mask ring interrupt on Intel hardware as well When resuming from system sleep states the driver issues following warning on Intel hardware: thunderbolt 0000:07:00.0: interrupt for TX ring 0 is already enabled The reason for this is that the commit in question did not mask the ring interrupt on Intel hardware leaving the interrupt active. Fix this by masking it also in Intel hardware. Reported-by: beld zhang Tested-by: beld zhang Closes: https://lore.kernel.org/linux-usb/ZHKW5NeabmfhgLbY@debian.me/ Fixes: c4af8e3fecd0 ("thunderbolt: Clear registers properly when auto clear isn't in use") Cc: stable@vger.kernel.org Reviewed-by: Mario Limonciello Signed-off-by: Mika Westerberg commit f4e4534850a9d18c250a93f8d7fbb51310828110 Author: Pedro Tammela Date: Mon May 29 12:33:35 2023 -0300 net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report The current code for the length calculation wrongly truncates the reported length of the groups array, causing an under report of the subscribed groups. To fix this, use 'BITS_TO_BYTES()' which rounds up the division by 8. Fixes: b42be38b2778 ("netlink: add API to retrieve all group memberships") Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230529153335.389815-1-pctammela@mojatatu.com Signed-off-by: Jakub Kicinski commit f6a27d6dc51b288106adaf053cff9c9b9cc12c4e Author: Oliver Upton Date: Tue May 30 19:32:13 2023 +0000 KVM: arm64: Drop last page ref in kvm_pgtable_stage2_free_removed() The reference count on page table allocations is increased for every 'counted' PTE (valid or donated) in the table in addition to the initial reference from ->zalloc_page(). kvm_pgtable_stage2_free_removed() fails to drop the last reference on the root of the table walk, meaning we leak memory. Fix it by dropping the last reference after the free walker returns, at which point all references for 'counted' PTEs have been released. Cc: stable@vger.kernel.org Fixes: 5c359cca1faf ("KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make") Reported-by: Yu Zhao Signed-off-by: Oliver Upton Tested-by: Yu Zhao Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230530193213.1663411-1-oliver.upton@linux.dev commit 36eec020fab668719b541f34d97f44e232ffa165 Author: Zhengchao Shao Date: Sat May 27 17:37:47 2023 +0800 net: sched: fix NULL pointer dereference in mq_attach When use the following command to test: 1)ip link add bond0 type bond 2)ip link set bond0 up 3)tc qdisc add dev bond0 root handle ffff: mq 4)tc qdisc replace dev bond0 parent ffff:fff1 handle ffff: mq The kernel reports NULL pointer dereference issue. The stack information is as follows: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mq_attach+0x44/0xa0 lr : qdisc_graft+0x20c/0x5cc sp : ffff80000e2236a0 x29: ffff80000e2236a0 x28: ffff0000c0e59d80 x27: ffff0000c0be19c0 x26: ffff0000cae3e800 x25: 0000000000000010 x24: 00000000fffffff1 x23: 0000000000000000 x22: ffff0000cae3e800 x21: ffff0000c9df4000 x20: ffff0000c9df4000 x19: 0000000000000000 x18: ffff80000a934000 x17: ffff8000f5b56000 x16: ffff80000bb08000 x15: 0000000000000000 x14: 0000000000000000 x13: 6b6b6b6b6b6b6b6b x12: 6b6b6b6b00000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff0000c0be0730 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000008 x5 : ffff0000cae3e864 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000001 x1 : ffff8000090bc23c x0 : 0000000000000000 Call trace: mq_attach+0x44/0xa0 qdisc_graft+0x20c/0x5cc tc_modify_qdisc+0x1c4/0x664 rtnetlink_rcv_msg+0x354/0x440 netlink_rcv_skb+0x64/0x144 rtnetlink_rcv+0x28/0x34 netlink_unicast+0x1e8/0x2a4 netlink_sendmsg+0x308/0x4a0 sock_sendmsg+0x64/0xac ____sys_sendmsg+0x29c/0x358 ___sys_sendmsg+0x90/0xd0 __sys_sendmsg+0x7c/0xd0 __arm64_sys_sendmsg+0x2c/0x38 invoke_syscall+0x54/0x114 el0_svc_common.constprop.1+0x90/0x174 do_el0_svc+0x3c/0xb0 el0_svc+0x24/0xec el0t_64_sync_handler+0x90/0xb4 el0t_64_sync+0x174/0x178 This is because when mq is added for the first time, qdiscs in mq is set to NULL in mq_attach(). Therefore, when replacing mq after adding mq, we need to initialize qdiscs in the mq before continuing to graft. Otherwise, it will couse NULL pointer dereference issue in mq_attach(). And the same issue will occur in the attach functions of mqprio, taprio and htb. ffff:fff1 means that the repalce qdisc is ingress. Ingress does not allow any qdisc to be attached. Therefore, ffff:fff1 is incorrectly used, and the command should be dropped. Fixes: 6ec1c69a8f64 ("net_sched: add classful multiqueue dummy scheduler") Signed-off-by: Zhengchao Shao Tested-by: Peilin Ye Acked-by: Jamal Hadi Salim Link: https://lore.kernel.org/r/20230527093747.3583502-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski commit bb50f12c69030c9a1aa5dfa26ea947f38c4c99f9 Merge: 7ba0732c805fd 9de95df5d15ba Author: Jakub Kicinski Date: Tue May 30 23:31:06 2023 -0700 Merge branch 'net-sched-fixes-for-sch_ingress-and-sch_clsact' Peilin Ye says: ==================== net/sched: Fixes for sch_ingress and sch_clsact These are v6 fixes for ingress and clsact Qdiscs, including only first 4 patches (already tested and reviewed) from v5. Patch 5 and 6 from previous versions are still under discussion and will be sent separately. [a] https://syzkaller.appspot.com/bug?extid=b53a9c0d1ea4ad62da8b Link to v5: https://lore.kernel.org/r/cover.1684887977.git.peilin.ye@bytedance.com/ Link to v4: https://lore.kernel.org/r/cover.1684825171.git.peilin.ye@bytedance.com/ Link to v3 (incomplete): https://lore.kernel.org/r/cover.1684821877.git.peilin.ye@bytedance.com/ Link to v2: https://lore.kernel.org/r/cover.1684796705.git.peilin.ye@bytedance.com/ Link to v1: https://lore.kernel.org/r/cover.1683326865.git.peilin.ye@bytedance.com/ ==================== Link: https://lore.kernel.org/r/cover.1685388545.git.peilin.ye@bytedance.com Signed-off-by: Jakub Kicinski commit 9de95df5d15baa956c2b70b9e794842e790a8a13 Author: Peilin Ye Date: Mon May 29 12:54:26 2023 -0700 net/sched: Prohibit regrafting ingress or clsact Qdiscs Currently, after creating an ingress (or clsact) Qdisc and grafting it under TC_H_INGRESS (TC_H_CLSACT), it is possible to graft it again under e.g. a TBF Qdisc: $ ip link add ifb0 type ifb $ tc qdisc add dev ifb0 handle 1: root tbf rate 20kbit buffer 1600 limit 3000 $ tc qdisc add dev ifb0 clsact $ tc qdisc link dev ifb0 handle ffff: parent 1:1 $ tc qdisc show dev ifb0 qdisc tbf 1: root refcnt 2 rate 20Kbit burst 1600b lat 560.0ms qdisc clsact ffff: parent ffff:fff1 refcnt 2 ^^^^^^^^ clsact's refcount has increased: it is now grafted under both TC_H_CLSACT and 1:1. ingress and clsact Qdiscs should only be used under TC_H_INGRESS (TC_H_CLSACT). Prohibit regrafting them. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 1f211a1b929c ("net, sched: add clsact qdisc") Tested-by: Pedro Tammela Acked-by: Jamal Hadi Salim Reviewed-by: Jamal Hadi Salim Reviewed-by: Vlad Buslov Signed-off-by: Peilin Ye Signed-off-by: Jakub Kicinski commit f85fa45d4a9408d98c46c8fa45ba2e3b2f4bf219 Author: Peilin Ye Date: Mon May 29 12:54:03 2023 -0700 net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs Currently it is possible to add e.g. an HTB Qdisc under ffff:fff1 (TC_H_INGRESS, TC_H_CLSACT): $ ip link add name ifb0 type ifb $ tc qdisc add dev ifb0 parent ffff:fff1 htb $ tc qdisc add dev ifb0 clsact Error: Exclusivity flag on, cannot modify. $ drgn ... >>> ifb0 = netdev_get_by_name(prog, "ifb0") >>> qdisc = ifb0.ingress_queue.qdisc_sleeping >>> print(qdisc.ops.id.string_().decode()) htb >>> qdisc.flags.value_() # TCQ_F_INGRESS 2 Only allow ingress and clsact Qdiscs under ffff:fff1. Return -EINVAL for everything else. Make TCQ_F_INGRESS a static flag of ingress and clsact Qdiscs. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 1f211a1b929c ("net, sched: add clsact qdisc") Tested-by: Pedro Tammela Acked-by: Jamal Hadi Salim Reviewed-by: Jamal Hadi Salim Reviewed-by: Vlad Buslov Signed-off-by: Peilin Ye Signed-off-by: Jakub Kicinski commit 5eeebfe6c493192b10d516abfd72742900f2a162 Author: Peilin Ye Date: Mon May 29 12:53:21 2023 -0700 net/sched: sch_clsact: Only create under TC_H_CLSACT clsact Qdiscs are only supposed to be created under TC_H_CLSACT (which equals TC_H_INGRESS). Return -EOPNOTSUPP if 'parent' is not TC_H_CLSACT. Fixes: 1f211a1b929c ("net, sched: add clsact qdisc") Tested-by: Pedro Tammela Acked-by: Jamal Hadi Salim Reviewed-by: Jamal Hadi Salim Reviewed-by: Vlad Buslov Signed-off-by: Peilin Ye Signed-off-by: Jakub Kicinski commit c7cfbd115001f94de9e4053657946a383147e803 Author: Peilin Ye Date: Mon May 29 12:52:55 2023 -0700 net/sched: sch_ingress: Only create under TC_H_INGRESS ingress Qdiscs are only supposed to be created under TC_H_INGRESS. Return -EOPNOTSUPP if 'parent' is not TC_H_INGRESS, similar to mq_init(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+b53a9c0d1ea4ad62da8b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/0000000000006cf87705f79acf1a@google.com/ Tested-by: Pedro Tammela Acked-by: Jamal Hadi Salim Reviewed-by: Jamal Hadi Salim Reviewed-by: Vlad Buslov Signed-off-by: Peilin Ye Signed-off-by: Jakub Kicinski commit c7275ce6a5fd32ca9f5a6294ed89cf0523181af9 Author: Uday Shankar Date: Thu May 25 12:22:04 2023 -0600 nvme: improve handling of long keep alives Upon keep alive completion, nvme_keep_alive_work is scheduled with the same delay every time. If keep alive commands are completing slowly, this may cause a keep alive timeout. The following trace illustrates the issue, taking KATO = 8 and TBKAS off for simplicity: 1. t = 0: run nvme_keep_alive_work, send keep alive 2. t = ε: keep alive reaches controller, controller restarts its keep alive timer 3. t = 4: host receives keep alive completion, schedules nvme_keep_alive_work with delay 4 4. t = 8: run nvme_keep_alive_work, send keep alive Here, a keep alive having RTT of 4 causes a delay of at least 8 - ε between the controller receiving successive keep alives. With ε small, the controller is likely to detect a keep alive timeout. Fix this by calculating the RTT of the keep alive command, and adjusting the scheduling delay of the next keep alive work accordingly. Reported-by: Costa Sapuntzakis Reported-by: Randy Jennings Signed-off-by: Uday Shankar Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 48b1320a674e1ff5de2fad8606bee38f724594dc Merge: afead42fdfcae 5ad9b4719fc9b Author: Linus Torvalds Date: Tue May 30 17:23:50 2023 -0400 Merge tag 'for-6.4-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "One bug fix and two build warning fixes: - call proper end bio callback for metadata RAID0 in a rare case of an unaligned block - fix uninitialized variable (reported by gcc 10.2) - fix warning about potential access beyond array bounds on mips64 with 64k pages (runtime check would not allow that)" * tag 'for-6.4-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds btrfs: fix an uninitialized variable warning in btrfs_log_inode btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work commit afead42fdfcae714fb6ac41a5c323629cdb6f9ee Merge: 1683c329b6a2e c041d33bf7ec7 Author: Linus Torvalds Date: Tue May 30 17:12:13 2023 -0400 Merge tag 'perf-tools-fixes-for-v6.4-2-2023-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix BPF CO-RE naming convention for checking the availability of fields on 'union perf_mem_data_src' on the running kernel - Remove the use of llvm-strip on BPF skel object files, not needed, fixes a build breakage when the llvm package, that contains it in most distros, isn't installed - Fix tools that use both evsel->{bpf_counter_list,bpf_filters}, removing them from a union - Remove extra "--" from the 'perf ftrace latency' --use-nsec option, previously it was working only when using the '-n' alternative - Don't stop building when both binutils-devel and a C++ compiler isn't available to compile the alternative C++ demangle support code, disable that feature instead - Sync the linux/in.h and coresight-pmu.h header copies with the kernel sources - Fix relative include path to cs-etm.h * tag 'perf-tools-fixes-for-v6.4-2-2023-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf evsel: Separate bpf_counter_list and bpf_filters, can be used at the same time tools headers UAPI: Sync the linux/in.h with the kernel sources perf cs-etm: Copy kernel coresight-pmu.h header perf bpf: Do not use llvm-strip on BPF binary perf build: Don't compile demangle-cxx.cpp if not necessary perf arm: Fix include path to cs-etm.h perf bpf filter: Fix a broken perf sample data naming for BPF CO-RE perf ftrace latency: Remove unnecessary "--" from --use-nsec option commit 1683c329b6a2ee54989811089854a8ac2d5b5fc1 Merge: 6d86b56f54533 0cc6578048e09 Author: Linus Torvalds Date: Tue May 30 17:07:25 2023 -0400 Merge tag 'regmap-fix-v6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "The most important fix here is for missing dropping of the RCU read lock when syncing maple tree register caches, the physical devices I have that use the code don't do any syncing so I'd only ever tested this with virtual devices and missed the fact that we need to drop the lock in order to write to buses that need to sleep. Otherwise there's a fix for an edge case when splitting up large batch writes which has been lurking for a long time, a check to make sure nobody writes new drivers with a bug that was found in several SoundWire drivers and a tweak to the way the new kunit tests are enabled to ensure they don't cause regmap to be enabled when it wouldn't otherwise be" * tag 'regmap-fix-v6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: maple: Drop the RCU read lock while syncing registers regmap: sdw: check for invalid multi-register writes config regmap: Account for register length when chunking regmap: REGMAP_KUNIT should not select REGMAP commit 6d86b56f54533025d94df25d77ed324344e02337 Merge: 8b817fded42d8 db3e33dd8bd95 Author: Linus Torvalds Date: Tue May 30 15:49:40 2023 -0400 Merge tag 'modules-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull modules fix from Luis Chamberlain: "A fix is provided for ia64. Even though ia64 is on life support it helps to fix issues if we can. Thanks to Linus for doing tons of the ia64 debugging" * tag 'modules-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module: fix module load for ia64 commit eb1f822c76beeaa76ab8b6737ab9dc9f9798408c Author: Theodore Ts'o Date: Fri May 26 23:57:29 2023 -0400 ext4: enable the lazy init thread when remounting read/write In commit a44be64bbecb ("ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled") we defer clearing tyhe SB_RDONLY flag in struct super. However, we didn't defer when we checked sb_rdonly() to determine the lazy itable init thread should be enabled, with the next result that the lazy inode table initialization would not be properly started. This can cause generic/231 to fail in ext4's nojournal mode. Fix this by moving when we decide to start or stop the lazy itable init thread to after we clear the SB_RDONLY flag when we are remounting the file system read/write. Fixes a44be64bbecb ("ext4: don't clear SB_RDONLY when remounting r/w until...") Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20230527035729.1001605-1-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 1077b2d53ef53629c14106aecf633bebd286c04c Author: Jan Kara Date: Wed May 24 12:44:53 2023 +0200 ext4: fix fsync for non-directories Commit e360c6ed7274 ("ext4: Drop special handling of journalled data from ext4_sync_file()") simplified ext4_sync_file() by dropping special handling of journalled data mode as it was not needed anymore. However that branch was also used for directories and symlinks and since the fastcommit code does not track metadata changes to non-regular files, the change has caused e.g. fsync(2) on directories to not commit transaction as it should. Fix the problem by adding handling for non-regular files. Fixes: e360c6ed7274 ("ext4: Drop special handling of journalled data from ext4_sync_file()") Reported-by: Eric Whitney Link: https://lore.kernel.org/all/ZFqO3xVnmhL7zv1x@debian-BULLSEYE-live-builder-AMD64 Signed-off-by: Jan Kara Tested-by: Eric Whitney Link: https://lore.kernel.org/r/20230524104453.8734-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit aff3bea95388299eec63440389b4545c8041b357 Author: Theodore Ts'o Date: Tue May 23 23:49:51 2023 -0400 ext4: add lockdep annotations for i_data_sem for ea_inode's Treat i_data_sem for ea_inodes as being in their own lockdep class to avoid lockdep complaints about ext4_setattr's use of inode_lock() on normal inodes potentially causing lock ordering with i_data_sem on ea_inodes in ext4_xattr_inode_write(). However, ea_inodes will be operated on by ext4_setattr(), so this isn't a problem. Cc: stable@kernel.org Link: https://syzkaller.appspot.com/bug?extid=298c5d8fb4a128bc27b0 Reported-by: syzbot+298c5d8fb4a128bc27b0@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20230524034951.779531-5-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 2bc7e7c1a3bc9bd0cbf0f71006f6fe7ef24a00c2 Author: Theodore Ts'o Date: Tue May 23 23:49:50 2023 -0400 ext4: disallow ea_inodes with extended attributes An ea_inode stores the value of an extended attribute; it can not have extended attributes itself, or this will cause recursive nightmares. Add a check in ext4_iget() to make sure this is the case. Cc: stable@kernel.org Reported-by: syzbot+e44749b6ba4d0434cd47@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20230524034951.779531-4-tytso@mit.edu Signed-off-by: Theodore Ts'o commit b928dfdcb27d8fa59917b794cfba53052a2f050f Author: Theodore Ts'o Date: Tue May 23 23:49:49 2023 -0400 ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() If the ea_inode has been pushed out of the inode cache while there is still a reference in the mb_cache, the lockdep subclass will not be set on the inode, which can lead to some lockdep false positives. Fixes: 33d201e0277b ("ext4: fix lockdep warning about recursive inode locking") Cc: stable@kernel.org Reported-by: syzbot+d4b971e744b1f5439336@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20230524034951.779531-3-tytso@mit.edu Signed-off-by: Theodore Ts'o commit d19663edc91de65ae85eea9902addc9d04b0ceb6 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:43 2023 +0100 fbdev: bw2: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit a3ce8c8ffb6fdee842b703da78bd81eac0f16d71 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:42 2023 +0100 fbdev: broadsheetfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 4b88b6e1c4ec832b02a65b51489692b58d2c6f84 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:41 2023 +0100 fbdev: au1200fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit bf76544d4515ac543cb9e5c666eebf3866e662a7 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:40 2023 +0100 fbdev: au1100fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 4369e38a6f1978b48f9200d2a69ce4658db76047 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:39 2023 +0100 fbdev: arcfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit d00394e1395be9e27f58d58a61642a2a5df10405 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:38 2023 +0100 fbdev: au1100fb: Drop if with an always false condition The driver core never calls a remove callback with the platform_device pointer being NULL. So the check for this condition can just be dropped. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit db3e33dd8bd956f165436afdbdbf1c653fb3c8e6 Author: Song Liu Date: Sun May 28 16:00:41 2023 -0700 module: fix module load for ia64 Frank reported boot regression in ia64 as: ELILO v3.16 for EFI/IA-64 .. Uncompressing Linux... done Loading file AC100221.initrd.img...done [ 0.000000] Linux version 6.4.0-rc3 (root@x4270) (ia64-linux-gcc (GCC) 12.2.0, GNU ld (GNU Binutils) 2.39) #1 SMP Thu May 25 15:52:20 CEST 2023 [ 0.000000] efi: EFI v1.1 by HP [ 0.000000] efi: SALsystab=0x3ee7a000 ACPI 2.0=0x3fe2a000 ESI=0x3ee7b000 SMBIOS=0x3ee7c000 HCDP=0x3fe28000 [ 0.000000] PCDP: v3 at 0x3fe28000 [ 0.000000] earlycon: uart8250 at MMIO 0x00000000f4050000 (options '9600n8') [ 0.000000] printk: bootconsole [uart8250] enabled [ 0.000000] ACPI: Early table checksum verification disabled [ 0.000000] ACPI: RSDP 0x000000003FE2A000 000028 (v02 HP ) [ 0.000000] ACPI: XSDT 0x000000003FE2A02C 0000CC (v01 HP rx2620 00000000 HP 00000000) [...] [ 3.793350] Run /init as init process Loading, please wait... Starting systemd-udevd version 252.6-1 [ 3.951100] ------------[ cut here ]------------ [ 3.951100] WARNING: CPU: 6 PID: 140 at kernel/module/main.c:1547 __layout_sections+0x370/0x3c0 [ 3.949512] Unable to handle kernel paging request at virtual address 1000000000000000 [ 3.951100] Modules linked in: [ 3.951100] CPU: 6 PID: 140 Comm: (udev-worker) Not tainted 6.4.0-rc3 #1 [ 3.956161] (udev-worker)[142]: Oops 11003706212352 [1] [ 3.951774] Hardware name: hp server rx2620 , BIOS 04.29 11/30/2007 [ 3.951774] [ 3.951774] Call Trace: [ 3.958339] Unable to handle kernel paging request at virtual address 1000000000000000 [ 3.956161] Modules linked in: [ 3.951774] [] show_stack.part.0+0x30/0x60 [ 3.951774] sp=e000000183a67b20 bsp=e000000183a61628 [ 3.956161] [ 3.956161] which bisect to module_memory change [1]. Debug showed that ia64 uses some special sections: __layout_sections: section .got (sh_flags 10000002) matched to MOD_INVALID __layout_sections: section .sdata (sh_flags 10000003) matched to MOD_INVALID __layout_sections: section .sbss (sh_flags 10000003) matched to MOD_INVALID All these sections are loaded to module core memory before [1]. Fix ia64 boot by loading these sections to MOD_DATA (core rw data). [1] commit ac3b43283923 ("module: replace module_layout with module_memory") Fixes: ac3b43283923 ("module: replace module_layout with module_memory") Reported-by: Frank Scheiner Closes: https://lists.debian.org/debian-ia64/2023/05/msg00010.html Closes: https://marc.info/?l=linux-ia64&m=168509859125505 Cc: Linus Torvalds Signed-off-by: Song Liu Tested-by: John Paul Adrian Glaubitz Signed-off-by: Luis Chamberlain commit 774a9636514764ddc0d072ae0d1d1c01a47e6ddd Author: Uday Shankar Date: Thu May 25 12:22:03 2023 -0600 nvme: check IO start time when deciding to defer KA When a command completes, we set a flag which will skip sending a keep alive at the next run of nvme_keep_alive_work when TBKAS is on. However, if the command was submitted long ago, it's possible that the controller may have also restarted its keep alive timer (as a result of receiving the command) long ago. The following trace demonstrates the issue, assuming TBKAS is on and KATO = 8 for simplicity: 1. t = 0: submit I/O commands A, B, C, D, E 2. t = 0.5: commands A, B, C, D, E reach controller, restart its keep alive timer 3. t = 1: A completes 4. t = 2: run nvme_keep_alive_work, see recent completion, do nothing 5. t = 3: B completes 6. t = 4: run nvme_keep_alive_work, see recent completion, do nothing 7. t = 5: C completes 8. t = 6: run nvme_keep_alive_work, see recent completion, do nothing 9. t = 7: D completes 10. t = 8: run nvme_keep_alive_work, see recent completion, do nothing 11. t = 9: E completes At this point, 8.5 seconds have passed without restarting the controller's keep alive timer, so the controller will detect a keep alive timeout. Fix this by checking the IO start time when deciding to defer sending a keep alive command. Only set comp_seen if the command started after the most recent run of nvme_keep_alive_work. With this change, the completions of B, C, and D will not set comp_seen and the run of nvme_keep_alive_work at t = 4 will send a keep alive. Reported-by: Costa Sapuntzakis Reported-by: Randy Jennings Signed-off-by: Uday Shankar Reviewed-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit ea4d453b9ec9ea279c39744cd0ecb47ef48ede35 Author: Uday Shankar Date: Thu May 25 12:22:02 2023 -0600 nvme: double KA polling frequency to avoid KATO with TBKAS on With TBKAS on, the completion of one command can defer sending a keep alive for up to twice the delay between successive runs of nvme_keep_alive_work. The current delay of KATO / 2 thus makes it possible for one command to defer sending a keep alive for up to KATO, which can result in the controller detecting a KATO. The following trace demonstrates the issue, taking KATO = 8 for simplicity: 1. t = 0: run nvme_keep_alive_work, no keep-alive sent 2. t = ε: I/O completion seen, set comp_seen = true 3. t = 4: run nvme_keep_alive_work, see comp_seen == true, skip sending keep-alive, set comp_seen = false 4. t = 8: run nvme_keep_alive_work, see comp_seen == false, send a keep-alive command. Here, there is a delay of 8 - ε between receiving a command completion and sending the next command. With ε small, the controller is likely to detect a keep alive timeout. Fix this by running nvme_keep_alive_work with a delay of KATO / 4 whenever TBKAS is on. Going through the above trace now gives us a worst-case delay of 4 - ε, which is in line with the recommendation of sending a command every KATO / 2 in the NVMe specification. Reported-by: Costa Sapuntzakis Reported-by: Randy Jennings Signed-off-by: Uday Shankar Reviewed-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 31a5978243d24d77be4bacca56c78a0fbc43b00d Author: min15.li Date: Fri May 26 17:06:56 2023 +0000 nvme: fix miss command type check In the function nvme_passthru_end(), only the value of the command opcode is checked, without checking the command type (IO command or Admin command). When we send a Dataset Management command (The opcode of the Dataset Management command is the same as the Set Feature command), kernel thinks it is a set feature command, then sets the controller's keep alive interval, and calls nvme_keep_alive_work(). Signed-off-by: min15.li Reviewed-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit fcfe84236ec0974fe92f0578d1d58ed805c4b70f Author: Roger Quadros Date: Tue May 30 09:59:26 2023 +0300 usb: typec: tps6598x: Fix broken polling mode after system suspend/resume During system resume we need to resume the polling workqueue if client->irq is not set else polling will no longer work. Fixes: 0d6a119cecd7 ("usb: typec: tps6598x: Add support for polling interrupts status") Signed-off-by: Roger Quadros Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230530065926.6161-1-rogerq@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0c331fd1dccfba657129380ee084b95c1cedfbef Author: Stephan Gerhold Date: Thu May 18 15:04:25 2023 +0200 spi: qup: Request DMA before enabling clocks It is usually better to request all necessary resources (clocks, regulators, ...) before starting to make use of them. That way they do not change state in case one of the resources is not available yet and probe deferral (-EPROBE_DEFER) is necessary. This is particularly important for DMA channels and IOMMUs which are not enforced by fw_devlink yet (unless you use fw_devlink.strict=1). spi-qup does this in the wrong order, the clocks are enabled and disabled again when the DMA channels are not available yet. This causes issues in some cases: On most SoCs one of the SPI QUP clocks is shared with the UART controller. When using earlycon UART is actively used during boot but might not have probed yet, usually for the same reason (waiting for the DMA controller). In this case, the brief enable/disable cycle ends up gating the clock and further UART console output will halt the system completely. Avoid this by requesting the DMA channels before changing the clock state. Fixes: 612762e82ae6 ("spi: qup: Add DMA capabilities") Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20230518-spi-qup-clk-defer-v1-1-f49fc9ca4e02@gerhold.net Signed-off-by: Mark Brown commit e384dba03e3294ce7ea69e4da558e9bf8f0e8946 Author: Edson Juliano Drosdeck Date: Mon May 29 15:19:11 2023 -0300 ASoC: nau8824: Add quirk to active-high jack-detect Add entries for Positivo laptops: CW14Q01P, K1424G, N14ZP74G to the DMI table, so that active-high jack-detect will work properly on these laptops. Signed-off-by: Edson Juliano Drosdeck Link: https://lore.kernel.org/r/20230529181911.632851-1-edson.drosdeck@gmail.com Signed-off-by: Mark Brown commit b6b5c6426efe27cbd954409a50604d99c79bd42b Author: Vijendar Mukunda Date: Thu May 25 16:59:55 2023 +0530 ASoC: amd: ps: fix for acp_lock access in pdm driver Sending the mutex address(acp_lock) as platform data during ACP PDM platform driver register sequence, its creating copy of the platform data. Referencing this platform data in ACP PDM driver results incorrect reference to the common lock usage. Instead of directly passing the lock address as platform data, retrieve it from parent driver data structure and use the same lock reference in ACP PDM driver. Fixes: 45aa83cb9388 ("ASoC: amd: ps: use acp_lock to protect common registers in pdm driver") Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230525113000.1290758-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 7183c37fd53eee1e795206e625da12a5d7ec1e1a Author: Herve Codina Date: Tue May 23 10:59:02 2023 +0200 serial: cpm_uart: Fix a COMPILE_TEST dependency In a COMPILE_TEST configuration, the cpm_uart driver uses symbols from the cpm_uart_cpm2.c file. This file is compiled only when CONFIG_CPM2 is set. Without this dependency, the linker fails with some missing symbols for COMPILE_TEST configuration that needs SERIAL_CPM without enabling CPM2. This lead to: depends on CPM2 || CPM1 || (PPC32 && CPM2 && COMPILE_TEST) This dependency does not make sense anymore and can be simplified removing all the COMPILE_TEST part. Signed-off-by: Herve Codina Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202305160221.9XgweObz-lkp@intel.com/ Fixes: e3e7b13bffae ("serial: allow COMPILE_TEST for some drivers") Cc: stable Link: https://lore.kernel.org/r/20230523085902.75837-3-herve.codina@bootlin.com Signed-off-by: Greg Kroah-Hartman commit 192d43e91e0fdbd51b64ba36e773cbdf38dda505 Author: Herve Codina Date: Tue May 23 10:59:01 2023 +0200 soc: fsl: cpm1: Fix TSA and QMC dependencies in case of COMPILE_TEST In order to compile tsa.c and qmc.c, CONFIG_CPM must be set. Without this dependency, the linker fails with some missing symbols for COMPILE_TEST configurations that need QMC without enabling CPM. Signed-off-by: Herve Codina Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202305160221.9XgweObz-lkp@intel.com/ Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/20230523085902.75837-2-herve.codina@bootlin.com Signed-off-by: Greg Kroah-Hartman commit 2474e05467c00f7d51af3039b664de6886325257 Author: Sherry Sun Date: Fri May 19 17:47:51 2023 +0800 tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK LPUART IP now has two known bugs, one is that CTS has higher priority than the break signal, which causes the break signal sending through UARTCTRL_SBK may impacted by the CTS input if the HW flow control is enabled. It exists on all platforms we support in this driver. So we add a workaround patch for this issue: commit c4c81db5cf8b ("tty: serial: fsl_lpuart: disable the CTS when send break signal"). Another IP bug is i.MX8QM LPUART may have an additional break character being sent after SBK was cleared. It may need to add some delay between clearing SBK and re-enabling CTS to ensure that the SBK latch are completely cleared. But we found that during the delay period before CTS is enabled, there is still a risk that Bluetooth data in TX FIFO may be sent out during this period because of break off and CTS disabled(even if BT sets CTS line deasserted, data is still sent to BT). Due to this risk, we have to drop the CTS-disabling workaround for SBK bugs, use TXINV seems to be a better way to replace SBK feature and avoid above risk. Also need to disable the transmitter to prevent any data from being sent out during break, then invert the TX line to send break. Then disable the TXINV when turn off break and re-enable transmitter. Fixes: c4c81db5cf8b ("tty: serial: fsl_lpuart: disable the CTS when send break signal") Cc: stable Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20230519094751.28948-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 134f49dec0b6aca3259cd8259de4c572048bd207 Author: Christophe JAILLET Date: Sun May 14 13:25:42 2023 +0200 serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() If an error occurs after reset_control_deassert(), it must be re-asserted, as already done in the .remove() function. Fixes: c6825c6395b7 ("serial: 8250_tegra: Create Tegra specific 8250 driver") Cc: stable Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/f8130f35339cc80edc6b9aac4bb2a60b60a226bf.1684063511.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit 7ba0732c805fdc623494ff36245d84222ba893e3 Merge: 1919b39fc6eab 63212608a92a1 Author: Paolo Abeni Date: Tue May 30 13:21:05 2023 +0200 Merge branch 'selftests-mptcp-skip-tests-not-supported-by-old-kernels-part-1' Matthieu Baerts says: ==================== selftests: mptcp: skip tests not supported by old kernels (part 1) After a few years of increasing test coverage in the MPTCP selftests, we realised [1] the last version of the selftests is supposed to run on old kernels without issues. Supporting older versions is not that easy for this MPTCP case: these selftests are often validating the internals by checking packets that are exchanged, when some MIB counters are incremented after some actions, how connections are getting opened and closed in some cases, etc. In other words, it is not limited to the socket interface between the userspace and the kernelspace. In addition, the current selftests run a lot of different sub-tests but the TAP13 protocol used in the selftests don't support sub-tests: in other words, one failure in sub-tests implies that the whole selftest is seen as failed at the end because sub-tests are not tracked. It is then important to skip sub-tests not supported by old kernels. To minimise the modifications and reduce the complexity to support old versions, the idea is to look at external signs and skip the whole selftests or just some sub-tests before starting them. This first part focuses on marking the different selftests as skipped if MPTCP is not even supported. That's what is done in patches 2 to 8. Patch 2/8 introduces a new file (mptcp_lib.sh) to be able to re-use some helpers in the different selftests. The first MPTCP selftest has been introduced in v5.6. Patch 1/8 is a bit different but still linked: it modifies mptcp_join.sh selftest not to use 'cmp --bytes' which is not supported by the BusyBox implementation. It is apparently quite common to use BusyBox in CI environments. This tool is needed for a subtest introduced in v6.1. Link: https://lore.kernel.org/stable/CA+G9fYtDGpgT4dckXD-y-N92nqUxuvue_7AtDdBcHrbOMsDZLg@mail.gmail.com/ [1] Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 ==================== Link: https://lore.kernel.org/r/20230528-upstream-net-20230528-mptcp-selftests-support-old-kernels-part-1-v1-0-a32d85577fc6@tessares.net Signed-off-by: Paolo Abeni commit 63212608a92a1ff10ae56dbb14e9fb685f7e4ffa Author: Matthieu Baerts Date: Sun May 28 19:35:33 2023 +0200 selftests: mptcp: userspace pm: skip if MPTCP is not supported Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP. A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped". Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 259a834fadda ("selftests: mptcp: functional tests for the userspace PM type") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni commit cf6f0fda7af7e8e016070bfee6b189e671a0c776 Author: Matthieu Baerts Date: Sun May 28 19:35:32 2023 +0200 selftests: mptcp: sockopt: skip if MPTCP is not supported Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP. A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped". Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: dc65fe82fb07 ("selftests: mptcp: add packet mark test case") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni commit 9161f21c74a1a0e7bb39eb84ea0c86b23c92fc87 Author: Matthieu Baerts Date: Sun May 28 19:35:31 2023 +0200 selftests: mptcp: simult flows: skip if MPTCP is not supported Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP. A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped". Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni commit 46565acdd29facbf418a11e4a3791b3c8967308d Author: Matthieu Baerts Date: Sun May 28 19:35:30 2023 +0200 selftests: mptcp: diag: skip if MPTCP is not supported Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP. A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped". Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni commit 715c78a82e00f848f99ef76e6f6b89216ccba268 Author: Matthieu Baerts Date: Sun May 28 19:35:29 2023 +0200 selftests: mptcp: join: skip if MPTCP is not supported Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP. A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped". Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: b08fbf241064 ("selftests: add test-cases for MPTCP MP_JOIN") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni commit 0f4955a40dafe18a1122e3714d8173e4b018e869 Author: Matthieu Baerts Date: Sun May 28 19:35:28 2023 +0200 selftests: mptcp: pm nl: skip if MPTCP is not supported Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP. A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped". Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: eedbc685321b ("selftests: add PM netlink functional tests") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni commit d83013bdf90a7994a474b0e650a7fc94b0d4ded6 Author: Matthieu Baerts Date: Sun May 28 19:35:27 2023 +0200 selftests: mptcp: connect: skip if MPTCP is not supported Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP. A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped". Note that this check can also mark the test as failed if 'SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES' env var is set to 1: by doing that, we can make sure a test is not being skipped by mistake. A new shared file is added here to be able to re-used the same check in the different selftests we have. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni commit d328fe87067480cf2bd0b58dab428a98d31dbb7e Author: Matthieu Baerts Date: Sun May 28 19:35:26 2023 +0200 selftests: mptcp: join: avoid using 'cmp --bytes' BusyBox's 'cmp' command doesn't support the '--bytes' parameter. Some CIs -- i.e. LKFT -- use BusyBox and have the mptcp_join.sh test failing [1] because their 'cmp' command doesn't support this '--bytes' option: cmp: unrecognized option '--bytes=1024' BusyBox v1.35.0 () multi-call binary. Usage: cmp [-ls] [-n NUM] FILE1 [FILE2] Instead, 'head --bytes' can be used as this option is supported by BusyBox. A temporary file is needed for this operation. Because it is apparently quite common to use BusyBox, it is certainly better to backport this fix to impacted kernels. Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases") Cc: stable@vger.kernel.org Link: https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.3-rc5-5-g148341f0a2f5/testrun/16088933/suite/kselftest-net-mptcp/test/net_mptcp_userspace_pm_sh/log [1] Suggested-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: Paolo Abeni commit fb109fba728407fa4a84d659b5cb87cd8399d7b3 Author: Hao Yao Date: Wed May 24 11:51:33 2023 +0800 platform/x86: int3472: Avoid crash in unregistering regulator gpio When int3472 is loaded before GPIO driver, acpi_get_and_request_gpiod() failed but the returned gpio descriptor is not NULL, it will cause panic in later gpiod_put(), so set the gpio_desc to NULL in register error handling to avoid such crash. Signed-off-by: Hao Yao Signed-off-by: Bingbu Cao Link: https://lore.kernel.org/r/20230524035135.90315-1-bingbu.cao@intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 1919b39fc6eabb9a6f9a51706ff6d03865f5df29 Author: Haiyang Zhang Date: Fri May 26 08:38:57 2023 -0700 net: mana: Fix perf regression: remove rx_cqes, tx_cqes counters The apc->eth_stats.rx_cqes is one per NIC (vport), and it's on the frequent and parallel code path of all queues. So, r/w into this single shared variable by many threads on different CPUs creates a lot caching and memory overhead, hence perf regression. And, it's not accurate due to the high volume concurrent r/w. For example, a workload is iperf with 128 threads, and with RPS enabled. We saw perf regression of 25% with the previous patch adding the counters. And this patch eliminates the regression. Since the error path of mana_poll_rx_cq() already has warnings, so keeping the counter and convert it to a per-queue variable is not necessary. So, just remove this counter from this high frequency code path. Also, remove the tx_cqes counter for the same reason. We have warnings & other counters for errors on that path, and don't need to count every normal cqe processing. Cc: stable@vger.kernel.org Fixes: bd7fc6e1957c ("net: mana: Add new MANA VF performance counters for easier troubleshooting") Signed-off-by: Haiyang Zhang Reviewed-by: Horatiu Vultur Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/1685115537-31675-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Paolo Abeni commit 91539341a3b6e9c868024a4292455dae36e6f58c Author: Marc Zyngier Date: Tue May 30 11:01:22 2023 +0100 irqchip/gic: Correctly validate OF quirk descriptors When checking for OF quirks, make sure either 'compatible' or 'property' is set, and give up otherwise. This avoids non-OF quirks being randomly applied as they don't have any of the OF data that need checking. Cc: Douglas Anderson Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Fixes: 44bd78dd2b88 ("irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues") Signed-off-by: Marc Zyngier commit 71698da37ce70c457751baea507a122851a2d481 Author: Samuel Iglesias Gonsálvez Date: Tue May 30 10:35:46 2023 +0200 MAINTAINERS: Vaibhav Gupta is the new ipack maintainer I have no longer access to the HW, nor time to properly maintain it. Adding Vaibhav as maintainer as he currently has access to the HW, he is working at CERN (user of these drivers) and he is maintaining them internally there. Signed-off-by: Samuel Iglesias Gonsálvez Acked-by: Vaibhav Gupta Link: https://lore.kernel.org/r/20230530083546.4831-1-vaibhavgupta40@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9da6225bc7377941acff4476493d515b9fdfea48 Author: Ivan Bornyakov Date: Tue May 30 21:49:36 2023 +0800 dt-bindings: fpga: replace Ivan Bornyakov maintainership As I'm leaving Metrotek, hand over Lattice Slave SPI sysCONFIG FPGA manager and Microchip Polarfire FPGA manager maintainership duties to Vladimir. Signed-off-by: Ivan Bornyakov Acked-by: Conor Dooley Acked-by: Vladimir Georgiev Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230429104838.5064-3-i.bornyakov@metrotek.ru Signed-off-by: Xu Yilun Link: https://lore.kernel.org/r/20230530134936.634370-3-yilun.xu@intel.com Signed-off-by: Greg Kroah-Hartman commit 929f4e7c06ca40c8e58b418c94708d880518d9b4 Author: Ivan Bornyakov Date: Tue May 30 21:49:35 2023 +0800 MAINTAINERS: update Microchip MPF FPGA reviewers As I'm leaving Metrotek, hand over reviewing duty of Microchip MPF FPGA driver to Vladimir. Signed-off-by: Ivan Bornyakov Acked-by: Conor Dooley Acked-by: Vladimir Georgiev Acked-by: Xu Yilun Link: https://lore.kernel.org/r/20230429104838.5064-2-i.bornyakov@metrotek.ru Signed-off-by: Xu Yilun Link: https://lore.kernel.org/r/20230530134936.634370-2-yilun.xu@intel.com Signed-off-by: Greg Kroah-Hartman commit 111d467485e647843d0ac9862cb290a8445c7167 Merge: 020c69c1a793e 71c6aa0305e3d Author: Paolo Abeni Date: Tue May 30 11:26:33 2023 +0200 Merge branch 'two-fixes-for-smcrv2' Wen Gu says: ==================== Two fixes for SMCRv2 This patch set includes two bugfix for SMCRv2. ==================== Link: https://lore.kernel.org/r/1685101741-74826-1-git-send-email-guwen@linux.alibaba.com Signed-off-by: Paolo Abeni commit 71c6aa0305e3d2365d3bfd0134b4025d9e7ba388 Author: Wen Gu Date: Fri May 26 19:49:01 2023 +0800 net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK We encountered a crash when using SMCRv2. It is caused by a logical error in smc_llc_fill_ext_v2(). BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 453 Comm: kworker/7:4 Kdump: loaded Tainted: G W E 6.4.0-rc3+ #44 Workqueue: events smc_llc_add_link_work [smc] RIP: 0010:smc_llc_fill_ext_v2+0x117/0x280 [smc] RSP: 0018:ffffacb5c064bd88 EFLAGS: 00010282 RAX: ffff9a6bc1c3c02c RBX: ffff9a6be3558000 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000000a RBP: ffffacb5c064bdb8 R08: 0000000000000040 R09: 000000000000000c R10: ffff9a6bc0910300 R11: 0000000000000002 R12: 0000000000000000 R13: 0000000000000002 R14: ffff9a6bc1c3c02c R15: ffff9a6be3558250 FS: 0000000000000000(0000) GS:ffff9a6eefdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 000000010b078003 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: smc_llc_send_add_link+0x1ae/0x2f0 [smc] smc_llc_srv_add_link+0x2c9/0x5a0 [smc] ? cc_mkenc+0x40/0x60 smc_llc_add_link_work+0xb8/0x140 [smc] process_one_work+0x1e5/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 When an alernate RNIC is available in system, SMC will try to add a new link based on the RNIC for resilience. All the RMBs in use will be mapped to the new link. Then the RMBs' MRs corresponding to the new link will be filled into SMCRv2 LLC ADD LINK messages. However, smc_llc_fill_ext_v2() mistakenly accesses to unused RMBs which haven't been mapped to the new link and have no valid MRs, thus causing a crash. So this patch fixes the logic. Fixes: b4ba4652b3f8 ("net/smc: extend LLC layer for SMC-Rv2") Signed-off-by: Wen Gu Signed-off-by: Paolo Abeni commit b24aa141c2ff26c919237aee61ea1818fc6780d9 Author: Wen Gu Date: Fri May 26 19:49:00 2023 +0800 net/smc: Scan from current RMB list when no position specified When finding the first RMB of link group, it should start from the current RMB list whose index is 0. So fix it. Fixes: b4ba4652b3f8 ("net/smc: extend LLC layer for SMC-Rv2") Signed-off-by: Wen Gu Signed-off-by: Paolo Abeni commit 061c228967f0e3f7aecdd32ee370ee745d96168d Author: Maximilian Luz Date: Thu May 25 23:32:18 2023 +0200 platform/surface: aggregator_tabletsw: Add support for book mode in POS subsystem Devices with a type-cover have an additional "book" mode, deactivating type-cover input and turning off its backlight. This is currently unsupported, leading to the warning surface_aggregator_tablet_mode_switch 01:26:01:00:01: unknown device posture for type-cover: 6 Therefore, add support for this state and map it to enable tablet-mode. Fixes: 37ff64cd81ff ("platform/surface: aggregator_tabletsw: Add support for Type-Cover posture source") Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20230525213218.2797480-3-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 9bed667033e66083d363a11e9414ad401ecc242c Author: Maximilian Luz Date: Thu May 25 23:32:17 2023 +0200 platform/surface: aggregator_tabletsw: Add support for book mode in KIP subsystem Devices with a type-cover have an additional "book" mode, deactivating type-cover input and turning off its backlight. This is currently unsupported, leading to the warning surface_aggregator_tablet_mode_switch 01:0e:01:00:01: unknown KIP cover state: 6 Therefore, add support for this state and map it to enable tablet-mode. Fixes: 9f794056db5b ("platform/surface: Add KIP/POS tablet-mode switch driver") Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20230525213218.2797480-2-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 539e0a7f9105d19c00629c3f4da00330488e8c60 Author: Maximilian Luz Date: Thu May 25 23:01:10 2023 +0200 platform/surface: aggregator: Allow completion work-items to be executed in parallel Currently, event completion work-items are restricted to be run strictly in non-parallel fashion by the respective workqueue. However, this has lead to some problems: In some instances, the event notifier function called inside this completion workqueue takes a non-negligible amount of time to execute. One such example is the battery event handling code (surface_battery.c), which can result in a full battery information refresh, involving further synchronous communication with the EC inside the event handler. This is made worse if the communication fails spuriously, generally incurring a multi-second timeout. Since the event completions are run strictly non-parallel, this blocks other events from being propagated to the respective subsystems. This becomes especially noticeable for keyboard and touchpad input, which also funnel their events through this system. Here, users have reported occasional multi-second "freezes". Note, however, that the event handling system was never intended to run purely sequentially. Instead, we have one work struct per EC/SAM subsystem, processing the event queue for that subsystem. These work structs were intended to run in parallel, allowing sequential processing of work items for each subsystem but parallel processing of work items across subsystems. The only restriction to this is the way the workqueue is created. Therefore, replace create_workqueue() with alloc_workqueue() and do not restrict the maximum number of parallel work items to be executed on that queue, resolving any cross-subsystem blockage. Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem") Link: https://github.com/linux-surface/linux-surface/issues/1026 Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20230525210110.2785470-1-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit ed08d937eaa4f18aa26e47fe6b937205a4745045 Author: Maximilian Luz Date: Thu May 25 22:50:41 2023 +0200 platform/surface: aggregator: Make to_ssam_device_driver() respect constness Make to_ssam_device_driver() a bit safer by replacing container_of() with container_of_const() to respect the constness of the passed in pointer, instead of silently discarding any const specifications. This change also makes it more similar to to_ssam_device(), which already uses container_of_const(). Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20230525205041.2774947-1-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit aafbb1eeabdc4e9241b400146f77369f041ec11b Author: Steven Rostedt (Google) Date: Mon May 29 04:40:02 2023 -0400 tracing/rv/rtla: Update MAINTAINERS file to point to proper mailing list The mailing list that goes to linux-trace-devel is for the tracing libraries, and the patchwork associated to the tracing libraries keys off of that mailing list. For anything that lives in the Linux kernel proper (including the tools directory) must go through linux-trace-kernel, as the patchwork to that list keys off of the Linux kernel proper. Update the MAINTAINERS file to reflect the proper mailing lists. Link: https://lore.kernel.org/linux-trace-kernel/20230529044002.0481452b@rorschach.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) Acked-by: Daniel Bristot de Oliveira commit 020c69c1a793ed29d28793808eddd75210c858dd Author: David Howells Date: Fri May 26 12:34:54 2023 +0100 rxrpc: Truncate UTS_RELEASE for rxrpc version UTS_RELEASE has a maximum length of 64 which can cause rxrpc_version to exceed the 65 byte message limit. Per the rx spec[1]: "If a server receives a packet with a type value of 13, and the client-initiated flag set, it should respond with a 65-byte payload containing a string that identifies the version of AFS software it is running." The current implementation causes a compile error when WERROR is turned on and/or UTS_RELEASE exceeds the length of 49 (making the version string more than 64 characters). Fix this by generating the string during module initialisation and limiting the UTS_RELEASE segment of the string does not exceed 49 chars. We need to make sure that the 64 bytes includes "linux-" at the front and " AF_RXRPC" at the back as this may be used in pattern matching. Fixes: 44ba06987c0b ("RxRPC: Handle VERSION Rx protocol packets") Reported-by: Kenny Ho Link: https://lore.kernel.org/r/20230523223944.691076-1-Kenny.Ho@amd.com/ Signed-off-by: David Howells Acked-by: Kenny Ho cc: Marc Dionne cc: Andrew Lunn cc: David Laight cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Link: https://web.mit.edu/kolya/afs/rx/rx-spec [1] Reviewed-by: Simon Horman Reviewed-by: Jeffrey Altman Link: https://lore.kernel.org/r/654974.1685100894@warthog.procyon.org.uk Signed-off-by: Paolo Abeni commit 811154e234db72f0a11557a84ba9640f8b3bc823 Author: Akihiko Odaki Date: Tue May 30 11:46:51 2023 +0900 KVM: arm64: Populate fault info for watchpoint When handling ESR_ELx_EC_WATCHPT_LOW, far_el2 member of struct kvm_vcpu_fault_info will be copied to far member of struct kvm_debug_exit_arch and exposed to the userspace. The userspace will see stale values from older faults if the fault info does not get populated. Fixes: 8fb2046180a0 ("KVM: arm64: Move early handlers to per-EC handlers") Suggested-by: Marc Zyngier Signed-off-by: Akihiko Odaki Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230530024651.10014-1-akihiko.odaki@daynix.com Cc: stable@vger.kernel.org commit 719dfd5925e186e09a2a6f23016936ac436f3d78 Author: Maninder Singh Date: Mon May 29 16:43:37 2023 +0530 powerpc/xmon: Use KSYM_NAME_LEN in array size kallsyms_lookup() which in turn calls kallsyms_lookup_buildid() writes to index "KSYM_NAME_LEN - 1". Thus the array passed as namebuf to kallsyms_lookup() should be KSYM_NAME_LEN in size. In xmon.c the array was defined to be "128" bytes directly, without using KSYM_NAME_LEN. Commit b8a94bfb3395 ("kallsyms: increase maximum kernel symbol length to 512") changed the value to 512, but missed updating the xmon code. Fixes: b8a94bfb3395 ("kallsyms: increase maximum kernel symbol length to 512") Cc: stable@vger.kernel.org # v6.1+ Co-developed-by: Onkarnath Signed-off-by: Onkarnath Signed-off-by: Maninder Singh [mpe: Tweak change log wording and fix commit reference] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230529111337.352990-2-maninder1.s@samsung.com commit 9d2ccf00bddc268045e3d65a8108d61ada0e4b4e Author: Gaurav Batra Date: Thu May 25 09:34:54 2023 -0500 powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall Currently in tce_freemulti_pSeriesLP() there is no limit on how many TCEs are passed to the H_STUFF_TCE hcall. This has not caused an issue until now, but newer firmware releases have started enforcing a limit of 512 TCEs per call. The limit is correct per the specification (PAPR v2.12 § 14.5.4.2.3). The code has been in it's current form since it was initially merged. Cc: stable@vger.kernel.org Signed-off-by: Gaurav Batra Reviewed-by: Brian King [mpe: Tweak change log wording & add PAPR reference] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230525143454.56878-1-gbatra@linux.vnet.ibm.com commit 81d358b118dc364bd147432db569d4d400a5a4f2 Author: Michael Ellerman Date: Thu May 25 12:43:21 2023 +1000 powerpc/crypto: Fix aes-gcm-p10 link errors The recently added P10 AES/GCM code added some files containing CRYPTOGAMS perl-asm code which are near duplicates of the p8 files found in drivers/crypto/vmx. In particular the newly added files produce functions with identical names to the existing code. When the kernel is built with CONFIG_CRYPTO_AES_GCM_P10=y and CONFIG_CRYPTO_DEV_VMX_ENCRYPT=y that leads to link errors, eg: ld: drivers/crypto/vmx/aesp8-ppc.o: in function `aes_p8_set_encrypt_key': (.text+0xa0): multiple definition of `aes_p8_set_encrypt_key'; arch/powerpc/crypto/aesp8-ppc.o:(.text+0xa0): first defined here ... ld: drivers/crypto/vmx/ghashp8-ppc.o: in function `gcm_ghash_p8': (.text+0x140): multiple definition of `gcm_ghash_p8'; arch/powerpc/crypto/ghashp8-ppc.o:(.text+0x2e4): first defined here Fix it for now by renaming the newly added files and functions to use "p10" instead of "p8" in the names. Fixes: 45a4672b9a6e ("crypto: p10-aes-gcm - Update Kconfig and Makefile") Tested-by: Vishal Chourasia Signed-off-by: Michael Ellerman Link: https://msgid.link/20230525150501.37081-1-mpe@ellerman.id.au commit 34dfde4ad87b84d21278a7e19d92b5b2c68e6c4d Author: Cambda Zhu Date: Sat May 27 12:03:17 2023 +0800 tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set This patch replaces the tp->mss_cache check in getting TCP_MAXSEG with tp->rx_opt.user_mss check for CLOSE/LISTEN sock. Since tp->mss_cache is initialized with TCP_MSS_DEFAULT, checking if it's zero is probably a bug. With this change, getting TCP_MAXSEG before connecting will return default MSS normally, and return user_mss if user_mss is set. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Jack Yang Suggested-by: Eric Dumazet Link: https://lore.kernel.org/netdev/CANn89i+3kL9pYtkxkwxwNMzvC_w3LNUum_2=3u+UyLBmGmifHA@mail.gmail.com/#t Signed-off-by: Cambda Zhu Link: https://lore.kernel.org/netdev/14D45862-36EA-4076-974C-EA67513C92F6@linux.alibaba.com/ Reviewed-by: Jason Xing Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230527040317.68247-1-cambda@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 4faeee0cf8a5d88d63cdbc3bab124fb0e6aed08c Author: Eric Dumazet Date: Fri May 26 16:34:58 2023 +0000 tcp: deny tcp_disconnect() when threads are waiting Historically connect(AF_UNSPEC) has been abused by syzkaller and other fuzzers to trigger various bugs. A recent one triggers a divide-by-zero [1], and Paolo Abeni was able to diagnose the issue. tcp_recvmsg_locked() has tests about sk_state being not TCP_LISTEN and TCP REPAIR mode being not used. Then later if socket lock is released in sk_wait_data(), another thread can call connect(AF_UNSPEC), then make this socket a TCP listener. When recvmsg() is resumed, it can eventually call tcp_cleanup_rbuf() and attempt a divide by 0 in tcp_rcv_space_adjust() [1] This patch adds a new socket field, counting number of threads blocked in sk_wait_event() and inet_wait_for_connect(). If this counter is not zero, tcp_disconnect() returns an error. This patch adds code in blocking socket system calls, thus should not hurt performance of non blocking ones. Note that we probably could revert commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0") to restore original tcpi_rcv_mss meaning (was 0 if no payload was ever received on a socket) [1] divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 13832 Comm: syz-executor.5 Not tainted 6.3.0-rc4-syzkaller-00224-g00c7b5f4ddc5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 RIP: 0010:tcp_rcv_space_adjust+0x36e/0x9d0 net/ipv4/tcp_input.c:740 Code: 00 00 00 00 fc ff df 4c 89 64 24 48 8b 44 24 04 44 89 f9 41 81 c7 80 03 00 00 c1 e1 04 44 29 f0 48 63 c9 48 01 e9 48 0f af c1 <49> f7 f6 48 8d 04 41 48 89 44 24 40 48 8b 44 24 30 48 c1 e8 03 48 RSP: 0018:ffffc900033af660 EFLAGS: 00010206 RAX: 4a66b76cbade2c48 RBX: ffff888076640cc0 RCX: 00000000c334e4ac RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000001 RBP: 00000000c324e86c R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880766417f8 R13: ffff888028fbb980 R14: 0000000000000000 R15: 0000000000010344 FS: 00007f5bffbfe700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32f25000 CR3: 000000007ced0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcp_recvmsg_locked+0x100e/0x22e0 net/ipv4/tcp.c:2616 tcp_recvmsg+0x117/0x620 net/ipv4/tcp.c:2681 inet6_recvmsg+0x114/0x640 net/ipv6/af_inet6.c:670 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg+0xe2/0x160 net/socket.c:1038 ____sys_recvmsg+0x210/0x5a0 net/socket.c:2720 ___sys_recvmsg+0xf2/0x180 net/socket.c:2762 do_recvmmsg+0x25e/0x6e0 net/socket.c:2856 __sys_recvmmsg net/socket.c:2935 [inline] __do_sys_recvmmsg net/socket.c:2958 [inline] __se_sys_recvmmsg net/socket.c:2951 [inline] __x64_sys_recvmmsg+0x20f/0x260 net/socket.c:2951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f5c0108c0f9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5bffbfe168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007f5c011ac050 RCX: 00007f5c0108c0f9 RDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000003 RBP: 00007f5c010e7b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5c012cfb1f R14: 00007f5bffbfe300 R15: 0000000000022000 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Reported-by: Paolo Abeni Diagnosed-by: Paolo Abeni Signed-off-by: Eric Dumazet Tested-by: Paolo Abeni Link: https://lore.kernel.org/r/20230526163458.2880232-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6ffc57ea004234d9373c57b204fd10370a69f392 Author: Eric Dumazet Date: Fri May 26 15:43:42 2023 +0000 af_packet: do not use READ_ONCE() in packet_bind() A recent patch added READ_ONCE() in packet_bind() and packet_bind_spkt() This is better handled by reading pkt_sk(sk)->num later in packet_do_bind() while appropriate lock is held. READ_ONCE() in writers are often an evidence of something being wrong. Fixes: 822b5a1c17df ("af_packet: Fix data-races of pkt_sk(sk)->num.") Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: Jiri Pirko Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230526154342.2533026-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0684f29a89e58944a9bfae3a8b5c1a217e44c960 Author: Jakub Kicinski Date: Fri May 26 15:06:53 2023 -0700 netlink: specs: correct types of legacy arrays ethtool has some attrs which dump multiple scalars into an attribute. The spec currently expects one attr per entry. Fixes: a353318ebf24 ("tools: ynl: populate most of the ethtool spec") Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20230526220653.65538-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 36936a56e1814f6c526fe71fbf980beab4f5577a Author: Sebastian Krzyszkowiak Date: Fri May 26 16:38:11 2023 +0200 net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 BM818 is based on Qualcomm MDM9607 chipset. Fixes: 9a07406b00cd ("net: usb: qmi_wwan: Add the BroadMobi BM818 card") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Krzyszkowiak Acked-by: Bjørn Mork Link: https://lore.kernel.org/r/20230526-bm818-dtr-v1-1-64bbfa6ba8af@puri.sm Signed-off-by: Jakub Kicinski commit 7f875850f20a42f488840c9df7af91ef7db2d576 Author: Damien Le Moal Date: Mon May 22 20:09:57 2023 +0900 ata: libata-scsi: Use correct device no in ata_find_dev() For devices not attached to a port multiplier and managed directly by libata, the device number passed to ata_find_dev() must always be lower than the maximum number of devices returned by ata_link_max_devices(). That is 1 for SATA devices or 2 for an IDE link with master+slave devices. This device number is the SCSI device ID which matches these constraints as the IDs are generated per port and so never exceed the maximum number of devices for the link being used. However, for libsas managed devices, SCSI device IDs are assigned per struct scsi_host, leading to device IDs for SATA devices that can be well in excess of libata per-link maximum number of devices. This results in ata_find_dev() to always return NULL for libsas managed devices except for the first device of the target scsi_host with ID (device number) equal to 0. This issue is visible by executing the hdparm utility, which fails. E.g.: hdparm -i /dev/sdX /dev/sdX: HDIO_GET_IDENTITY failed: No message of desired type Fix this by rewriting ata_find_dev() to ignore the device number for non-PMP attached devices with a link with at most 1 device, that is SATA devices. For these, the device number 0 is always used to return the correct pointer to the struct ata_device of the port link. This change excludes IDE master/slave setups (maximum number of devices per link is 2) and port-multiplier attached devices. Also, to be consistant with the fact that SCSI device IDs and channel numbers used as device numbers are both unsigned int, change the devno argument of ata_find_dev() to unsigned int. Reported-by: Xingui Yang Fixes: 41bda9c98035 ("libata-link: update hotplug to handle PMP links") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Jason Yan commit 5842d1d9c1b0d17e0c29eae65ae1f245f83682dd Author: Mustafa Ismail Date: Mon May 22 10:56:54 2023 -0500 RDMA/irdma: Fix Local Invalidate fencing If the local invalidate fence is indicated in the WR, only the read fence is currently being set in WQE. Fix this to set both the read and local fence in the WQE. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://lore.kernel.org/r/20230522155654.1309-4-shiraz.saleem@intel.com Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit c8f304d75f6c6cc679a73f89591f9a915da38f09 Author: Mustafa Ismail Date: Mon May 22 10:56:53 2023 -0500 RDMA/irdma: Prevent QP use after free There is a window where the poll cq may use a QP that has been freed. This can happen if a CQE is polled before irdma_clean_cqes() can clear the CQE's related to the QP and the destroy QP races to free the QP memory. then the QP structures are used in irdma_poll_cq. Fix this by moving the clearing of CQE's before the reference is removed and the QP is destroyed. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://lore.kernel.org/r/20230522155654.1309-3-shiraz.saleem@intel.com Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit ffe14de983252862c91ad23bd5ca72fd9398d0e6 Author: Michael Margolin Date: Thu May 25 09:44:44 2023 +0000 MAINTAINERS: Update maintainer of Amazon EFA driver Change EFA driver maintainer from Gal Pressman to myself. Keep Gal as a reviewer at his request. Link: https://lore.kernel.org/r/20230525094444.12570-1-mrgolin@amazon.com Signed-off-by: Michael Margolin Acked-by: Gal Pressman Signed-off-by: Jason Gunthorpe commit 44d0fb387b53e56c8a050bac5c7d460e21eb226f Author: Ruihan Li Date: Mon May 15 21:09:58 2023 +0800 mm: page_table_check: Ensure user pages are not slab pages The current uses of PageAnon in page table check functions can lead to type confusion bugs between struct page and slab [1], if slab pages are accidentally mapped into the user space. This is because slab reuses the bits in struct page to store its internal states, which renders PageAnon ineffective on slab pages. Since slab pages are not expected to be mapped into the user space, this patch adds BUG_ON(PageSlab(page)) checks to make sure that slab pages are not inadvertently mapped. Otherwise, there must be some bugs in the kernel. Reported-by: syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@google.com/ [1] Fixes: df4e817b7108 ("mm: page table check") Cc: # 5.17 Signed-off-by: Ruihan Li Acked-by: Pasha Tatashin Link: https://lore.kernel.org/r/20230515130958.32471-5-lrh2000@pku.edu.cn Signed-off-by: Greg Kroah-Hartman commit 81a31a860bb61d54eb688af2568d9332ed9b8942 Author: Ruihan Li Date: Mon May 15 21:09:57 2023 +0800 mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM Without EXCLUSIVE_SYSTEM_RAM, users are allowed to map arbitrary physical memory regions into the userspace via /dev/mem. At the same time, pages may change their properties (e.g., from anonymous pages to named pages) while they are still being mapped in the userspace, leading to "corruption" detected by the page table check. To avoid these false positives, this patch makes PAGE_TABLE_CHECK depends on EXCLUSIVE_SYSTEM_RAM. This dependency is understandable because PAGE_TABLE_CHECK is a hardening technique but /dev/mem without STRICT_DEVMEM (i.e., !EXCLUSIVE_SYSTEM_RAM) is itself a security problem. Even with EXCLUSIVE_SYSTEM_RAM, I/O pages may be still allowed to be mapped via /dev/mem. However, these pages are always considered as named pages, so they won't break the logic used in the page table check. Cc: # 5.17 Signed-off-by: Ruihan Li Acked-by: David Hildenbrand Acked-by: Pasha Tatashin Link: https://lore.kernel.org/r/20230515130958.32471-4-lrh2000@pku.edu.cn Signed-off-by: Greg Kroah-Hartman commit d0b861653f8c16839c3035875b556afc4472f941 Author: Ruihan Li Date: Mon May 15 21:09:56 2023 +0800 usb: usbfs: Use consistent mmap functions When hcd->localmem_pool is non-null, localmem_pool is used to allocate DMA memory. In this case, the dma address will be properly returned (in dma_handle), and dma_mmap_coherent should be used to map this memory into the user space. However, the current implementation uses pfn_remap_range, which is supposed to map normal pages. Instead of repeating the logic in the memory allocation function, this patch introduces a more robust solution. Here, the type of allocated memory is checked by testing whether dma_handle is properly set. If dma_handle is properly returned, it means some DMA pages are allocated and dma_mmap_coherent should be used to map them. Otherwise, normal pages are allocated and pfn_remap_range should be called. This ensures that the correct mmap functions are used consistently, independently with logic details that determine which type of memory gets allocated. Fixes: a0e710a7def4 ("USB: usbfs: fix mmap dma mismatch") Cc: stable@vger.kernel.org Signed-off-by: Ruihan Li Link: https://lore.kernel.org/r/20230515130958.32471-3-lrh2000@pku.edu.cn Signed-off-by: Greg Kroah-Hartman commit 0143d148d1e882fb1538dc9974c94d63961719b9 Author: Ruihan Li Date: Mon May 15 21:09:55 2023 +0800 usb: usbfs: Enforce page requirements for mmap The current implementation of usbdev_mmap uses usb_alloc_coherent to allocate memory pages that will later be mapped into the user space. Meanwhile, usb_alloc_coherent employs three different methods to allocate memory, as outlined below: * If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to allocate memory; * If DMA is not available, it uses kmalloc to allocate memory; * Otherwise, it uses dma_alloc_coherent. However, it should be noted that gen_pool_dma_alloc does not guarantee that the resulting memory will be page-aligned. Furthermore, trying to map slab pages (i.e., memory allocated by kmalloc) into the user space is not resonable and can lead to problems, such as a type confusion bug when PAGE_TABLE_CHECK=y [1]. To address these issues, this patch introduces hcd_alloc_coherent_pages, which addresses the above two problems. Specifically, hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling __get_free_pages. Reported-by: syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.comm Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@google.com/ [1] Fixes: f7d34b445abc ("USB: Add support for usbfs zerocopy.") Fixes: ff2437befd8f ("usb: host: Fix excessive alignment restriction for local memory allocations") Cc: stable@vger.kernel.org Signed-off-by: Ruihan Li Acked-by: Alan Stern Link: https://lore.kernel.org/r/20230515130958.32471-2-lrh2000@pku.edu.cn Signed-off-by: Greg Kroah-Hartman commit 7b32040f6d7f885ffc09a6df7c17992d56d2eab8 Author: Marek Vasut Date: Mon May 15 19:24:56 2023 +0200 dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type The "snps,hsphy_interface" is string, not u8. Fix the type. Fixes: 389d77658801 ("dt-bindings: usb: Convert DWC USB3 bindings to DT schema") Cc: stable Reviewed-by: Krzysztof Kozlowski Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20230515172456.179049-1-marex@denx.de Signed-off-by: Greg Kroah-Hartman commit 47fe1c3064c6bc1bfa3c032ff78e603e5dd6e5bc Author: Damien Le Moal Date: Mon May 29 16:32:37 2023 +0900 block: fix revalidate performance regression The scsi driver function sd_read_block_characteristics() always calls disk_set_zoned() to a disk zoned model correctly, in case the device model changed. This is done even for regular disks to set the zoned model to BLK_ZONED_NONE and free any zone related resources if the drive previously was zoned. This behavior significantly impact the time it takes to revalidate disks on a large system as the call to disk_clear_zone_settings() done from disk_set_zoned() for the BLK_ZONED_NONE case results in the device request queued to be frozen, even if there are no zone resources to free. Avoid this overhead for non-zoned devices by not calling disk_clear_zone_settings() in disk_set_zoned() if the device model was already set to BLK_ZONED_NONE, which is always the case for regular devices. Reported by: Brian Bunker Fixes: 508aebb80527 ("block: introduce blk_queue_clear_zone_settings()") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20230529073237.1339862-1-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 016da9c65fec9f0e78c4909ed9a0f2d567af6775 Author: Dan Carpenter Date: Thu May 25 18:38:37 2023 +0300 usb: gadget: udc: fix NULL dereference in remove() The "udc" pointer was never set in the probe() function so it will lead to a NULL dereference in udc_pci_remove() when we do: usb_del_gadget_udc(&udc->gadget); Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/ZG+A/dNpFWAlCChk@kili Signed-off-by: Greg Kroah-Hartman commit efb6b535207395a5c7317993602e2503ca8cb4b3 Author: Uttkarsh Aggarwal Date: Thu May 25 14:58:54 2023 +0530 usb: gadget: f_fs: Add unbind event before functionfs_unbind While exercising the unbind path, with the current implementation the functionfs_unbind would be calling which waits for the ffs->mutex to be available, however within the same time ffs_ep0_read is invoked & if no setup packets are pending, it will invoke function wait_event_interruptible_exclusive_locked_irq which by definition waits for the ev.count to be increased inside the same mutex for which functionfs_unbind is waiting. This creates deadlock situation because the functionfs_unbind won't get the lock until ev.count is increased which can only happen if the caller ffs_func_unbind can proceed further. Following is the illustration: CPU1 CPU2 ffs_func_unbind() ffs_ep0_read() mutex_lock(ffs->mutex) wait_event(ffs->ev.count) functionfs_unbind() mutex_lock(ffs->mutex) mutex_unlock(ffs->mutex) ffs_event_add() Fix this by moving the event unbind before functionfs_unbind to ensure the ev.count is incrased properly. Fixes: 6a19da111057 ("usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait") Cc: stable Signed-off-by: Uttkarsh Aggarwal Link: https://lore.kernel.org/r/20230525092854.7992-1-quic_uaggarwa@quicinc.com Signed-off-by: Greg Kroah-Hartman commit dbe678f6192f27879ac9ff6bc7a1036aad85aae9 Author: Frank Li Date: Thu May 18 11:49:45 2023 -0400 usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM At iMX8QM platform, enable NCM gadget and run 'iperf3 -s'. At host, run 'iperf3 -V -c fe80::6863:98ff:feef:3e0%enxc6e147509498' [ 5] 0.00-1.00 sec 1.55 MBytes 13.0 Mbits/sec 90 4.18 KBytes [ 5] 1.00-2.00 sec 1.44 MBytes 12.0 Mbits/sec 75 4.18 KBytes [ 5] 2.00-3.00 sec 1.48 MBytes 12.4 Mbits/sec 75 4.18 KBytes Expected speed should be bigger than 300Mbits/sec. The root cause of this performance drop was found to be data corruption happening at 4K borders in some Ethernet packets, leading to TCP checksum errors. This corruption occurs from the position (4K - (address & 0x7F)) to 4K. The u_ether function's allocation of skb_buff reserves 64B, meaning all RX addresses resemble 0xXXXX0040. Force trb_burst_size to 16 can fix this problem. Cc: stable@vger.kernel.org Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20230518154946.3666662-1-Frank.Li@nxp.com Signed-off-by: Greg Kroah-Hartman commit 46248400d81e2aa0b65cd659d6f40188192a58b6 Author: Richard Acayan Date: Tue May 23 16:25:50 2023 +0100 misc: fastrpc: reject new invocations during device removal The channel's rpmsg object allows new invocations to be made. After old invocations are already interrupted, the driver shouldn't try to invoke anymore. Invalidating the rpmsg at the end of the driver removal function makes it easy to cause a race condition in userspace. Even closing a file descriptor before the driver finishes its cleanup can cause an invocation via fastrpc_release_current_dsp_process() and subsequent timeout. Invalidate the channel before the invocations are interrupted to make sure that no invocations can be created to hang after the device closes. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: stable Signed-off-by: Richard Acayan Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230523152550.438363-5-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit b6a062853ddf6b4f653af2d8b75ba45bb9a036ad Author: Richard Acayan Date: Tue May 23 16:25:49 2023 +0100 misc: fastrpc: return -EPIPE to invocations on device removal The return value is initialized as -1, or -EPERM. The completion of an invocation implies that the return value is set appropriately, but "Permission denied" does not accurately describe the outcome of the invocation. Set the invocation's return value to a more appropriate "Broken pipe", as the cleanup breaks the driver's connection with rpmsg. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: stable Signed-off-by: Richard Acayan Reviewed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230523152550.438363-4-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 3c7d0079a1831118ef232bd9c2f34d058a1f31c2 Author: Ekansh Gupta Date: Tue May 23 16:25:48 2023 +0100 misc: fastrpc: Reassign memory ownership only for remote heap The userspace map request for remote heap allocates CMA memory. The ownership of this memory needs to be reassigned to proper owners to allow access from the protection domain running on DSP. This reassigning of ownership is not correct if done for any other supported flags. When any other flag is requested from userspace, fastrpc is trying to reassign the ownership of memory and this reassignment is getting skipped for remote heap request which is incorrect. Add proper flag check to reassign the memory only if remote heap is requested. Fixes: 532ad70c6d44 ("misc: fastrpc: Add mmap request assigning for static PD pool") Cc: stable Tested-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Reviewed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230523152550.438363-3-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit a6e766dea0a22918735176e4af862d535962f11e Author: Ekansh Gupta Date: Tue May 23 16:25:47 2023 +0100 misc: fastrpc: Pass proper scm arguments for secure map request If a map request is made with securemap attribute, the memory ownership needs to be reassigned to new VMID to allow access from protection domain. Currently only DSP VMID is passed to the reassign call which is incorrect as only a combination of HLOS and DSP VMID is allowed for memory ownership reassignment and passing only DSP VMID will cause assign call failure. Also pass proper restoring permissions to HLOS as the source permission will now carry both HLOS and DSP VMID permission. Change is also made to get valid physical address from scatter/gather for this allocation request. Fixes: e90d91190619 ("misc: fastrpc: Add support to secure memory map") Cc: stable Tested-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230523152550.438363-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit ed309ce522185583b163bd0c74f0d9f299fe1826 Author: Conor Dooley Date: Fri May 26 11:59:08 2023 +0100 RISC-V: mark hibernation as nonportable Hibernation support depends on firmware marking its reserved/PMP protected regions as not accessible from Linux. The latest versions of the de-facto SBI implementation (OpenSBI) do not do this, having dropped the no-map property to enable 1 GiB huge page mappings by the kernel. This was exposed by commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping"), which made the first 2 MiB of DRAM (where SBI typically resides) accessible by the kernel. Attempting to hibernate with either OpenSBI, or other implementations following its lead, will lead to a kernel panic ([1], [2]) as the hibernation process will attempt to save/restore any mapped regions, including the PMP protected regions in use by the SBI implementation. Mark hibernation as depending on "NONPORTABLE", as only a small subset of systems are capable of supporting it, until such time that an SBI implementation independent way to communicate what regions are in use has been agreed on. As hibernation support landed in v6.4-rc1, disabling it for most platforms does not constitute a regression. The alternative would have been reverting commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping"). Doing so would permit hibernation on platforms with these SBI implementations, but would limit the options we have to solve the protection of the region without causing a regression in hibernation support. Reported-by: Song Shuai Link: https://lore.kernel.org/all/CAAYs2=gQvkhTeioMmqRDVGjdtNF_vhB+vm_1dHJxPNi75YDQ_Q@mail.gmail.com/ [1] Reported-by: JeeHeng Sia Link: https://groups.google.com/a/groups.riscv.org/g/sw-dev/c/ITXwaKfA6z8 [2] Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230526-astride-detonator-9ae120051159@wendy Signed-off-by: Palmer Dabbelt commit 8b817fded42d8fe3a0eb47b1149d907851a3c942 Merge: 7a6c8e512fa07 a2d910f02231f Author: Linus Torvalds Date: Mon May 29 07:20:13 2023 -0400 Merge tag 'trace-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: "User events: - Use long instead of int for storing the enable set/clear bit, as it was found that big endian machines could end up using the wrong bits. - Split allocating mm and attaching it. This keeps the allocation separate from the registration and avoids various races. - Remove RCU locking around pin_user_pages_remote() as that can schedule. The RCU protection is no longer needed with the above split of mm allocation and attaching. - Rename the "link" fields of the various structs to something more meaningful. - Add comments around user_event_mm struct usage and locking requirements. Timerlat tracer: - Fix missed wakeup of timerlat thread caused by the timerlat interrupt triggering when tracing is off. The timer interrupt handler needs to always wake up the timerlat thread regardless if tracing is enabled or not, otherwise, it will never wake up. Histograms: - Fix regression of breaking the "stacktrace" modifier for variables. That modifier cannot be used for values, but can be used for variables that are passed from one histogram to the next. This was broken when adding the restriction to values as the variable logic used the same code. - Rename the special field "stacktrace" to "common_stacktrace". Special fields (that are not actually part of the event, but can act just like event fields, like 'comm' and 'timestamp') should be prefixed with 'common_' for consistency. To keep backward compatibility, 'stacktrace' can still be used (as with the special field 'cpu'), but can be overridden if the event has a field called 'stacktrace'. - Update the synthetic event selftests to use the new name (synthetic events are created by histograms) Tracing bootup selftests: - Reorganize the code to keep artifacts of the selftests not compiled in when selftests are not configured. - Add various cond_resched() around the selftest code, as the softlock watchdog was triggering much more often. It appears that the kernel runs slower now with full debugging enabled. - While debugging ftrace with ftrace (using an instance ring buffer instead of the top level one), I found that the selftests were disabling prints to the debug instance. This should not happen, as the selftests only disable printing to the main buffer as the selftests examine the main buffer to see if it has what it expects, and prints can make the tests fail. Make the selftests only disable printing to the toplevel buffer, and leave the instance buffers alone" * tag 'trace-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Have function_graph selftest call cond_resched() tracing: Only make selftest conditionals affect the global_trace tracing: Make tracing_selftest_running/delete nops when not used tracing: Have tracer selftests call cond_resched() before running tracing: Move setting of tracing_selftest_running out of register_tracer() tracing/selftests: Update synthetic event selftest to use common_stacktrace tracing: Rename stacktrace field to common_stacktrace tracing/histograms: Allow variables to have some modifiers tracing/user_events: Document user_event_mm one-shot list usage tracing/user_events: Rename link fields for clarity tracing/user_events: Remove RCU lock while pinning pages tracing/user_events: Split up mm alloc and attach tracing/timerlat: Always wakeup the timerlat thread tracing/user_events: Use long vs int for atomic bit ops commit 7a6c8e512fa072cfe8ad7a3b26666b6f26435870 Merge: ac2263b588dff 6ab39f99927ee Author: Linus Torvalds Date: Mon May 29 07:05:49 2023 -0400 Merge tag 'v6.4-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix an alignment crash in x86/aria" * tag 'v6.4-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: x86/aria - Use 16 byte alignment for GFNI constant vectors commit ac2263b588dffd3a1efd7ed0b156ea6c5aea200d Author: Linus Torvalds Date: Mon May 29 06:40:33 2023 -0400 Revert "module: error out early on concurrent load of the same module file" This reverts commit 9828ed3f695a138f7add89fa2a186ababceb8006. Sadly, it does seem to cause failures to load modules. Johan Hovold reports: "This change breaks module loading during boot on the Lenovo Thinkpad X13s (aarch64). Specifically it results in indefinite probe deferral of the display and USB (ethernet) which makes it a pain to debug. Typing in the dark to acquire some logs reveals that other modules are missing as well" Since this was applied late as a "let's try this", I'm reverting it asap, and we can try to figure out what goes wrong later. The excessive parallel module loading problem is annoying, but not noticeable in normal situations, and this was only meant as an optimistic workaround for a user-space bug. One possible solution may be to do the optimistic exclusive open first, and then use a lock to serialize loading if that fails. Reported-by: Johan Hovold Link: https://lore.kernel.org/lkml/ZHRpH-JXAxA6DnzR@hovoldconsulting.com/ Signed-off-by: Linus Torvalds commit 3fe95742af29b8b4eccab2ba94bc521805c6e10c Author: Mika Westerberg Date: Wed May 24 13:47:04 2023 +0300 thunderbolt: Do not touch CL state configuration during discovery If the boot firmware has already established tunnels, especially ones that have special requirements from the link such as DisplayPort, we should not blindly enable CL states (nor change the TMU configuration). Otherwise the existing tunnels may not work as expected. For this reason, skip the CL state enabling when we go over the existing topology. This will also keep the TMU settings untouched because we do not change the TMU configuration when CL states are not enabled. Reported-by: Koba Ko Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7831 Cc: stable@vger.kernel.org # v6.0+ Acked-By: Yehezkel Bernat Signed-off-by: Mika Westerberg commit b6d572aeb58a5e0be86bd51ea514c4feba996cc4 Author: Mika Westerberg Date: Wed May 24 10:41:57 2023 +0300 thunderbolt: Increase DisplayPort Connection Manager handshake timeout It turns out that when plugging in VGA cable through USB-C to VGA/DVI dongle the Connection Manager handshake can take longer time, at least on Intel Titan Ridge based docks such as Dell WD91TB. This leads to following error in the dmesg: thunderbolt 0000:00:0d.3: 3:10: DP tunnel activation failed, aborting and the display stays blank (because we failed to establish the tunnel). For this reason increase the timeout to 3s. Reported-by: Koba Ko Cc: stable@vger.kernel.org Acked-By: Yehezkel Bernat Signed-off-by: Mika Westerberg commit a2d910f02231f33118647fc438157ae69c073f89 Author: Steven Rostedt (Google) Date: Sun May 28 01:17:42 2023 -0400 tracing: Have function_graph selftest call cond_resched() When all kernel debugging is enabled (lockdep, KSAN, etc), the function graph enabling and disabling can take several seconds to complete. The function_graph selftest enables and disables function graph tracing several times. With full debugging enabled, the soft lockup watchdog was triggering because the selftest was running without ever scheduling. Add cond_resched() throughout the test to make sure it does not trigger the soft lockup detector. Link: https://lkml.kernel.org/r/20230528051742.1325503-6-rostedt@goodmis.org Signed-off-by: Steven Rostedt (Google) commit ac9d2cb1d5f8e22235c399338504dadc87d14e74 Author: Steven Rostedt (Google) Date: Sun May 28 01:17:41 2023 -0400 tracing: Only make selftest conditionals affect the global_trace The tracing_selftest_running and tracing_selftest_disabled variables were to keep trace_printk() and other writes from affecting the tracing selftests, as the tracing selftests would examine the ring buffer to see if it contained what it expected or not. trace_printk() and friends could add to the ring buffer and cause the selftests to fail (and then disable the tracer that was being tested). To keep that from happening, these variables were added and would keep trace_printk() and friends from writing to the ring buffer while the tests were going on. But this was only the top level ring buffer (owned by the global_trace instance). There is no reason to prevent writing into ring buffers of other instances via the trace_array_printk() and friends. For the functions that could be used by other instances, check if the global_trace is the tracer instance that is being written to before deciding to not allow the write. Link: https://lkml.kernel.org/r/20230528051742.1325503-5-rostedt@goodmis.org Signed-off-by: Steven Rostedt (Google) commit a3ae76d7ff781208100e6acc58eb09afb7b4b177 Author: Steven Rostedt (Google) Date: Sun May 28 01:17:40 2023 -0400 tracing: Make tracing_selftest_running/delete nops when not used There's no reason to test the condition variables tracing_selftest_running or tracing_selftest_delete when tracing selftests are not enabled. Make them define 0s when not the selftests are not configured in. Link: https://lkml.kernel.org/r/20230528051742.1325503-4-rostedt@goodmis.org Signed-off-by: Steven Rostedt (Google) commit 9da705d432a07927526005a0688d81fbbf30e349 Author: Steven Rostedt (Google) Date: Sun May 28 01:17:39 2023 -0400 tracing: Have tracer selftests call cond_resched() before running As there are more and more internal selftests being added to the Linux kernel (KSAN, lockdep, etc) the selftests are taking longer to run when these are enabled. Add a cond_resched() to the calling of do_run_tracer_selftest() to force a schedule if NEED_RESCHED is set, otherwise the soft lockup watchdog may trigger on boot up. Link: https://lkml.kernel.org/r/20230528051742.1325503-3-rostedt@goodmis.org Signed-off-by: Steven Rostedt (Google) commit e8352cf5778c53b80fdcee086278b2048ddb8f98 Author: Steven Rostedt (Google) Date: Sun May 28 01:17:38 2023 -0400 tracing: Move setting of tracing_selftest_running out of register_tracer() The variables tracing_selftest_running and tracing_selftest_disabled are only used for when CONFIG_FTRACE_STARTUP_TEST is enabled. Make them only visible within the selftest code. The setting of those variables are in the register_tracer() call, and set in a location where they do not need to be. Create a wrapper around run_tracer_selftest() called do_run_tracer_selftest() which sets those variables, and have register_tracer() call that instead. Having those variables only set within the CONFIG_FTRACE_STARTUP_TEST scope gets rid of them (and also the ability to remove testing against them) when the startup tests are not enabled (most cases). Link: https://lkml.kernel.org/r/20230528051742.1325503-2-rostedt@goodmis.org Signed-off-by: Steven Rostedt (Google) commit e338142b39cf40155054f95daa28d210d2ee1b2d Merge: dca389eb958f9 2a881183dc5ab Author: Linus Torvalds Date: Sun May 28 20:05:07 2023 -0400 Merge tag 'phy-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - init count imbalance fix in qcom-qmp-pcie and combo drivers - kernel doc header fix for qcom-snps driver - mediatek floating point comparison fix - amlogic fix register value * tag 'phy-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value phy: mediatek: rework the floating point comparisons to fixed point phy: qcom-qmp-pcie-msm8996: fix init-count imbalance phy: qcom-qmp-combo: fix init-count imbalance commit dca389eb958f982406df8199af40fefe1b881b84 Merge: 7877cb91f1081 e14fd2af7a1d6 Author: Linus Torvalds Date: Sun May 28 19:59:08 2023 -0400 Merge tag 'dmaengine-fix-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: "Driver fixes for the at-hdmac, pl330, TI and IDXD drivers: - AT HDMAC driver fixes for Flow Controller bitfield, peripheral ID handling and potential NULL dereference check - PL330 function rename to avoid conflicts - build warning fix for pm function in TI driver - IDXD driver fix for passing freed memory" * tag 'dmaengine-fix-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: at_hdmac: Extend the Flow Controller bitfield to three bits dmaengine: at_hdmac: Repair bitfield macros for peripheral ID handling dmaengine: pl330: rename _start to prevent build error dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() dmaengine: ti: k3-udma: annotate pm function with __maybe_unused dmaengine: idxd: Fix passing freed memory in idxd_cdev_open() commit bca7a46336e38667f7670aacd2098dc45b8b7868 Merge: 7877cb91f1081 bbaae0c79ebd4 Author: Greg Kroah-Hartman Date: Sun May 28 20:03:33 2023 +0100 Merge tag 'iio-fixes-for-6.4a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: 1st set of IIO fixes for the 6.4 cycle. Usual mixed bag of issues in new code for this cycle and old issues that have surfaced in the last few weeks. - adi,ad_sigma_delta * Ensure irq lazy disable handing is not used as it breaks completion detection. - adi,ad4130 * Fix failure to remove clock provider. - adi,ad5758 * Wrong CONFIG variable used to control driver build. - adi,ad7192 * Fix repeated channel index by just expressing shorted channels as differential channel between a channel and itself. - adi,ad74413 * Fix error handling for resistance input processing to not fail in case of success. - rohm,bu27034 * Fix integration time in wrong units (should be seconds not usecs) * Ensure reset is actually written not detected as already set from regcache. - gts helper * Fix wrong parameter docs. * Fix integration time in wrong units (should be seconds not usecs) - fsl,imx8qxp-adc * Add missing vref-supply to binding doc (already used by driver) - fsl,imx93 * Fix sign bug in read_raw() so that error check didn't work. - inv,icm42600 * Fix reset of timestamp to work even if a particular sensor is off when the chip is first enabled. - kionix,kx022a * Fix irq get form fw node to not include the 0 value. - microchip,mcp4725 * Fix return value from i2c_master_send() handling to nto assume 0 on success. - mediatek,mt6370 * Fix incorrect scaling of a few currents on devices with particular vendor IDs. - fsl,mxs-lradc * Cleanup ordering issue fix. - renesas,rcar-adc bindings * Fix missing vendor prefix for adi,ad7476 - st,st_accel * Fix handling when no ACPI _ONT method present. - st,stm32-adc * Handle no adc-diff-channel present case (all single ended) * Handle no adc-channels present case (all differential) - ti,palmas * Fix off by one bug that could allow out of bounds read if callers provided wrong value. - ti,tmag5273 * Fix a runtime PM leak on measurement error - vishay,vcnl4035 * Correctly mask chip ID so devices with different addresses don't fail the test. * tag 'iio-fixes-for-6.4a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (23 commits) iio: imu: inv_icm42600: fix timestamp reset iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value iio: dac: mcp4725: Fix i2c_master_send() return value handling iio: accel: kx022a fix irq getting iio: bu27034: Ensure reset is written iio: dac: build ad5758 driver when AD5758 is selected iio: addac: ad74413: fix resistance input processing iio: light: vcnl4035: fixed chip ID check dt-bindings: iio: imx8qxp-adc: add missing vref-supply iio: adc: stm32-adc: skip adc-channels setup if none is present iio: adc: stm32-adc: skip adc-diff-channels setup if none is present iio: adc: ad7192: Change "shorted" channels to differential iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method iio: gts-helpers: fix integration time units iio: bu27034: Fix integration time iio: fix doc for iio_gts_find_sel_by_int_time iio: adc: palmas: fix off by one bugs iio: adc: mxs-lradc: fix the order of two cleanup operations iio: ad4130: Make sure clock provider gets removed ... commit 36e4fc57fc1619f462e669e939209c45763bc8f5 Author: Akihiro Suda Date: Sun May 28 19:36:02 2023 +0200 efi: Bump stub image version for macOS HVF compatibility The macOS hypervisor framework includes a host-side VMM called VZLinuxBootLoader [1] which implements native support for booting the Linux kernel inside a guest directly (instead of, e.g., via GRUB installed inside the guest). On x86, it incorporates a BIOS style loader that does not implement or expose EFI to the loaded kernel. However, this loader appears to fail when the 'image minor version' field in the kernel image's PE/COFF header (which is generally only used by EFI based bootloaders) is set to any value other than 0x0. [2] Commit e346bebbd36b1576 ("efi: libstub: Always enable initrd command line loader and bump version") incremented the EFI stub image minor version to convey that all EFI stub kernels now implement support for the initrd= command line option, and do so in a way where it can load initrd images from any filesystem known to the EFI firmware (as opposed to prior implementations that could only load initrds from the same volume that the kernel image was loaded from). Unfortunately, bumping the version to v1.1 triggers this issue in VZLinuxBootLoader, breaking the boot on x86. So let's keep the image minor version at 0x0, and bump the image major version instead. While at it, convert this field to a bit field, so that individual features are discoverable from it, as suggested by Linus. So let's bump the major version to v3, and document the initrd= command line loading feature as being represented by bit 1 in the mask. Note that, due to the prior interpretation as a monotonically increasing version field, loaders are still permitted to assume that the LoadFile2 initrd loading feature is supported for any major version value >= 1, even if bit 0 is not set. [1] https://developer.apple.com/documentation/virtualization/vzlinuxbootloader [2] https://lore.kernel.org/linux-efi/CAG8fp8Teu4G9JuenQrqGndFt2Gy+V4YgJ=hN1xX7AD940YKf3A@mail.gmail.com/ Fixes: e346bebbd36b1576 ("efi: libstub: Always enable initrd command ...") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217485 Signed-off-by: Akihiro Suda [ardb: rewrite comment and commit log] Signed-off-by: Ard Biesheuvel commit b3e6bcb94590dea45396b9481e47b809b1be4afa Author: Theodore Ts'o Date: Tue May 23 23:49:48 2023 -0400 ext4: add EA_INODE checking to ext4_iget() Add a new flag, EXT4_IGET_EA_INODE which indicates whether the inode is expected to have the EA_INODE flag or not. If the flag is not set/clear as expected, then fail the iget() operation and mark the file system as corrupted. This commit also makes the ext4_iget() always perform the is_bad_inode() check even when the inode is already inode cache. This allows us to remove the is_bad_inode() check from the callers of ext4_iget() in the ea_inode code. Reported-by: syzbot+cbb68193bdb95af4340a@syzkaller.appspotmail.com Reported-by: syzbot+62120febbd1ee3c3c860@syzkaller.appspotmail.com Reported-by: syzbot+edce54daffee36421b4c@syzkaller.appspotmail.com Cc: stable@kernel.org Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20230524034951.779531-2-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 7877cb91f1081754a1487c144d85dc0d2e2e7fc4 Author: Linus Torvalds Date: Sun May 28 07:49:00 2023 -0400 Linux 6.4-rc4 commit f8b2507c263d6c1478d179c7c260064a61f14542 Merge: 2d5438f4c6fda edc0a2b595765 Author: Linus Torvalds Date: Sun May 28 07:42:05 2023 -0400 Merge tag 'x86-urgent-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu fix from Thomas Gleixner: "A single fix for x86: - Prevent a bogus setting for the number of HT siblings, which is caused by the CPUID evaluation trainwreck of X86. That recomputes the value for each CPU, so the last CPU "wins". That can cause completely bogus sibling values" * tag 'x86-urgent-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms commit 2d5438f4c6fdaa34c5d7de89a5331b8dbcd920af Merge: abbf7fa15b7c1 38776cc45eb76 Author: Linus Torvalds Date: Sun May 28 07:37:23 2023 -0400 Merge tag 'perf-urgent-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "A small set of perf fixes: - Make the MSR-readout based CHA discovery work around broken discovery tables in some SPR firmwares. - Prevent saving PEBS configuration which has software bits set that cause a crash when restored into the relevant MSR" * tag 'perf-urgent-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/uncore: Correct the number of CHAs on SPR perf/x86/intel: Save/restore cpuc->active_pebs_data_cfg when using guest PEBS commit abbf7fa15b7c140da7893f9c910b4762ac99ae7a Merge: d8f14b84fefd8 2e4be0d011f21 Author: Linus Torvalds Date: Sun May 28 07:33:29 2023 -0400 Merge tag 'objtool-urgent-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull unwinder fixes from Thomas Gleixner: "A set of unwinder and tooling fixes: - Ensure that the stack pointer on x86 is aligned again so that the unwinder does not read past the end of the stack - Discard .note.gnu.property section which has a pointlessly different alignment than the other note sections. That confuses tooling of all sorts including readelf, libbpf and pahole" * tag 'objtool-urgent-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/show_trace_log_lvl: Ensure stack pointer is aligned, again vmlinux.lds.h: Discard .note.gnu.property section commit d8f14b84fefd8669cbcbe4fee3f61a44be904993 Merge: 9bd5386c653f6 eb799279fb1f9 Author: Linus Torvalds Date: Sun May 28 07:15:33 2023 -0400 Merge tag 'core-debugobjects-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects fixes from Thomas Gleixner: "Two fixes for debugobjects: - Prevent the allocation path from waking up kswapd. That's a long standing issue due to the GFP_ATOMIC allocation flag. As debug objects can be invoked from pretty much any context waking kswapd can end up in arbitrary lock chains versus the waitqueue lock - Correct the explicit lockdep wait-type violation in debug_object_fill_pool()" * tag 'core-debugobjects-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Don't wake up kswapd from fill_pool() debugobjects,locking: Annotate debug_object_fill_pool() wait type violation commit 9bd5386c653f64755dc33f77793273ef0763fe63 Merge: 045049cb38193 4115af49d2c24 Author: Linus Torvalds Date: Sun May 28 07:12:21 2023 -0400 Merge tag 'irq-urgent-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A set of fixes for interrupt chip drivers: - Prevent loss of state in the MIPS GIC interrupt controller - Disable pseudo NMIs on Mediatek based Chromebooks as they have firmware issues which cause instantenous chrashes and freezes wen pseudo NMIs are used - Fix the error handling path in the MBIGEN driver and a defined but not used warning in the meson-gpio interrupt chip driver" * tag 'irq-urgent-2023-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/mbigen: Unify the error handling in mbigen_of_create_domain() irqchip/meson-gpio: Mark OF related data as maybe unused irqchip/mips-gic: Use raw spinlock for gic_lock irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues dt-bindings: interrupt-controller: arm,gic-v3: Add quirk for Mediatek SoCs w/ broken FW commit 045049cb3819341fb83f807967a70c22fdddbd96 Merge: 416839029e385 4897a898a2160 Author: Linus Torvalds Date: Sun May 28 07:08:52 2023 -0400 Merge tag 'mips-fixes_6.4_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - fixes to get alchemy platform back in shape - fix for initrd detection * tag 'mips-fixes_6.4_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: Move initrd_start check after initrd address sanitisation. MIPS: Alchemy: fix dbdma2 MIPS: Restore Au1300 support MIPS: unhide PATA_PLATFORM commit 416839029e3858f61dc7dd346559c03e74ed8380 Merge: 4e893b5aa4ac2 358e526a1648c Author: Linus Torvalds Date: Sat May 27 18:09:18 2023 -0700 Merge tag 'powerpc-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - Reinstate ARCH_FORCE_MAX_ORDER ranges to fix various breakage * tag 'powerpc-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/mm: Reinstate ARCH_FORCE_MAX_ORDER ranges commit d78bd6cc68276bd57f766f7cb98bfe32c23ab327 Author: Helge Deller Date: Sat May 27 08:41:09 2023 +0200 fbcon: Fix null-ptr-deref in soft_cursor syzbot repored this bug in the softcursor code: BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12 CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Workqueue: events_power_efficient fb_flashcursor Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 print_report+0xe4/0x514 mm/kasan/report.c:465 kasan_report+0xd4/0x130 mm/kasan/report.c:572 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105 soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377 fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380 process_one_work+0x788/0x12d4 kernel/workqueue.c:2405 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552 kthread+0x288/0x310 kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853 This fix let bit_cursor() bail out early when a font bitmap isn't available yet. Signed-off-by: Helge Deller Reported-by: syzbot+d910bd780e6efac35869@syzkaller.appspotmail.com Acked-by: Sam Ravnborg Cc: stable@kernel.org commit 518ecb6a209f6ff678aeadf9f2bf870c0982ca85 Author: Helge Deller Date: Sat May 27 11:37:29 2023 +0200 fbdev: imsttfb: Fix error path of imsttfb_probe() Release ressources when init_imstt() returns failure. Signed-off-by: Helge Deller commit 5cf9a090a39c97f4506b7b53739d469b1c05a7e9 Author: Helge Deller Date: Sat May 27 11:28:36 2023 +0200 fbdev: imsttfb: Release framebuffer and dealloc cmap on error path Add missing cleanups in error path. Signed-off-by: Helge Deller commit 4e893b5aa4ac2c8a56a40d18fe87e9d2295e5dcf Merge: 957f3f8e53430 335b4223466dd Author: Linus Torvalds Date: Sat May 27 09:42:56 2023 -0700 Merge tag 'for-linus-6.4-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - a double free fix in the Xen pvcalls backend driver - a fix for a regression causing the MSI related sysfs entries to not being created in Xen PV guests - a fix in the Xen blkfront driver for handling insane input data better * tag 'for-linus-6.4-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/pci/xen: populate MSI sysfs entries xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() xen/blkfront: Only check REQ_FUA for writes commit 957f3f8e5343041ddb9a1265ab661db259cc712e Merge: 49572d5361298 d1d8875c8c135 Author: Linus Torvalds Date: Sat May 27 09:14:43 2023 -0700 Merge tag 'char-misc-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are some small driver fixes for 6.4-rc4. They are just two different types: - binder fixes and reverts for reported problems and regressions in the binder "driver". - coresight driver fixes for reported problems. All of these have been in linux-next for over a week with no reported problems" * tag 'char-misc-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: binder: fix UAF of alloc->vma in race with munmap() binder: add lockless binder_alloc_(set|get)_vma() Revert "android: binder: stop saving a pointer to the VMA" Revert "binder_alloc: add missing mmap_lock calls when using the VMA" binder: fix UAF caused by faulty buffer cleanup coresight: perf: Release Coresight path when alloc trace id failed coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() commit ca50d7765587fe0a8351a6e8d9742cfd4811d925 Author: Shenwei Wang Date: Fri May 26 10:38:54 2023 -0500 arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts Add the assigned-clocks and assigned-clock-rates properties for the LPUARTx nodes. Without these properties, the default clock rate used would be 0, which can cause the UART ports to fail when open. Fixes: 35f4e9d7530f ("arm64: dts: imx8: split adma ss into dma and audio ss") Signed-off-by: Shenwei Wang Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 2b28fc688cdff225c41cdd22857500e187453ed7 Author: Shenwei Wang Date: Thu May 18 08:54:21 2023 -0500 arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals The USDHC2 CD and WP sginal should be on LSIO_GPIO5. Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support") Signed-off-by: Shenwei Wang Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 99e09b9c0ab43346c52f2787ca4e5c4b1798362e Author: Krzysztof Kozlowski Date: Wed May 17 18:37:36 2023 +0200 soundwire: qcom: add proper error paths in qcom_swrm_startup() Reverse actions in qcom_swrm_startup() error paths to avoid leaking stream memory and keeping runtime PM unbalanced. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230517163736.997553-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 700581ede41d029403feec935df4616309696fd7 Author: Pierre-Louis Bossart Date: Mon May 15 15:48:59 2023 +0800 soundwire: dmi-quirks: add new mapping for HP Spectre x360 A BIOS/DMI update seems to have broken some devices, let's add a new mapping. Link: https://github.com/thesofproject/linux/issues/4323 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Signed-off-by: Bard Liao Link: https://lore.kernel.org/r/20230515074859.3097-1-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit fdd7d1fff4e3b97c4706f4c0e000a38b134b7ae5 Author: Steve French Date: Sat May 27 03:33:23 2023 -0500 cifs: address unused variable warning Fix trivial unused variable warning (when SMB1 support disabled) "ioctl.c:324:17: warning: variable 'caps' set but not used [-Wunused-but-set-variable]" Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202305250056.oZhsJmdD-lkp@intel.com/ Signed-off-by: Steve French commit 30bc32c7c1f975cc3c14e1c7dc437266311282cf Author: Lorenzo Bianconi Date: Wed May 24 16:39:32 2023 +0200 wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll Grab sta_poll_lock spinlock in mt7615_mac_sta_poll routine in order to avoid possible races with mt7615_mac_add_txs() or mt7615_mac_fill_rx() removing msta pointer from sta_poll_list. Fixes: a621372a04ac ("mt76: mt7615: rework mt7615_mac_sta_poll for usb code") Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/48b23404b759de4f1db2ef85975c72a4aeb1097c.1684938695.git.lorenzo@kernel.org commit 780328abc0cbde7398d3c04be56fbb5f89ed10b8 Author: Uwe Kleine-König Date: Fri May 26 07:41:23 2023 +0200 fbdev: matroxfb ssd1307fb: Switch i2c drivers back to use .probe() After commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new() call-back type"), all drivers being converted to .probe_new() and then 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") convert back to (the new) .probe() to be able to eventually drop .probe_new() from struct i2c_driver. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit cbd77119b6355872cd308a60e99f9ca678435d15 Author: Manivannan Sadhasivam Date: Wed May 17 17:16:35 2023 +0530 EDAC/qcom: Get rid of hardcoded register offsets The LLCC EDAC register offsets varies between each SoC. Hardcoding the register offsets won't work and will often result in crash due to accessing the wrong locations. Hence, get the register offsets from the LLCC driver matching the individual SoCs. Cc: # 6.0: 5365cea199c7 ("soc: qcom: llcc: Rename reg_offset structs to reflect LLCC version") Cc: # 6.0: c13d7d261e36 ("soc: qcom: llcc: Pass LLCC version based register offsets to EDAC driver") Cc: # 6.0 Fixes: a6e9d7ef252c ("soc: qcom: llcc: Add configuration data for SM8450 SoC") Acked-by: Borislav Petkov (AMD) Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230517114635.76358-3-manivannan.sadhasivam@linaro.org commit 3d49f7406b5d9822c1411c6658bac2ae55ba19a2 Author: Manivannan Sadhasivam Date: Wed May 17 17:16:34 2023 +0530 EDAC/qcom: Remove superfluous return variable assignment in qcom_llcc_core_setup() "ret" variable will be assigned on both success and failure cases. So there is no need to initialize it during start of qcom_llcc_core_setup(). Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230517114635.76358-2-manivannan.sadhasivam@linaro.org commit 4ea0bf4b98d66a7a790abb285539f395596bae92 Author: Ben Noordhuis Date: Sat May 6 11:55:02 2023 +0200 io_uring: undeprecate epoll_ctl support Libuv recently started using it so there is at least one consumer now. Cc: stable@vger.kernel.org Fixes: 61a2732af4b0 ("io_uring: deprecate epoll_ctl support") Link: https://github.com/libuv/libuv/pull/3979 Signed-off-by: Ben Noordhuis Link: https://lore.kernel.org/r/20230506095502.13401-1-info@bnoordhuis.nl Signed-off-by: Jens Axboe commit 396ac4c982f6d6cd7c0293a546a0ba5d77fe7f90 Author: Dan Carpenter Date: Fri May 26 15:01:33 2023 +0300 smb: delete an unnecessary statement We don't need to set the list iterators to NULL before a list_for_each_entry() loop because they are assigned inside the macro. Signed-off-by: Dan Carpenter Reviewed-by: Mukesh Ojha Signed-off-by: Steve French commit 6fe55c2799bc29624770c26f98ba7b06214f43e0 Author: Namjae Jeon Date: Thu May 25 00:13:38 2023 +0900 ksmbd: call putname after using the last component last component point filename struct. Currently putname is called after vfs_path_parent_lookup(). And then last component is used for lookup_one_qstr_excl(). name in last component is freed by previous calling putname(). And It cause file lookup failure when testing generic/464 test of xfstest. Fixes: 74d7970febf7 ("ksmbd: fix racy issue from using ->d_parent and ->d_name") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 6cc2268f5647cbfde3d4fc2e4ee005070ea3a8d2 Author: Namjae Jeon Date: Fri May 19 23:11:33 2023 +0900 ksmbd: fix incorrect AllocationSize set in smb2_get_info If filesystem support sparse file, ksmbd should return allocated size using ->i_blocks instead of stat->size. This fix generic/694 xfstests. Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 36322523dddb11107e9f7f528675a0dec2536103 Author: Namjae Jeon Date: Fri May 19 23:09:48 2023 +0900 ksmbd: fix UAF issue from opinfo->conn If opinfo->conn is another connection and while ksmbd send oplock break request to cient on current connection, The connection for opinfo->conn can be disconnect and conn could be freed. When sending oplock break request, this ksmbd_conn can be used and cause user-after-free issue. When getting opinfo from the list, ksmbd check connection is being released. If it is not released, Increase ->r_count to wait that connection is freed. Cc: stable@vger.kernel.org Reported-by: Per Forlin Tested-by: Per Forlin Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 0512a5f89e1fae74251fde6893ff634f1c96c6fb Author: Kuan-Ting Chen Date: Fri May 19 23:00:24 2023 +0900 ksmbd: fix multiple out-of-bounds read during context decoding Check the remaining data length before accessing the context structure to ensure that the entire structure is contained within the packet. Additionally, since the context data length `ctxt_len` has already been checked against the total packet length `len_of_ctxts`, update the comparison to use `ctxt_len`. Cc: stable@vger.kernel.org Signed-off-by: Kuan-Ting Chen Acked-by: Namjae Jeon Signed-off-by: Steve French commit d738950f112c8f40f0515fe967db998e8235a175 Author: Kuan-Ting Chen Date: Fri May 19 22:59:28 2023 +0900 ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate Check request_buf length first to avoid out-of-bounds read by req->DialectCount. [ 3350.990282] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x35d7/0x3e60 [ 3350.990282] Read of size 2 at addr ffff88810ad61346 by task kworker/5:0/276 [ 3351.000406] Workqueue: ksmbd-io handle_ksmbd_work [ 3351.003499] Call Trace: [ 3351.006473] [ 3351.006473] dump_stack_lvl+0x8d/0xe0 [ 3351.006473] print_report+0xcc/0x620 [ 3351.006473] kasan_report+0x92/0xc0 [ 3351.006473] smb2_handle_negotiate+0x35d7/0x3e60 [ 3351.014760] ksmbd_smb_negotiate_common+0x7a7/0xf00 [ 3351.014760] handle_ksmbd_work+0x3f7/0x12d0 [ 3351.014760] process_one_work+0xa85/0x1780 Cc: stable@vger.kernel.org Signed-off-by: Kuan-Ting Chen Acked-by: Namjae Jeon Signed-off-by: Steve French commit 84c5aa47925a1f40d698b6a6a2bf67e99617433d Author: Namjae Jeon Date: Fri May 12 23:29:12 2023 +0900 ksmbd: fix credit count leakage This patch fix the failure from smb2.credits.single_req_credits_granted test. When client send 8192 credit request, ksmbd return 8191 credit granted. ksmbd should give maximum possible credits that must be granted within the range of not exceeding the max credit to client. Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit df14afeed2e6c1bbadef7d2f9c46887bbd6d8d94 Author: Namjae Jeon Date: Sun May 14 10:02:27 2023 +0900 ksmbd: fix uninitialized pointer read in smb2_create_link() There is a case that file_present is true and path is uninitialized. This patch change file_present is set to false by default and set to true when patch is initialized. Fixes: 74d7970febf7 ("ksmbd: fix racy issue from using ->d_parent and ->d_name") Reported-by: Coverity Scan Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 48b47f0caaa8a9f05ed803cb4f335fa3a7bfc622 Author: Namjae Jeon Date: Fri May 12 17:05:41 2023 +0900 ksmbd: fix uninitialized pointer read in ksmbd_vfs_rename() Uninitialized rd.delegated_inode can be used in vfs_rename(). Fix this by setting rd.delegated_inode to NULL to avoid the uninitialized read. Fixes: 74d7970febf7 ("ksmbd: fix racy issue from using ->d_parent and ->d_name") Reported-by: Coverity Scan Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 49572d5361298711207ab387a6c318407deb963a Merge: 18713e8a68937 793a539ac7884 Author: Linus Torvalds Date: Fri May 26 17:45:24 2023 -0700 Merge tag 'cxl-fixes-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull compute express link fixes from Dan Williams: "The 'media ready' series prevents the driver from acting on bad capacity information, and it moves some checks earlier in the init sequence which impacts topics in the queue for 6.5. Additional hotplug testing uncovered a missing enable for memory decode. A debug crash fix is also included. Summary: - Stop trusting capacity data before the "media ready" indication - Add missing HDM decoder capability enable for the cold-plug case - Fix a debug message induced crash" * tag 'cxl-fixes-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl: Explicitly initialize resources when media is not ready cxl/port: Fix NULL pointer access in devm_cxl_add_port() cxl: Move cxl_await_media_ready() to before capacity info retrieval cxl: Wait Memory_Info_Valid before access memory related info cxl/port: Enable the HDM decoder capability for switch ports commit 18713e8a689377386f639d9317f958244825bd7b Merge: 96f15fc6cc020 abf5422e821f0 Author: Linus Torvalds Date: Fri May 26 16:17:56 2023 -0700 Merge tag 'arm-fixes-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "There have not been a lot of fixes for for the soc tree in 6.4, but these have been sitting here for too long. For the devicetree side, there is one minor warning fix for vexpress, the rest all all for the the NXP i.MX platforms: SoC specific bugfixes for the iMX8 clocks and its USB-3.0 gadget device, as well as board specific fixes for regulators and the phy on some of the i.MX boards. The microchip risc-v and arm32 maintainers now also add a shared maintainer file entry for the arm64 parts. The remaining fixes are all for firmware drivers, addressing mistakes in the optee, scmi and ff-a firmware driver implementation, mostly in the error handling code, incorrect use of the alloc_workqueue() interface in SCMI, and compatibility with corner cases of the firmware implementation" * tag 'arm-fixes-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: MAINTAINERS: update arm64 Microchip entries arm64: dts: imx8: fix USB 3.0 Gadget Failure in QM & QXPB0 at super speed dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type arm64: dts: colibri-imx8x: delete adc1 and dsp arm64: dts: colibri-imx8x: fix iris pinctrl configuration arm64: dts: colibri-imx8x: move pinctrl property from SoM to eval board arm64: dts: colibri-imx8x: fix eval board pin configuration arm64: dts: imx8mp: Fix video clock parents ARM: dts: imx6qdl-mba6: Add missing pvcie-supply regulator ARM: dts: imx6ull-dhcor: Set and limit the mode for PMIC buck 1, 2 and 3 arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay arm64: dts: imx8mn: Fix video clock parents firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors firmware: arm_ffa: Fix FFA device names for logical partitions firmware: arm_ffa: Fix usage of partition info get count flag firmware: arm_ffa: Check if ffa_driver remove is present before executing arm64: dts: arm: add missing cache properties ARM: dts: vexpress: add missing cache properties firmware: arm_scmi: Fix incorrect alloc_workqueue() invocation optee: fix uninited async notif value commit 96f15fc6cc020f68ea23e099da34858678060002 Merge: 8846af7547b52 3b8803494a061 Author: Linus Torvalds Date: Fri May 26 16:06:57 2023 -0700 Merge tag 'pci-v6.4-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fix from Bjorn Helgaas: - Quirk Ice Lake Root Ports to work around DPC log size issue (Mika Westerberg) * tag 'pci-v6.4-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports commit 8846af7547b52704cc50b76eecb5fe5a5128fda9 Merge: a92c9ab69f669 4752354af7104 Author: Linus Torvalds Date: Fri May 26 15:57:14 2023 -0700 Merge tag 'vfio-v6.4-rc4' of https://github.com/awilliam/linux-vfio Pull VFIO fix from Alex Williamson: - Test for and return error for invalid pfns through the pin pages interface (Yan Zhao) * tag 'vfio-v6.4-rc4' of https://github.com/awilliam/linux-vfio: vfio/type1: check pfn valid before converting to struct page commit f270f8582353b70b8c6626252c8de3328ab45097 Merge: 9491d01fbc550 8557dc2712694 Author: Jens Axboe Date: Fri May 26 16:37:42 2023 -0600 Merge tag 'md-fixes-2023-05-24' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.4 Pull MD fix from Song: "This change fixes a raid5 regression since 5.12 kernels." * tag 'md-fixes-2023-05-24' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk() commit a92c9ab69f6696b26ef0c1ca3e8b922d1fc82e86 Merge: 6fae9129b1c70 9491d01fbc550 Author: Linus Torvalds Date: Fri May 26 15:04:54 2023 -0700 Merge tag 'block-6.4-2023-05-26' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A few fixes for the storage side of things: - Fix bio caching condition for passthrough IO (Anuj) - end-of-device check fix for zero sized devices (Christoph) - Update Paolo's email address - NVMe pull request via Keith with a single quirk addition - Fix regression in how wbt enablement is done (Yu) - Fix race in active queue accounting (Tian)" * tag 'block-6.4-2023-05-26' of git://git.kernel.dk/linux: NVMe: Add MAXIO 1602 to bogus nid list. block: make bio_check_eod work for zero sized devices block: fix bio-cache for passthru IO block, bfq: update Paolo's address in maintainer list blk-mq: fix race condition in active queue accounting blk-wbt: fix that wbt can't be disabled by default commit 6fae9129b1c70bd6b7677b808c03bc96e83460fc Merge: 77af1f2b9a246 533ab73f5b5c9 Author: Linus Torvalds Date: Fri May 26 15:00:04 2023 -0700 Merge tag 'io_uring-6.4-2023-05-26' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a single fix for the conditional schedule with the SQPOLL thread, dropping the uring_lock if we do need to reschedule" * tag 'io_uring-6.4-2023-05-26' of git://git.kernel.dk/linux: io_uring: unlock sqd->lock before sq thread release CPU commit 5ad9b4719fc9bc4715c7e19875a962095b0577e7 Author: pengfuyuan Date: Tue May 23 15:09:55 2023 +0800 btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds When compiling on a MIPS 64-bit machine we get these warnings: In file included from ./arch/mips/include/asm/cacheflush.h:13, from ./include/linux/cacheflush.h:5, from ./include/linux/highmem.h:8, from ./include/linux/bvec.h:10, from ./include/linux/blk_types.h:10, from ./include/linux/blkdev.h:9, from fs/btrfs/disk-io.c:7: fs/btrfs/disk-io.c: In function ‘csum_tree_block’: fs/btrfs/disk-io.c:100:34: error: array subscript 1 is above array bounds of ‘struct page *[1]’ [-Werror=array-bounds] 100 | kaddr = page_address(buf->pages[i]); | ~~~~~~~~~~^~~ ./include/linux/mm.h:2135:48: note: in definition of macro ‘page_address’ 2135 | #define page_address(page) lowmem_page_address(page) | ^~~~ cc1: all warnings being treated as errors We can check if i overflows to solve the problem. However, this doesn't make much sense, since i == 1 and num_pages == 1 doesn't execute the body of the loop. In addition, i < num_pages can also ensure that buf->pages[i] will not cross the boundary. Unfortunately, this doesn't help with the problem observed here: gcc still complains. To fix this add a compile-time condition for the extent buffer page array size limit, which would eventually lead to eliminating the whole for loop. CC: stable@vger.kernel.org # 5.10+ Signed-off-by: pengfuyuan Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8fd9f4232d8152c650fd15127f533a0f6d0a4b2b Author: Shida Zhang Date: Tue May 16 09:34:30 2023 +0800 btrfs: fix an uninitialized variable warning in btrfs_log_inode This fixes the following warning reported by gcc 10.2.1 under x86_64: ../fs/btrfs/tree-log.c: In function ‘btrfs_log_inode’: ../fs/btrfs/tree-log.c:6211:9: error: ‘last_range_start’ may be used uninitialized in this function [-Werror=maybe-uninitialized] 6211 | ret = insert_dir_log_key(trans, log, path, key.objectid, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 6212 | first_dir_index, last_dir_index); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../fs/btrfs/tree-log.c:6161:6: note: ‘last_range_start’ was declared here 6161 | u64 last_range_start; | ^~~~~~~~~~~~~~~~ This might be a false positive fixed in later compiler versions but we want to have it fixed. Reported-by: k2ci Reviewed-by: Anand Jain Signed-off-by: Shida Zhang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 45c2f36871955b51b4ce083c447388d8c72d6b91 Author: Christoph Hellwig Date: Mon May 15 11:18:21 2023 +0200 btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work When I implemented the storage layer bio splitting, I was under the assumption that we'll never split metadata bios. But Qu reminded me that this can actually happen with very old file systems with unaligned metadata chunks and RAID0. I still haven't seen such a case in practice, but we better handled this case, especially as it is fairly easily to do not calling the ->end_іo method directly in btrfs_end_io_work, and using the proper btrfs_orig_bbio_end_io helper instead. In addition to the old file system with unaligned metadata chunks case documented in the commit log, the combination of the new scrub code with Johannes pending raid-stripe-tree also triggers this case. We spent some time debugging it and found that this patch solves the problem. Fixes: 103c19723c80 ("btrfs: split the bio submission path into a separate file") CC: stable@vger.kernel.org # 6.3+ Reviewed-by: Johannes Thumshirn Tested-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit abac3ac97fe8734b620e7322a116450d7f90aa43 Author: Vladislav Efanov Date: Fri May 26 19:16:32 2023 +0300 batman-adv: Broken sync while rescheduling delayed work Syzkaller got a lot of crashes like: KASAN: use-after-free Write in *_timers* All of these crashes point to the same memory area: The buggy address belongs to the object at ffff88801f870000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 5320 bytes inside of 8192-byte region [ffff88801f870000, ffff88801f872000) This area belongs to : batadv_priv->batadv_priv_dat->delayed_work->timer_list The reason for these issues is the lack of synchronization. Delayed work (batadv_dat_purge) schedules new timer/work while the device is being deleted. As the result new timer/delayed work is set after cancel_delayed_work_sync() was called. So after the device is freed the timer list contains pointer to already freed memory. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Cc: stable@kernel.org Fixes: 2f1dfbe18507 ("batman-adv: Distributed ARP Table - implement local storage") Signed-off-by: Vladislav Efanov Acked-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 77af1f2b9a2464e4bce20cfd32bfb2390c67de7c Merge: c551afcdc373e 5f7fdb0f25575 Author: Linus Torvalds Date: Fri May 26 13:55:46 2023 -0700 Merge tag 'thermal-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Fix a regression introduced inadvertently during the 6.3 cycle by a commit making the Intel int340x thermal driver use sysfs_emit_at() instead of scnprintf() (Srinivas Pandruvada)" * tag 'thermal-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: int340x: Add new line for UUID display commit c551afcdc373eb66d12e08ed0434711c9a10ca2b Merge: 91a304340a227 3bf8c6307bad5 Author: Linus Torvalds Date: Fri May 26 13:45:43 2023 -0700 Merge tag 'pm-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Fix three issues related to the ->fast_switch callback in the AMD P-state cpufreq driver (Gautham R. Shenoy and Wyes Karny)" * tag 'pm-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf() cpufreq: amd-pstate: Remove fast_switch_possible flag from active driver cpufreq: amd-pstate: Add ->fast_switch() callback commit 793a539ac78843ef9378bb42a44edfbc552a67d5 Author: Dave Jiang Date: Thu May 25 17:33:01 2023 -0700 cxl: Explicitly initialize resources when media is not ready When media is not ready do not assume that the capacity information from the identify command is valid, i.e. ->total_bytes ->partition_align_bytes ->{volatile,persistent}_only_bytes. Explicitly zero out the capacity resources and exit early. Given zero-init of those fields this patch is functionally equivalent to the prior state, but it improves readability and robustness going forward. Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/168506118166.3004974.13523455340007852589.stgit@djiang5-mobl3 Signed-off-by: Dan Williams commit 91a304340a2272b1941c9ac81d57c68f97e6260d Merge: b158dd941b4f2 3002b8642f016 Author: Linus Torvalds Date: Fri May 26 13:29:16 2023 -0700 Merge tag 'gpio-fixes-for-v6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix incorrect output in in-tree gpio tools - fix a shell coding issue in gpio-sim selftests - correctly set the permissions for debugfs attributes exposed by gpio-mockup - fix chip name and pin count in gpio-f7188x for one of the supported models - fix numberspace pollution when using dynamically and statically allocated GPIOs together * tag 'gpio-fixes-for-v6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio-f7188x: fix chip name and pin count on Nuvoton chip gpiolib: fix allocation of mixed dynamic/static GPIOs gpio: mockup: Fix mode of debugfs files selftests: gpio: gpio-sim: Fix BUG: test FAILED due to recent change tools: gpio: fix debounce_period_us output of lsgpio commit b158dd941b4f28e12c4f956caf2352febe09fe4e Merge: b83ac44e02986 597441b3436a4 Author: Linus Torvalds Date: Fri May 26 13:21:38 2023 -0700 Merge tag 'for-6.4-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - handle memory allocation error in checksumming helper (reported by syzbot) - fix lockdep splat when aborting a transaction, add NOFS protection around invalidate_inode_pages2 that could allocate with GFP_KERNEL - reduce chances to hit an ENOSPC during scrub with RAID56 profiles * tag 'for-6.4-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: use nofs when cleaning up aborted transactions btrfs: handle memory allocation failure in btrfs_csum_one_bio btrfs: scrub: try harder to mark RAID56 block groups read-only commit b83ac44e02986e640ee954e187ba414cb94453e2 Merge: 47ee3f1dd93bc 5502d1fab09df Author: Linus Torvalds Date: Fri May 26 13:11:41 2023 -0700 Merge tag 'drm-fixes-2023-05-26' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "This week's collection is pretty spread out, accel/qaic has a bunch of fixes, amdgpu, then lots of single fixes across a bunch of places. core: - fix drmm_mutex_init lock class mgag200: - fix gamma lut initialisation pl111: - fix FB depth on IMPD-1 framebuffer amdgpu: - Fix missing BO unlocking in KIQ error path - Avoid spurious secure display error messages - SMU13 fix - Fix an OD regression - GPU reset display IRQ warning fix - MST fix radeon: - Fix a DP regression i915: - PIPEDMC disabling fix for bigjoiner config panel: - fix aya neo air plus quirk sched: - remove redundant NULL check qaic: - fix NNC message corruption - Grab ch_lock during QAIC_ATTACH_SLICE_BO - Flush the transfer list again - Validate if BO is sliced before slicing - Validate user data before grabbing any lock - initialize ret variable to 0 - silence some uninitialized variable warnings" * tag 'drm-fixes-2023-05-26' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: Have Payload Properly Created After Resume drm/amd/display: Fix warning in disabling vblank irq drm/amd/pm: Fix output of pp_od_clk_voltage drm/amd/pm: add missing NotifyPowerSource message mapping for SMU13.0.7 drm/radeon: reintroduce radeon_dp_work_func content drm/amdgpu: don't enable secure display on incompatible platforms drm:amd:amdgpu: Fix missing buffer object unlock in failure path accel/qaic: Fix NNC message corruption accel/qaic: Grab ch_lock during QAIC_ATTACH_SLICE_BO accel/qaic: Flush the transfer list again accel/qaic: Validate if BO is sliced before slicing accel/qaic: Validate user data before grabbing any lock accel/qaic: initialize ret variable to 0 drm/i915: Fix PIPEDMC disabling for a bigjoiner configuration drm: fix drmm_mutex_init() drm/sched: Remove redundant check drm: panel-orientation-quirks: Change Air's quirk to support Air Plus accel/qaic: silence some uninitialized variable warnings drm/pl111: Fix FB depth on IMPD-1 framebuffer drm/mgag200: Fix gamma lut not initialized. commit 47ee3f1dd93bcbe031539b1ecdaafb44b661c772 Author: Linus Torvalds Date: Fri May 26 12:34:20 2023 -0700 x86: re-introduce support for ERMS copies for user space accesses I tried to streamline our user memory copy code fairly aggressively in commit adfcf4231b8c ("x86: don't use REP_GOOD or ERMS for user memory copies"), in order to then be able to clean up the code and inline the modern FSRM case in commit 577e6a7fd50d ("x86: inline the 'rep movs' in user copies for the FSRM case"). We had reports [1] of that causing regressions earlier with blogbench, but that turned out to be a horrible benchmark for that case, and not a sufficient reason for re-instating "rep movsb" on older machines. However, now Eric Dumazet reported [2] a regression in performance that seems to be a rather more real benchmark, where due to the removal of "rep movs" a TCP stream over a 100Gbps network no longer reaches line speed. And it turns out that with the simplified the calling convention for the non-FSRM case in commit 427fda2c8a49 ("x86: improve on the non-rep 'copy_user' function"), re-introducing the ERMS case is actually fairly simple. Of course, that "fairly simple" is glossing over several missteps due to having to fight our assembler alternative code. This code really wanted to rewrite a conditional branch to have two different targets, but that made objtool sufficiently unhappy that this instead just ended up doing a choice between "jump to the unrolled loop, or use 'rep movsb' directly". Let's see if somebody finds a case where the kernel memory copies also care (see commit 68674f94ffc9: "x86: don't use REP_GOOD or ERMS for small memory copies"). But Eric does argue that the user copies are special because networking tries to copy up to 32KB at a time, if order-3 pages allocations are possible. In-kernel memory copies are typically small, unless they are the special "copy pages at a time" kind that still use "rep movs". Link: https://lore.kernel.org/lkml/202305041446.71d46724-yujie.liu@intel.com/ [1] Link: https://lore.kernel.org/lkml/CANn89iKUbyrJ=r2+_kK+sb2ZSSHifFZ7QkPLDpAtkJ8v4WUumA@mail.gmail.com/ [2] Reported-and-tested-by: Eric Dumazet Fixes: adfcf4231b8c ("x86: don't use REP_GOOD or ERMS for user memory copies") Signed-off-by: Linus Torvalds commit c041d33bf7ec731bb71f47e4d45a7aec9e40b1b9 Author: Song Liu Date: Fri May 19 16:57:57 2023 -0700 perf evsel: Separate bpf_counter_list and bpf_filters, can be used at the same time 'struct evsel' uses a union for the two lists. This turned out to be error prone. For example: [root@quaco ~]# perf stat --bpf-prog 5246 Error: cpu-clock event does not have sample flags 66c660 failed to set filter "(null)" on event cpu-clock with 2 (No such file or directory) [root@quaco ~]# perf stat --bpf-prog 5246 Fix this issue by separating the two lists. Fixes: 56ec9457a4a20c5e ("perf bpf filter: Implement event sample filtering") Signed-off-by: Song Liu Acked-by: Namhyung Kim Cc: Jiri Olsa Cc: Namhyung Kim Cc: kernel-team@meta.com Link: https://lore.kernel.org/r/20230519235757.3613719-1-song@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c8268a9b91055c992909a0845cfa59c624908da8 Author: Arnaldo Carvalho de Melo Date: Fri May 26 15:45:03 2023 -0300 tools headers UAPI: Sync the linux/in.h with the kernel sources Picking the changes from: 3632679d9e4f879f ("ipv{4,6}/raw: fix output xfrm lookup wrt protocol") That includes a define (IP_PROTOCOL) that isn't being used in generating any id -> string table used by 'perf trace'. Addresses this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/in.h' differs from latest version at 'include/uapi/linux/in.h' diff -u tools/include/uapi/linux/in.h include/uapi/linux/in.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nicolas Dichtel Cc: Paolo Abeni Link: https://lore.kernel.org/lkml/ZHD/Ms0DMq7viaq+@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 15d4371bac978bb96b36c37e822cdae24c0dcd77 Author: James Clark Date: Mon May 22 11:26:04 2023 +0100 perf cs-etm: Copy kernel coresight-pmu.h header Copy the kernel version of the header to fix the header diff build warning. Some new definitions were only added to the tools side header, but these are only used in Perf so move them to a different header. Signed-off-by: James Clark Reviewed-by: Mike Leach Link: https://lore.kernel.org/r/20230522102604.1081416-1-james.clark@arm.com Cc: Mark Rutland Cc: Suzuki K Poulose Cc: Ian Rogers Cc: Peter Zijlstra Cc: Adrian Hunter Cc: acme@kernel.org Cc: Jiri Olsa Cc: Namhyung Kim Cc: Will Deacon Cc: Leo Yan Cc: Alexander Shishkin Cc: linux-arm-kernel@lists.infradead.org Cc: coresight@lists.linaro.org Cc: siyanteng@loongson.cn Cc: John Garry Cc: Ingo Molnar Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 251c01e27feee83ff8fa294d33277616c9032dd0 Author: Song Liu Date: Fri May 26 15:30:23 2023 -0300 perf bpf: Do not use llvm-strip on BPF binary llvm-strip is not really required. Remove this dependency to make it easier to build perf with BUILD_BPF_SKEL=1. Committer notes: This removes the need for the 'llvm' package just to get llvm-strip. Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Song Liu Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 65cd8e5534f873b76b55fb17e942c512ee3699d9 Author: Ian Rogers Date: Mon Apr 17 12:25:46 2023 -0700 perf build: Don't compile demangle-cxx.cpp if not necessary demangle-cxx.cpp requires a C++ compiler, but feature checks may fail because of the absence of this. Add a CONFIG_CXX_DEMANGLE so that the source isn't built if not supported. Copy libbfd and cplus demangle variants to a weak symbol-elf.c version so they aren't dependent on C++. These variants are only built with the build option BUILD_NONDISTRO=1. Committer note: This also handles this build break when a C++ compiler isn't available: CXX /tmp/build/perf/util/demangle-cxx.o /bin/sh: g++: command not found Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Qi Liu Cc: Ravi Bangoria Link: https://lore.kernel.org/r/20230417192546.99923-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a0c2f92d36d20d72efb27cbe8669037321e92f22 Author: Ian Rogers Date: Mon May 15 09:50:39 2023 -0700 perf arm: Fix include path to cs-etm.h Change "../cs-etm.h" to just "../../../util/cs-etm.h" as ../cs-etm.h doesn't exist. Suggested-by: Leo Yan Reviewed-by: Leo Yan Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230515165039.544045-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 690917c647e245da76183656400d4926427a8b93 Author: Namhyung Kim Date: Wed May 24 17:03:07 2023 -0700 perf bpf filter: Fix a broken perf sample data naming for BPF CO-RE BPF CO-RE requires 3 underscores for the ignored suffix rule but it mistakenly used only 2. Let's fix it. Fixes: 3a8b8fc3174891c4 ("perf bpf filter: Support pre-5.16 kernels where 'mem_hops' isn't in 'union perf_mem_data_src'") Signed-off-by: Namhyung Kim Acked-by: Andrii Nakryiko Acked-by: John Fastabend Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20230525000307.3202449-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4095f4d9225a64921a6ee4bb8dbc94c6edc2df08 Author: Tudor Ambarus Date: Thu May 18 08:54:40 2023 +0000 mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes We failed to initialize n_banks for spi-nor-generic flashes, which caused a devide by zero when computing the bank_size. By default we consider that all chips have a single bank. Initialize the default number of banks for spi-nor-generic flashes. Even if the bug is fixed with this simple initialization, check the n_banks value before dividing so that we make sure this kind of bug won't occur again if some other struct instance is created uninitialized. Suggested-by: Todd Brandt Reported-by: Todd Brandt Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217448 Fixes: 9d6c5d64f028 ("mtd: spi-nor: Introduce the concept of bank") Link: https://lore.kernel.org/all/20230516225108.29194-1-todd.e.brandt@intel.com/ Signed-off-by: Tudor Ambarus Tested-by: Todd Brandt Reviewed-by: Miquel Raynal Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230518085440.2363676-1-tudor.ambarus@linaro.org commit 650a8884a364ff2568b51cde9009cfd43cdae6ad Author: Arnd Bergmann Date: Tue May 16 22:21:24 2023 +0200 mtd: rawnand: ingenic: fix empty stub helper definitions A few functions provide an empty interface definition when CONFIG_MTD_NAND_INGENIC_ECC is disabled, but they are accidentally defined as global functions in the header: drivers/mtd/nand/raw/ingenic/ingenic_ecc.h:39:5: error: no previous prototype for 'ingenic_ecc_calculate' drivers/mtd/nand/raw/ingenic/ingenic_ecc.h:46:5: error: no previous prototype for 'ingenic_ecc_correct' drivers/mtd/nand/raw/ingenic/ingenic_ecc.h:53:6: error: no previous prototype for 'ingenic_ecc_release' drivers/mtd/nand/raw/ingenic/ingenic_ecc.h:57:21: error: no previous prototype for 'of_ingenic_ecc_get' Turn them into 'static inline' definitions instead. Fixes: 15de8c6efd0e ("mtd: rawnand: ingenic: Separate top-level and SoC specific code") Signed-off-by: Arnd Bergmann Reviewed-by: Paul Cercueil Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230516202133.559488-1-arnd@kernel.org commit 420c4495b5e56cc11e6802ce98400544f698b393 Author: Tudor Ambarus Date: Tue May 9 19:39:00 2023 +0000 mtd: spi-nor: spansion: make sure local struct does not contain garbage Following errors were seen with um-x86_64-gcc12/um-allyesconfig: + /kisskb/src/drivers/mtd/spi-nor/spansion.c: error: 'op' is used uninitialized [-Werror=uninitialized]: => 495:27, 364:27 Initialise local struct spi_mem_op with all zeros at declaration in order to avoid using garbage data for fields that are not explicitly set afterwards. Reported-by: Geert Uytterhoeven Fixes: c87c9b11c53ce ("mtd: spi-nor: spansion: Determine current address mode") Fixes: 6afcc84080c41 ("mtd: spi-nor: spansion: Add support for Infineon S25FS256T") Signed-off-by: Tudor Ambarus Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230509193900.948753-1-tudor.ambarus@linaro.org commit 9491d01fbc550d123d72bf1cd7a0985508a9c469 Merge: 3eb96946f0be6 a3a9d63dcd155 Author: Jens Axboe Date: Fri May 26 09:46:01 2023 -0600 Merge tag 'nvme-6.4-2023-05-26' of git://git.infradead.org/nvme into block-6.4 Pull NVMe fix from Keith: "nvme fixes for 6.4 One nvme quirk (Tatsuki)" * tag 'nvme-6.4-2023-05-26' of git://git.infradead.org/nvme: NVMe: Add MAXIO 1602 to bogus nid list. commit 8938f75a5e35c597a647c28984a0304da7a33d63 Author: Herve Codina Date: Tue May 23 17:12:22 2023 +0200 ASoC: simple-card: Add missing of_node_put() in case of error In the error path, a of_node_put() for platform is missing. Just add it. Signed-off-by: Herve Codina Acked-by: Kuninori Morimoto Link: https://lore.kernel.org/r/20230523151223.109551-9-herve.codina@bootlin.com Signed-off-by: Mark Brown commit a3a9d63dcd15535e7fdf4c7c1b32bfaed762973a Author: Tatsuki Sugiura Date: Sat May 20 21:23:50 2023 +0900 NVMe: Add MAXIO 1602 to bogus nid list. HIKSEMI FUTURE M.2 SSD uses the same dummy nguid and eui64. I confirmed it with my two devices. This patch marks the controller as NVME_QUIRK_BOGUS_NID. --------------------------------------------------------- sugi@tempest:~% sudo nvme id-ctrl /dev/nvme0 NVME Identify Controller: vid : 0x1e4b ssvid : 0x1e4b sn : 30096022612 mn : HS-SSD-FUTURE 2048G fr : SN10542 rab : 0 ieee : 000000 cmic : 0 mdts : 7 cntlid : 0 ver : 0x10400 rtd3r : 0x7a120 rtd3e : 0x1e8480 oaes : 0x200 ctratt : 0x2 rrls : 0 cntrltype : 1 fguid : 00000000-0000-0000-0000-000000000000 --------------------------------------------------------- --------------------------------------------------------- sugi@tempest:~% sudo nvme id-ns /dev/nvme0n1 NVME Identify Namespace 1: nguid : 00000000000000000000000000000000 eui64 : 0000000000000002 lbaf 0 : ms:0 lbads:9 rp:0 (in use) --------------------------------------------------------- Signed-off-by: Tatsuki Sugiura Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit abf5422e821f0f321e95cb728f013f143ca4655c Merge: 51bba254edc79 111a833dc5cbe Author: Arnd Bergmann Date: Fri May 26 16:49:05 2023 +0200 Merge tag 'ffa-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A fixes for v6.4 Quite a few fixes to address set of assorted issues: 1. NULL pointer dereference if the ffa driver doesn't provide remove() callback as it is currently executed unconditionally 2. FF-A core probe failure on systems with v1.0 firmware as the new partition info get count flag is used unconditionally 3. Failure to register more than one logical partition or service within the same physical partition as the device name contains only VM ID which will be same for all but each will have unique UUID. 4. Rejection of certain memory interface transmissions by the receivers (secure partitions) as few MBZ fields are non-zero due to lack of explicit re-initialization of those fields * tag 'ffa-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors firmware: arm_ffa: Fix FFA device names for logical partitions firmware: arm_ffa: Fix usage of partition info get count flag firmware: arm_ffa: Check if ffa_driver remove is present before executing Link: https://lore.kernel.org/r/20230509143453.1188753-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 8d73259ef23f449329294dc187932f7470268126 Author: Namhyung Kim Date: Thu May 25 14:20:38 2023 -0700 perf ftrace latency: Remove unnecessary "--" from --use-nsec option The option name should not have the dashes. Current version shows four dashes for the option. $ perf ftrace latency -h Usage: perf ftrace [] [] or: perf ftrace [] -- [] [] or: perf ftrace {trace|latency} [] [] or: perf ftrace {trace|latency} [] -- [] [] -b, --use-bpf Use BPF to measure function latency -n, ----use-nsec Use nano-second histogram -T, --trace-funcs Show latency of given function Fixes: 84005bb6148618cc ("perf ftrace latency: Add -n/--use-nsec option") Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Changbin Du Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230525212038.3535851-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9b9e46aa07273ceb96866b2e812b46f1ee0b8d2f Author: Osama Muhammad Date: Thu May 25 22:27:46 2023 +0500 nfcsim.c: Fix error checking for debugfs_create_dir This patch fixes the error checking in nfcsim.c. The DebugFS kernel API is developed in a way that the caller can safely ignore the errors that occur during the creation of DebugFS nodes. Signed-off-by: Osama Muhammad Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit a05e9aabd9dc27fc8888678391e3bf78624f8253 Author: Hans Verkuil Date: Wed Apr 19 08:06:02 2023 +0100 media: staging: media: atomisp: init high & low vars Fix a compiler warning: include/linux/dev_printk.h: In function 'ov2680_probe': include/linux/dev_printk.h:144:31: warning: 'high' may be used uninitialized [-Wmaybe-uninitialized] 144 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~ In function 'ov2680_detect', inlined from 'ov2680_s_config' at drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:468:8, inlined from 'ov2680_probe' at drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:647:8: drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:376:13: note: 'high' was declared here 376 | u32 high, low; | ^~~~ 'high' is indeed uninitialized after the ov_read_reg8() call failed, so there is no point showing the value. Just say that the read failed. But low can also be used uninitialized later, so just make it more robust and properly zero the high and low variables. Signed-off-by: Hans Verkuil Reviewed-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 73af6c7511038249cad3d5f3b44bf8d78ac0f499 Author: Hans Verkuil Date: Mon Apr 24 16:07:28 2023 +0100 media: cec: core: don't set last_initiator if tx in progress When a message was received the last_initiator is set to 0xff. This will force the signal free time for the next transmit to that for a new initiator. However, if a new transmit is already in progress, then don't set last_initiator, since that's the initiator of the current transmit. Overwriting this would cause the signal free time of a following transmit to be that of the new initiator instead of a next transmit. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit fe4526d99e2e06b08bb80316c3a596ea6a807b75 Author: Hans Verkuil Date: Thu Apr 20 08:26:53 2023 +0100 media: cec: core: disable adapter in cec_devnode_unregister Explicitly disable the CEC adapter in cec_devnode_unregister() Usually this does not really do anything important, but for drivers that use the CEC pin framework this is needed to properly stop the hrtimer. Without this a crash would happen when such a driver is unloaded with rmmod. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit ed17f89e9502f03af493e130620a9bb74c07cf28 Author: Pin-yen Lin Date: Sat Apr 22 11:39:05 2023 +0100 media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats When VCODEC_CAPABILITY_4K_DISABLED is not set in dec_capability, skip formats that are not MTK_FMT_DEC so only decoder formats is updated in mtk_init_vdec_params. Fixes: e25528e1dbe5 ("media: mediatek: vcodec: Use 4K frame size when supported by stateful decoder") Signed-off-by: Pin-yen Lin Reviewed-by: Chen-Yu Tsai Reviewed-by: Yunfei Dong Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 76743b29f4802afdf81d7ff1228c11e697850235 Author: Yassine Oudjana Date: Wed May 3 08:53:40 2023 +0100 media: camss: camss-video: Don't zero subdev format again after initialization In an earlier commit, setting the which field of the subdev format struct in video_get_subdev_format was moved to a designated initializer that also zeroes all other fields. However, the memset call that was zeroing the fields earlier was left in place, causing the which field to be cleared after being set in the initializer. Remove the memset call from video_get_subdev_format to avoid clearing the initialized which field. Fixes: ecefa105cc44 ("media: Zero-initialize all structures passed to subdev pad operations") Signed-off-by: Yassine Oudjana Acked-by: Bryan O'Donoghue Tested-by: Andrey Konovalov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 14b4bd01f8e5d663a41ef8cec5857db874b66e88 Author: Benjamin Gaignard Date: Tue May 23 17:25:15 2023 +0100 media: verisilicon: Additional fix for the crash when opening the driver This fixes the following issue observed on Odroid-M1 board: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Mem abort info: ... Modules linked in: crct10dif_ce hantro_vpu snd_soc_simple_card snd_soc_simple_card_utils v4l2_vp9 v4l2_h264 rockchip_saradc v4l2_mem2mem videobuf2_dma_contig videobuf2_memops rtc_rk808 videobuf2_v4l2 industrialio_triggered_buffer rockchip_thermal dwmac_rk stmmac_platform stmmac videodev kfifo_buf display_connector videobuf2_common pcs_xpcs mc rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi drm_display_helper panfrost drm_shmem_helper gpu_sched ip_tables x_tables ipv6 CPU: 3 PID: 176 Comm: v4l_id Not tainted 6.3.0-rc7-next-20230420 #13481 Hardware name: Hardkernel ODROID-M1 (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : hantro_try_fmt+0xa0/0x278 [hantro_vpu] lr : hantro_try_fmt+0x94/0x278 [hantro_vpu] ... Call trace: hantro_try_fmt+0xa0/0x278 [hantro_vpu] hantro_set_fmt_out+0x3c/0x298 [hantro_vpu] hantro_reset_raw_fmt+0x98/0x128 [hantro_vpu] hantro_set_fmt_cap+0x240/0x254 [hantro_vpu] hantro_reset_encoded_fmt+0x94/0xcc [hantro_vpu] hantro_reset_fmts+0x18/0x38 [hantro_vpu] hantro_open+0xd4/0x20c [hantro_vpu] v4l2_open+0x80/0x120 [videodev] chrdev_open+0xc0/0x22c do_dentry_open+0x13c/0x48c vfs_open+0x2c/0x38 path_openat+0x550/0x934 do_filp_open+0x80/0x12c do_sys_openat2+0xb4/0x168 __arm64_sys_openat+0x64/0xac invoke_syscall+0x48/0x114 el0_svc_common+0x100/0x120 do_el0_svc+0x3c/0xa8 el0_svc+0x40/0xa8 el0t_64_sync_handler+0xb8/0xbc el0t_64_sync+0x190/0x194 Code: 97fc8a7f f940aa80 52864a61 72a686c1 (b9400800) ---[ end trace 0000000000000000 ]--- Fixes: db6f68b51e5c ("media: verisilicon: Do not set context src/dst formats in reset functions") Signed-off-by: Benjamin Gaignard Tested-by: Michael Tretter Tested-by: Diederik de Haas Tested-by: Marek Szyprowski Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit dc362e20cd6ab7a93d1b09669730c406f0910c35 Author: Raju Rangoju Date: Thu May 25 23:56:12 2023 +0530 amd-xgbe: fix the false linkup in xgbe_phy_status In the event of a change in XGBE mode, the current auto-negotiation needs to be reset and the AN cycle needs to be re-triggerred. However, the current code ignores the return value of xgbe_set_mode(), leading to false information as the link is declared without checking the status register. Fix this by propagating the mode switch status information to xgbe_phy_status(). Fixes: e57f7a3feaef ("amd-xgbe: Prepare for working with more than one type of phy") Co-developed-by: Sudheesh Mavila Signed-off-by: Sudheesh Mavila Reviewed-by: Simon Horman Acked-by: Shyam Sundar S K Signed-off-by: Raju Rangoju Signed-off-by: David S. Miller commit 8a0d57df8938e9fd2e99d47a85b7f37d86f91097 Author: Jakub Kicinski Date: Wed May 24 22:17:41 2023 -0700 tls: improve lockless access safety of tls_err_abort() Most protos' poll() methods insert a memory barrier between writes to sk_err and sk_error_report(). This dates back to commit a4d258036ed9 ("tcp: Fix race in tcp_poll"). I guess we should do the same thing in TLS, tcp_poll() does not hold the socket lock. Fixes: 3c4d7559159b ("tls: kernel TLS support") Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 5502d1fab09df791a8b1208dea9defc418b9bbf7 Merge: 13aa38f86eea7 e997c218ad736 Author: Dave Airlie Date: Fri May 26 15:38:27 2023 +1000 Merge tag 'drm-misc-fixes-2023-05-24' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v6.4-rc4: - A few non-trivial fixes to qaic. - Fix drmm_mutex_init always using same lock class. - Fix pl111 fb depth. - Fix uninitialised gamma lut in mgag200. - Add Aya Neo Air Plus quirk. - Trivial null check removal in scheduler. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/d19f748c-2c5b-8140-5b05-a8282dfef73e@linux.intel.com commit 13aa38f86eea7f95eca4909c075b3b511dc3f500 Merge: 94d39d01287b8 482e6ad9adde6 Author: Dave Airlie Date: Fri May 26 15:30:08 2023 +1000 Merge tag 'amd-drm-fixes-6.4-2023-05-24' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.4-2023-05-24: amdgpu: - Fix missing BO unlocking in KIQ error path - Avoid spurious secure display error messages - SMU13 fix - Fix an OD regression - GPU reset display IRQ warning fix - MST fix radeon: - Fix a DP regression Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230524211238.7749-1-alexander.deucher@amd.com commit 94d39d01287b8e28cf4b914908a9fef5201954a8 Merge: 44c026a73be80 45dfbd992923f Author: Dave Airlie Date: Fri May 26 14:36:50 2023 +1000 Merge tag 'drm-intel-fixes-2023-05-25' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes PIPEDMC disabling fix for bigjoiner config Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZG9aROGyc947/J1l@jlahtine-mobl.ger.corp.intel.com commit aa866ee4b15162ef92a567512f85c4357ca8e97f Merge: 822b5a1c17df7 bb72b94c659f5 Author: Jakub Kicinski Date: Thu May 25 21:09:40 2023 -0700 Merge tag 'mlx5-fixes-2023-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-05-24 This series includes bug fixes for the mlx5 driver. * tag 'mlx5-fixes-2023-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: Documentation: net/mlx5: Wrap notes in admonition blocks Documentation: net/mlx5: Add blank line separator before numbered lists Documentation: net/mlx5: Use bullet and definition lists for vnic counters description Documentation: net/mlx5: Wrap vnic reporter devlink commands in code blocks net/mlx5: Fix check for allocation failure in comp_irqs_request_pci() net/mlx5: DR, Add missing mutex init/destroy in pattern manager net/mlx5e: Move Ethernet driver debugfs to profile init callback net/mlx5e: Don't attach netdev profile while handling internal error net/mlx5: Fix post parse infra to only parse every action once net/mlx5e: Use query_special_contexts cmd only once per mdev net/mlx5: fw_tracer, Fix event handling net/mlx5: SF, Drain health before removing device net/mlx5: Drain health before unregistering devlink net/mlx5e: Do not update SBCM when prio2buffer command is invalid net/mlx5e: Consider internal buffers size in port buffer calculations net/mlx5e: Prevent encap offload when neigh update is running net/mlx5e: Extract remaining tunnel encap code to dedicated file ==================== Link: https://lore.kernel.org/r/20230525034847.99268-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 822b5a1c17df7e338b9f05d1cfe5764e37c7f74f Author: Kuniyuki Iwashima Date: Wed May 24 16:29:34 2023 -0700 af_packet: Fix data-races of pkt_sk(sk)->num. syzkaller found a data race of pkt_sk(sk)->num. The value is changed under lock_sock() and po->bind_lock, so we need READ_ONCE() to access pkt_sk(sk)->num without these locks in packet_bind_spkt(), packet_bind(), and sk_diag_fill(). Note that WRITE_ONCE() is already added by commit c7d2ef5dd4b0 ("net/packet: annotate accesses to po->bind"). BUG: KCSAN: data-race in packet_bind / packet_do_bind write (marked) to 0xffff88802ffd1cee of 2 bytes by task 7322 on cpu 0: packet_do_bind+0x446/0x640 net/packet/af_packet.c:3236 packet_bind+0x99/0xe0 net/packet/af_packet.c:3321 __sys_bind+0x19b/0x1e0 net/socket.c:1803 __do_sys_bind net/socket.c:1814 [inline] __se_sys_bind net/socket.c:1812 [inline] __x64_sys_bind+0x40/0x50 net/socket.c:1812 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff88802ffd1cee of 2 bytes by task 7318 on cpu 1: packet_bind+0xbf/0xe0 net/packet/af_packet.c:3322 __sys_bind+0x19b/0x1e0 net/socket.c:1803 __do_sys_bind net/socket.c:1814 [inline] __se_sys_bind net/socket.c:1812 [inline] __x64_sys_bind+0x40/0x50 net/socket.c:1812 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0x0300 -> 0x0000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7318 Comm: syz-executor.4 Not tainted 6.3.0-13380-g7fddb5b5300c #4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Fixes: 96ec6327144e ("packet: Diag core and basic socket info dumping") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230524232934.50950-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 081e8df6819997eae236f75dd52f0c147c4be939 Author: Jakub Kicinski Date: Wed May 24 10:07:12 2023 -0700 tools: ynl: avoid dict errors on older Python versions Python 3.9.0 or newer supports combining dicts() with |, but older versions of Python are still used in the wild (e.g. on CentOS 8, which goes EoL May 31, 2024). With Python 3.6.8 we get: TypeError: unsupported operand type(s) for |: 'dict' and 'dict' Use older syntax. Tested with non-legacy families only. Fixes: f036d936ca57 ("tools: ynl: Add fixed-header support to ynl") Reviewed-by: Simon Horman Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://lore.kernel.org/r/20230524170712.2036128-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 31642e7089df8fd3f54ca7843f7ee2952978cad1 Author: Eric Dumazet Date: Wed May 24 14:14:56 2023 +0000 netrom: fix info-leak in nr_write_internal() Simon Kapadia reported the following issue: The Online Amateur Radio Community (OARC) has recently been experimenting with building a nationwide packet network in the UK. As part of our experimentation, we have been testing out packet on 300bps HF, and playing with net/rom. For HF packet at this baud rate you really need to make sure that your MTU is relatively low; AX.25 suggests a PACLEN of 60, and a net/rom PACLEN of 40 to go with that. However the Linux net/rom support didn't work with a low PACLEN; the mkiss module would truncate packets if you set the PACLEN below about 200 or so, e.g.: Apr 19 14:00:51 radio kernel: [12985.747310] mkiss: ax1: truncating oversized transmit packet! This didn't make any sense to me (if the packets are smaller why would they be truncated?) so I started investigating. I looked at the packets using ethereal, and found that many were just huge compared to what I would expect. A simple net/rom connection request packet had the request and then a bunch of what appeared to be random data following it: Simon provided a patch that I slightly revised: Not only we must not use skb_tailroom(), we also do not want to count NR_NETWORK_LEN twice. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-Developed-by: Simon Kapadia Signed-off-by: Simon Kapadia Signed-off-by: Eric Dumazet Tested-by: Simon Kapadia Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230524141456.1045467-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit ffb3322181d9e8db880202e4f00991764a35d812 Author: Wei Fang Date: Wed May 24 20:57:14 2023 +0800 net: stmmac: fix call trace when stmmac_xdp_xmit() is invoked We encountered a kernel call trace issue which was related to ndo_xdp_xmit callback on our i.MX8MP platform. The reproduce steps show as follows. 1. The FEC port (eth0) connects to a PC port, and the PC uses pktgen_sample03_burst_single_flow.sh to generate packets and send these packets to the FEC port. Notice that the script must be executed before step 2. 2. Run the "./xdp_redirect eth0 eth1" command on i.MX8MP, the eth1 interface is the dwmac. Then there will be a call trace issue soon. Please see the log for more details. The root cause is that the NETDEV_XDP_ACT_NDO_XMIT feature is enabled by default, so when the step 2 command is exexcuted and packets have already been sent to eth0, the stmmac_xdp_xmit() starts running before the stmmac_xdp_set_prog() finishes. To resolve this issue, we disable the NETDEV_XDP_ACT_NDO_XMIT feature by default and turn on/off this feature when the bpf program is installed/uninstalled which just like the other ethernet drivers. Call Trace log: [ 306.311271] ------------[ cut here ]------------ [ 306.315910] WARNING: CPU: 0 PID: 15 at lib/timerqueue.c:55 timerqueue_del+0x68/0x70 [ 306.323590] Modules linked in: [ 306.326654] CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1+ #37 [ 306.333277] Hardware name: NXP i.MX8MPlus EVK board (DT) [ 306.338591] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 306.345561] pc : timerqueue_del+0x68/0x70 [ 306.349577] lr : __remove_hrtimer+0x5c/0xa0 [ 306.353777] sp : ffff80000b7c3920 [ 306.357094] x29: ffff80000b7c3920 x28: 0000000000000000 x27: 0000000000000001 [ 306.364244] x26: ffff80000a763a40 x25: ffff0000d0285a00 x24: 0000000000000001 [ 306.371390] x23: 0000000000000001 x22: ffff000179389a40 x21: 0000000000000000 [ 306.378537] x20: ffff000179389aa0 x19: ffff0000d2951308 x18: 0000000000001000 [ 306.385686] x17: f1d3000000000000 x16: 00000000c39c1000 x15: 55e99bbe00001a00 [ 306.392835] x14: 09000900120aa8c0 x13: e49af1d300000000 x12: 000000000000c39c [ 306.399987] x11: 100055e99bbe0000 x10: ffff8000090b1048 x9 : ffff8000081603fc [ 306.407133] x8 : 000000000000003c x7 : 000000000000003c x6 : 0000000000000001 [ 306.414284] x5 : ffff0000d2950980 x4 : 0000000000000000 x3 : 0000000000000000 [ 306.421432] x2 : 0000000000000001 x1 : ffff0000d2951308 x0 : ffff0000d2951308 [ 306.428585] Call trace: [ 306.431035] timerqueue_del+0x68/0x70 [ 306.434706] __remove_hrtimer+0x5c/0xa0 [ 306.438549] hrtimer_start_range_ns+0x2bc/0x370 [ 306.443089] stmmac_xdp_xmit+0x174/0x1b0 [ 306.447021] bq_xmit_all+0x194/0x4b0 [ 306.450612] __dev_flush+0x4c/0x98 [ 306.454024] xdp_do_flush+0x18/0x38 [ 306.457522] fec_enet_rx_napi+0x6c8/0xc68 [ 306.461539] __napi_poll+0x40/0x220 [ 306.465038] net_rx_action+0xf8/0x240 [ 306.468707] __do_softirq+0x128/0x3a8 [ 306.472378] run_ksoftirqd+0x40/0x58 [ 306.475961] smpboot_thread_fn+0x1c4/0x288 [ 306.480068] kthread+0x124/0x138 [ 306.483305] ret_from_fork+0x10/0x20 [ 306.486889] ---[ end trace 0000000000000000 ]--- Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Signed-off-by: Wei Fang Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230524125714.357337-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit d68cb7cf1fd0ef4287bc0ecd1ed0b6ae8e05fc70 Author: Thomas Bogendoerfer Date: Wed May 24 21:49:08 2023 +0200 net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure Do skb_put() after a new skb has been successfully allocated otherwise the reused skb leads to skb_panics or incorrect packet sizes. Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") Signed-off-by: Thomas Bogendoerfer Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230524194908.147145-1-tbogendoerfer@suse.de Signed-off-by: Jakub Kicinski commit b535cc796a4b4942cd189652588e8d37c1f5925a Author: Steve French Date: Thu May 25 18:53:28 2023 -0500 smb3: missing null check in SMB2_change_notify If plen is null when passed in, we only checked for null in one of the two places where it could be used. Although plen is always valid (not null) for current callers of the SMB2_change_notify function, this change makes it more consistent. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/202305251831.3V1gbbFs-lkp@intel.com/ Signed-off-by: Steve French commit 1dd5483af494216e91c9a12f11992bcba483f944 Author: Steve French Date: Wed May 24 15:12:29 2023 -0500 smb3: update a reviewer email in MAINTAINERS file Paulo has a new email address so update maintainers files. Signed-off-by: Steve French commit 0d85b27b0cc6b5cf54567c5ad913a247a71583ce Merge: 192fe71ce5d17 ab6cacf833ba3 Author: Linus Torvalds Date: Thu May 25 19:23:18 2023 -0700 Merge tag '6.4-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb directory moves and client fixes from Steve French: "Four smb3 client fixes (three of which marked for stable) and three patches to move of fs/cifs and fs/ksmbd to a new common "fs/smb" parent directory - Move the client and server source directories to a common parent directory: fs/cifs -> fs/smb/client fs/ksmbd -> fs/smb/server fs/smbfs_common -> fs/smb/common - important readahead fix - important fix for SMB1 regression - fix for missing mount option ("mapchars") in mount API conversion - minor debugging improvement" * tag '6.4-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb3: move Documentation/filesystems/cifs to Documentation/filesystems/smb cifs: correct references in Documentation to old fs/cifs path smb: move client and server files to common directory fs/smb cifs: mapchars mount option ignored smb3: display debug information better for encryption cifs: fix smb1 mount regression cifs: Fix cifs_limit_bvec_subset() to correctly check the maxmimum size commit 192fe71ce5d17b184423b96d76ce648e1b848db4 Merge: 9828ed3f695a1 61e150fb31072 Author: Linus Torvalds Date: Thu May 25 18:50:18 2023 -0700 Merge tag 'parisc-for-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: "Quite a bunch of real bugfixes in here and most of them are tagged for backporting: A fix for cache flushing from irq context, a kprobes & kgdb breakpoint handling fix, and a fix in the alternative code patching function to take care of CPU hotplugging. parisc now provides LOCKDEP support and comes with a lightweight spinlock check. Both features helped me to find the cache flush bug. Additionally writing the AGP gatt has been fixed, the machine allows the user to reboot after a system halt and arch_sync_dma_for_cpu() has been optimized for PCXL PCUs. Summary: - Fix flush_dcache_page() for usage from irq context - Handle kprobes breakpoints only in kernel context - Handle kgdb breakpoints only in kernel context - Use num_present_cpus() in alternative patching code - Enable LOCKDEP support - Add lightweight spinlock checks - Flush AGP gatt writes and adjust gatt mask in parisc_agp_mask_memory() - Allow to reboot machine after system halt - Improve cache flushing for PCXL in arch_sync_dma_for_cpu()" * tag 'parisc-for-6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix flush_dcache_page() for usage from irq context parisc: Handle kgdb breakpoints only in kernel context parisc: Handle kprobes breakpoints only in kernel context parisc: Allow to reboot machine after system halt parisc: Enable LOCKDEP support parisc: Add lightweight spinlock checks parisc: Use num_present_cpus() in alternative patching code parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory() parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu() commit 9828ed3f695a138f7add89fa2a186ababceb8006 Author: Linus Torvalds Date: Thu May 25 09:32:25 2023 -0700 module: error out early on concurrent load of the same module file It turns out that udev under certain circumstances will concurrently try to load the same modules over-and-over excessively. This isn't a kernel bug, but it ends up affecting the kernel, to the point that under certain circumstances we can fail to boot, because the kernel uses a lot of memory to read all the module data all at once. Note that it isn't a memory leak, it's just basically a thundering herd problem happening at bootup with a lot of CPUs, with the worst cases then being pretty bad. Admittedly the worst situations are somewhat contrived: lots and lots of CPUs, not a lot of memory, and KASAN enabled to make it all slower and as such (unintentionally) exacerbate the problem. Luis explains: [1] "My best assessment of the situation is that each CPU in udev ends up triggering a load of duplicate set of modules, not just one, but *a lot*. Not sure what heuristics udev uses to load a set of modules per CPU." Petr Pavlu chimes in: [2] "My understanding is that udev workers are forked. An initial kmod context is created by the main udevd process but no sharing happens after the fork. It means that the mentioned memory pool logic doesn't really kick in. Multiple parallel load requests come from multiple udev workers, for instance, each handling an udev event for one CPU device and making the exactly same requests as all others are doing at the same time. The optimization idea would be to recognize these duplicate requests at the udevd/kmod level and converge them" Note that module loading has tried to mitigate this issue before, see for example commit 064f4536d139 ("module: avoid allocation if module is already present and ready"), which has a few ASCII graphs on memory use due to this same issue. However, while that noticed that the module was already loaded, and exited with an error early before spending any more time on setting up the module, it didn't handle the case of multiple concurrent module loads all being active - but not complete - at the same time. Yes, one of them will eventually win the race and finalize its copy, and the others will then notice that the module already exists and error out, but while this all happens, we have tons of unnecessary concurrent work being done. Again, the real fix is for udev to not do that (maybe it should use threads instead of fork, and have actual shared data structures and not cause duplicate work). That real fix is apparently not trivial. But it turns out that the kernel already has a pretty good model for dealing with concurrent access to the same file: the i_writecount of the inode. In fact, the module loading already indirectly uses 'i_writecount' , because 'kernel_file_read()' will in fact do ret = deny_write_access(file); if (ret) return ret; ... allow_write_access(file); around the read of the file data. We do not allow concurrent writes to the file, and return -ETXTBUSY if the file was open for writing at the same time as the module data is loaded from it. And the solution to the reader concurrency problem is to simply extend this "no concurrent writers" logic to simply be "exclusive access". Note that "exclusive" in this context isn't really some absolute thing: it's only exclusion from writers and from other "special readers" that do this writer denial. So we simply introduce a variation of that "deny_write_access()" logic that not only denies write access, but also requires that this is the _only_ such access that denies write access. Which means that you can't start loading a module that is already being loaded as a module by somebody else, or you will get the same -ETXTBSY error that you would get if there were writers around. [ It also means that you can't try to load a currently executing executable as a module, for the same reason: executables do that same "deny_write_access()" thing, and that's obviously where the whole ETXTBSY logic traditionally came from. This is not a problem for kernel modules, since the set of normal executable files and kernel module files is entirely disjoint. ] This new function is called "exclusive_deny_write_access()", and the implementation is trivial, in that it's just an atomic decrement of i_writecount if it was 0 before. To use that new exclusivity check, all we then do is wrap the module loading with that exclusive_deny_write_access()() / allow_write_access() pair. The actual patch is a bit bigger than that, because we want to surround not just the "load file data" part, but the whole module setup, to get maximum exclusion. So this ends up splitting up "finit_module()" into a few helper functions to make it all very clear and legible. In Luis' test-case (bringing up 255 vcpu's in a virtual machine [3]), the "wasted vmalloc" space (ie module data read into a vmalloc'ed area in order to be loaded as a module, but then discarded because somebody else loaded the same module instead) dropped from 1.8GiB to 474kB. Yes, that's gigabytes to kilobytes. It doesn't drop completely to zero, because even with this change, you can still end up having completely serial pointless module loads, where one udev process has loaded a module fully (and thus the kernel has released that exclusive lock on the module file), and then another udev process tries to load the same module again. So while we cannot fully get rid of the fundamental bug in user space, we _can_ get rid of the excessive concurrent thundering herd effect. A couple of final side notes on this all: - This tweak only affects the "finit_module()" system call, which gives the kernel a file descriptor with the module data. You can also just feed the module data as raw data from user space with "init_module()" (note the lack of 'f' at the beginning), and obviously for that case we do _not_ have any "exclusive read" logic. So if you absolutely want to do things wrong in user space, and try to load the same module multiple times, and error out only later when the kernel ends up saying "you can't load the same module name twice", you can still do that. And in fact, some distros will do exactly that, because they will uncompress the kernel module data in user space before feeding it to the kernel (mainly because they haven't started using the new kernel side decompression yet). So this is not some absolute "you can't do concurrent loads of the same module". It's literally just a very simple heuristic that will catch it early in case you try to load the exact same module file at the same time, and in that case avoid a potentially nasty situation. - There is another user of "deny_write_access()": the verity code that enables fs-verity on a file (the FS_IOC_ENABLE_VERITY ioctl). If you use fs-verity and you care about verifying the kernel modules (which does make sense), you should do it *before* loading said kernel module. That may sound obvious, but now the implementation basically requires it. Because if you try to do it concurrently, the kernel may refuse to load the module file that is being set up by the fs-verity code. - This all will obviously mean that if you insist on loading the same module in parallel, only one module load will succeed, and the others will return with an error. That was true before too, but what is different is that the -ETXTBSY error can be returned *before* the success case of another process fully loading and instantiating the module. Again, that might sound obvious, and it is indeed the whole point of the whole change: we are much quicker to notice the whole "you're already in the process of loading this module". So it's very much intentional, but it does mean that if you just spray the kernel with "finit_module()", and expect that the module is immediately loaded afterwards without checking the return value, you are doing something horribly horribly wrong. I'd like to say that that would never happen, but the whole _reason_ for this commit is that udev is currently doing something horribly horribly wrong, so ... Link: https://lore.kernel.org/all/ZEGopJ8VAYnE7LQ2@bombadil.infradead.org/ [1] Link: https://lore.kernel.org/all/23bd0ce6-ef78-1cd8-1f21-0e706a00424a@suse.com/ [2] Link: https://lore.kernel.org/lkml/ZG%2Fa+nrt4%2FAAUi5z@bombadil.infradead.org/ [3] Cc: Greg Kroah-Hartman Cc: Lucas De Marchi Cc: Petr Pavlu Tested-by: Luis Chamberlain Signed-off-by: Linus Torvalds commit 9db898594c541444e19b2d20fb8a06262cf8fcd9 Merge: 50fb587e6a56d 48524463f807e Author: Linus Torvalds Date: Thu May 25 11:03:58 2023 -0700 Merge tag 'vfs/v6.4-rc3/misc.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - During the acl rework we merged this cycle the generic_listxattr() helper had to be modified in a way that in principle it would allow for POSIX ACLs to be reported. At least that was the impression we had initially. Because before the acl rework POSIX ACLs would be reported if the filesystem did have POSIX ACL xattr handlers in sb->s_xattr. That logic changed and now we can simply check whether the superblock has SB_POSIXACL set and if the inode has inode->i_{default_}acl set report the appropriate POSIX ACL name. However, we didn't realize that generic_listxattr() was only ever used by two filesystems. Both of them don't support POSIX ACLs via sb->s_xattr handlers and so never reported POSIX ACLs via generic_listxattr() even if they raised SB_POSIXACL and did contain inodes which had acls set. The example here is nfs4. As a result, generic_listxattr() suddenly started reporting POSIX ACLs when it wouldn't have before. Since SB_POSIXACL implies that the umask isn't stripped in the VFS nfs4 can't just drop SB_POSIXACL from the superblock as it would also alter umask handling for them. So just have generic_listxattr() not report POSIX ACLs as it never did anyway. It's documented as such. - Our SB_* flags currently use a signed integer and we shift the last bit causing UBSAN to complain about undefined behavior. Switch to using unsigned. While the original patch used an explicit unsigned bitshift it's now pretty common to rely on the BIT() macro in a lot of headers nowadays. So the patch has been adjusted to use that. - Add Namjae as ntfs reviewer. They're already active this cycle so let's make it explicit right now. * tag 'vfs/v6.4-rc3/misc.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: ntfs: Add myself as a reviewer fs: don't call posix_acl_listxattr in generic_listxattr fs: fix undefined behavior in bit shift for SB_NOUSER commit 50fb587e6a56dba74c3c56a7a09c48bff25cc5fa Merge: eb03e31813541 ad42a35bdfc6d Author: Linus Torvalds Date: Thu May 25 10:55:26 2023 -0700 Merge tag 'net-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth and bpf. Current release - regressions: - net: fix skb leak in __skb_tstamp_tx() - eth: mtk_eth_soc: fix QoS on DSA MAC on non MTK_NETSYS_V2 SoCs Current release - new code bugs: - handshake: - fix sock->file allocation - fix handshake_dup() ref counting - bluetooth: - fix potential double free caused by hci_conn_unlink - fix UAF in hci_conn_hash_flush Previous releases - regressions: - core: fix stack overflow when LRO is disabled for virtual interfaces - tls: fix strparser rx issues - bpf: - fix many sockmap/TCP related issues - fix a memory leak in the LRU and LRU_PERCPU hash maps - init the offload table earlier - eth: mlx5e: - do as little as possible in napi poll when budget is 0 - fix using eswitch mapping in nic mode - fix deadlock in tc route query code Previous releases - always broken: - udplite: fix NULL pointer dereference in __sk_mem_raise_allocated() - raw: fix output xfrm lookup wrt protocol - smc: reset connection when trying to use SMCRv2 fails - phy: mscc: enable VSC8501/2 RGMII RX clock - eth: octeontx2-pf: fix TSOv6 offload - eth: cdc_ncm: deal with too low values of dwNtbOutMaxSize" * tag 'net-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits) udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). net: phy: mscc: enable VSC8501/2 RGMII RX clock net: phy: mscc: remove unnecessary phydev locking net: phy: mscc: add support for VSC8501 net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE net/handshake: Enable the SNI extension to work properly net/handshake: Unpin sock->file if a handshake is cancelled net/handshake: handshake_genl_notify() shouldn't ignore @flags net/handshake: Fix uninitialized local variable net/handshake: Fix handshake_dup() ref counting net/handshake: Remove unneeded check from handshake_dup() ipv6: Fix out-of-bounds access in ipv6_find_tlv() net: ethernet: mtk_eth_soc: fix QoS on DSA MAC on non MTK_NETSYS_V2 SoCs docs: netdev: document the existence of the mail bot net: fix skb leak in __skb_tstamp_tx() r8169: Use a raw_spinlock_t for the register locks. page_pool: fix inconsistency for page_pool_ring_[un]lock() bpf, sockmap: Test progs verifier error with latest clang bpf, sockmap: Test FIONREAD returns correct bytes in rx buffer with drops bpf, sockmap: Test FIONREAD returns correct bytes in rx buffer ... commit edc0a2b5957652f4685ef3516f519f84807087db Author: Zhang Rui Date: Thu Mar 23 09:56:40 2023 +0800 x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms Traditionally, all CPUs in a system have identical numbers of SMT siblings. That changes with hybrid processors where some logical CPUs have a sibling and others have none. Today, the CPU boot code sets the global variable smp_num_siblings when every CPU thread is brought up. The last thread to boot will overwrite it with the number of siblings of *that* thread. That last thread to boot will "win". If the thread is a Pcore, smp_num_siblings == 2. If it is an Ecore, smp_num_siblings == 1. smp_num_siblings describes if the *system* supports SMT. It should specify the maximum number of SMT threads among all cores. Ensure that smp_num_siblings represents the system-wide maximum number of siblings by always increasing its value. Never allow it to decrease. On MeteorLake-P platform, this fixes a problem that the Ecore CPUs are not updated in any cpu sibling map because the system is treated as an UP system when probing Ecore CPUs. Below shows part of the CPU topology information before and after the fix, for both Pcore and Ecore CPU (cpu0 is Pcore, cpu 12 is Ecore). ... -/sys/devices/system/cpu/cpu0/topology/package_cpus:000fff -/sys/devices/system/cpu/cpu0/topology/package_cpus_list:0-11 +/sys/devices/system/cpu/cpu0/topology/package_cpus:3fffff +/sys/devices/system/cpu/cpu0/topology/package_cpus_list:0-21 ... -/sys/devices/system/cpu/cpu12/topology/package_cpus:001000 -/sys/devices/system/cpu/cpu12/topology/package_cpus_list:12 +/sys/devices/system/cpu/cpu12/topology/package_cpus:3fffff +/sys/devices/system/cpu/cpu12/topology/package_cpus_list:0-21 Notice that the "before" 'package_cpus_list' has only one CPU. This means that userspace tools like lscpu will see a little laptop like an 11-socket system: -Core(s) per socket: 1 -Socket(s): 11 +Core(s) per socket: 16 +Socket(s): 1 This is also expected to make the scheduler do rather wonky things too. [ dhansen: remove CPUID detail from changelog, add end user effects ] CC: stable@kernel.org Fixes: bbb65d2d365e ("x86: use cpuid vector 0xb when available for detecting cpu topology") Fixes: 95f3d39ccf7a ("x86/cpu/topology: Provide detect_extended_topology_early()") Suggested-by: Len Brown Signed-off-by: Zhang Rui Signed-off-by: Dave Hansen Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20230323015640.27906-1-rui.zhang%40intel.com commit 3bf8c6307bad5c0cc09cde982e146d847859b651 Author: Wyes Karny Date: Thu May 18 05:58:19 2023 +0000 cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf() Driver should update policy->cur after updating the frequency. Currently amd_pstate doesn't update policy->cur when `adjust_perf` is used. Which causes /proc/cpuinfo to show wrong cpu frequency. Fix this by updating policy->cur with correct frequency value in adjust_perf function callback. - Before the fix: (setting min freq to 1.5 MHz) [root@amd]# cat /proc/cpuinfo | grep "cpu MHz" | sort | uniq --count 1 cpu MHz : 1777.016 1 cpu MHz : 1797.160 1 cpu MHz : 1797.270 189 cpu MHz : 400.000 - After the fix: (setting min freq to 1.5 MHz) [root@amd]# cat /proc/cpuinfo | grep "cpu MHz" | sort | uniq --count 1 cpu MHz : 1753.353 1 cpu MHz : 1756.838 1 cpu MHz : 1776.466 1 cpu MHz : 1776.873 1 cpu MHz : 1777.308 1 cpu MHz : 1779.900 183 cpu MHz : 1805.231 1 cpu MHz : 1956.815 1 cpu MHz : 2246.203 1 cpu MHz : 2259.984 Fixes: 1d215f0319c2 ("cpufreq: amd-pstate: Add fast switch function for AMD P-State") Signed-off-by: Wyes Karny [ rjw: Subject edits ] Cc: 5.17+ # 5.17+ Signed-off-by: Rafael J. Wysocki commit b78c77273a5648eddc02f275f582b681a5127711 Author: Abhinav Kumar Date: Thu Apr 27 16:28:47 2023 -0700 drm/msm/dp: add module parameter for PSR On sc7280 where eDP is the primary display, PSR is causing IGT breakage even for basic test cases like kms_atomic and kms_atomic_transition. Most often the issue starts with below stack so providing that as reference Call trace: dpu_encoder_assign_crtc+0x64/0x6c dpu_crtc_enable+0x188/0x204 drm_atomic_helper_commit_modeset_enables+0xc0/0x274 msm_atomic_commit_tail+0x1a8/0x68c commit_tail+0xb0/0x160 drm_atomic_helper_commit+0x11c/0x124 drm_atomic_commit+0xb0/0xdc drm_atomic_connector_commit_dpms+0xf4/0x110 drm_mode_obj_set_property_ioctl+0x16c/0x3b0 drm_connector_property_set_ioctl+0x4c/0x74 drm_ioctl_kernel+0xec/0x15c drm_ioctl+0x264/0x408 __arm64_sys_ioctl+0x9c/0xd4 invoke_syscall+0x4c/0x110 el0_svc_common+0x94/0xfc do_el0_svc+0x3c/0xb0 el0_svc+0x2c/0x7c el0t_64_sync_handler+0x48/0x114 el0t_64_sync+0x190/0x194 ---[ end trace 0000000000000000 ]--- [drm-dp] dp_ctrl_push_idle: PUSH_IDLE pattern timedout Other basic use-cases still seem to work fine hence add a a module parameter to allow toggling psr enable/disable till PSR related issues are hashed out with IGT. Signed-off-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Acked-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/534420/ Link: https://lore.kernel.org/r/20230427232848.5200-1-quic_abhinavk@quicinc.com Signed-off-by: Rob Clark commit 173d42721b4661327bf4dd8301714417695506c2 Author: Rob Clark Date: Mon May 1 13:44:41 2023 -0700 drm/msm: Set max segment size earlier Fixes the following splat on a6xx gen2+ (a640, a650, a660 families), a6xx gen1 has smaller GMU allocations so they fit under the default 64K max segment size. ------------[ cut here ]------------ DMA-API: msm_dpu ae01000.display-controller: mapping sg segment longer than device claims to support [len=126976] [max=65536] WARNING: CPU: 5 PID: 9 at kernel/dma/debug.c:1160 debug_dma_map_sg+0x288/0x314 Modules linked in: CPU: 5 PID: 9 Comm: kworker/u16:0 Not tainted 6.3.0-rc2-debug+ #629 Hardware name: Google Villager (rev1+) with LTE (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : debug_dma_map_sg+0x288/0x314 lr : debug_dma_map_sg+0x288/0x314 sp : ffffffc00809b560 x29: ffffffc00809b560 x28: 0000000000000060 x27: 0000000000000000 x26: 0000000000010000 x25: 0000000000000004 x24: 0000000000000004 x23: ffffffffffffffff x22: ffffffdb31693cc0 x21: ffffff8080935800 x20: ffffff8087417400 x19: ffffff8087a45010 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000010000 x14: 0000000000000001 x13: ffffffffffffffff x12: ffffffffffffffff x11: 0000000000000000 x10: 000000000000000a x9 : ffffffdb2ff05e14 x8 : ffffffdb31275000 x7 : ffffffdb2ff08908 x6 : 0000000000000000 x5 : 0000000000000001 x4 : ffffffdb2ff08a74 x3 : ffffffdb31275008 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff80803a9a80 Call trace: debug_dma_map_sg+0x288/0x314 __dma_map_sg_attrs+0x80/0xe4 dma_map_sgtable+0x30/0x4c get_pages+0x1d4/0x1e4 msm_gem_pin_pages_locked+0xbc/0xf8 msm_gem_pin_vma_locked+0x58/0xa0 msm_gem_get_and_pin_iova_range+0x98/0xac a6xx_gmu_memory_alloc+0x7c/0x128 a6xx_gmu_init+0x16c/0x9b0 a6xx_gpu_init+0x38c/0x3e4 adreno_bind+0x214/0x264 component_bind_all+0x128/0x1f8 msm_drm_bind+0x2b8/0x608 try_to_bring_up_aggregate_device+0x88/0x1a4 __component_add+0xec/0x13c component_add+0x1c/0x28 dp_display_probe+0x3f8/0x43c platform_probe+0x70/0xc4 really_probe+0x148/0x280 __driver_probe_device+0xc8/0xe0 driver_probe_device+0x44/0x100 __device_attach_driver+0x64/0xdc bus_for_each_drv+0xb0/0xd8 __device_attach+0xd8/0x168 device_initial_probe+0x1c/0x28 bus_probe_device+0x44/0xb0 deferred_probe_work_func+0xc8/0xe0 process_one_work+0x2e0/0x488 process_scheduled_works+0x4c/0x50 worker_thread+0x218/0x274 kthread+0xf0/0x100 ret_from_fork+0x10/0x20 irq event stamp: 293712 hardirqs last enabled at (293711): [] vprintk_emit+0x160/0x25c hardirqs last disabled at (293712): [] el1_dbg+0x24/0x80 softirqs last enabled at (279520): [] __do_softirq+0x21c/0x4bc softirqs last disabled at (279515): [] ____do_softirq+0x18/0x24 ---[ end trace 0000000000000000 ]--- Signed-off-by: Rob Clark Fixes: db735fc4036b ("drm/msm: Set dma maximum segment size for mdss") Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/534892/ Link: https://lore.kernel.org/r/20230501204441.1642741-1-robdclark@gmail.com commit eb03e318135419b8b781f83cdfa7dbb9252afad6 Merge: 029c77f89a15e 95339f40a8b65 Author: Linus Torvalds Date: Thu May 25 10:26:36 2023 -0700 Merge tag 'for-v6.4-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply fixes from Sebastian Reichel: - Fix power_supply_get_battery_info for devices without parent devices resulting in NULL pointer dereference - Fix desktop systems reporting to run on battery once a power-supply device with device scope appears (e.g. a HID keyboard with a battery) - Ratelimit debug print about driver not providing data - Fix race condition related to external_power_changed in multiple drivers (ab8500, axp288, bq25890, sc27xx, bq27xxx) - Fix LED trigger switching from blinking to solid-on when charging finishes - Fix multiple races in bq27xxx battery driver - mt6360: handle potential ENOMEM from devm_work_autocancel - sbs-charger: Fix SBS_CHARGER_STATUS_CHARGE_INHIBITED bit - rt9467: avoid passing 0 to dev_err_probe * tag 'for-v6.4-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (21 commits) power: supply: Fix logic checking if system is running from battery power: supply: mt6360: add a check of devm_work_autocancel in mt6360_charger_probe power: supply: sbs-charger: Fix INHIBITED bit for Status reg power: supply: rt9467: Fix passing zero to 'dev_err_probe' power: supply: Ratelimit no data debug output power: supply: Fix power_supply_get_battery_info() if parent is NULL power: supply: bq24190: Call power_supply_changed() after updating input current power: supply: bq25890: Call power_supply_changed() after updating input current or voltage power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes power: supply: bq27xxx: Move bq27xxx_battery_update() down power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status() power: supply: bq27xxx: Fix poll_interval handling and races on remove power: supply: bq27xxx: Fix I2C IRQ race on remove power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition power: supply: leds: Fix blink to LED on transition power: supply: sc27xx: Fix external_power_changed race power: supply: bq25890: Fix external_power_changed race power: supply: axp288_fuel_gauge: Fix external_power_changed race ... commit 029c77f89a15e0e2f209ac5be9ec1d9672b8b09a Merge: ecea3ba2fba21 4ca110cab4656 Author: Linus Torvalds Date: Thu May 25 09:48:23 2023 -0700 Merge tag 'sound-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes: - HD-audio runtime PM bug fix - A couple of HD-audio quirks - Fix series of ASoC Intel AVS drivers - ASoC DPCM fix for a bug found on new Intel systems - A few other ASoC device-specific small fixes" * tag 'sound-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Enable headset onLenovo M70/M90 ASoC: dwc: move DMA init to snd_soc_dai_driver probe() ASoC: cs35l41: Fix default regmap values for some registers ALSA: hda: Fix unhandled register update during auto-suspend period ASoC: dt-bindings: tlv320aic32x4: Fix supply names ASoC: Intel: avs: Add missing checks on FE startup ASoC: Intel: avs: Fix avs_path_module::instance_id size ASoC: Intel: avs: Account for UID of ACPI device ASoC: Intel: avs: Fix declaration of enum avs_channel_config ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg ASoC: Intel: avs: Access path components under lock ASoC: Intel: avs: Fix module lookup ALSA: hda/ca0132: add quirk for EVGA X299 DARK ASoC: soc-pcm: test if a BE can be prepared ASoC: rt5682: Disable jack detection interrupt during suspend ASoC: lpass: Fix for KASAN use_after_free out of bounds commit ecea3ba2fba2124c8bdc87b27b3829a6015ff854 Merge: 5566051fa6735 3279decb2c3c8 Author: Linus Torvalds Date: Thu May 25 09:42:15 2023 -0700 Merge tag 'platform-drivers-x86-v6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Nothing special to report just a few small fixes" * tag 'platform-drivers-x86-v6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/intel/ifs: Annotate work queue on stack so object debug does not complain platform/x86: ISST: Remove 8 socket limit platform/mellanox: mlxbf-pmc: fix sscanf() error checking platform/x86/amd/pmf: Fix CnQF and auto-mode after resume platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 commit 5566051fa67352af069e0eb4b047f2b832b9a1cc Merge: 933174ae28ba7 b845b574f86dc Author: Linus Torvalds Date: Thu May 25 09:33:03 2023 -0700 Merge tag 'm68k-for-v6.4-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fix from Geert Uytterhoeven: - Fix signal frame issue causing user-space crashes on 68020/68030 * tag 'm68k-for-v6.4-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Move signal frame following exception on 68020/030 commit 533ab73f5b5c95dcb4152b52d5482abcc824c690 Author: Wenwen Chen Date: Thu May 25 16:26:26 2023 +0800 io_uring: unlock sqd->lock before sq thread release CPU The sq thread actively releases CPU resources by calling the cond_resched() and schedule() interfaces when it is idle. Therefore, more resources are available for other threads to run. There exists a problem in sq thread: it does not unlock sqd->lock before releasing CPU resources every time. This makes other threads pending on sqd->lock for a long time. For example, the following interfaces all require sqd->lock: io_sq_offload_create(), io_register_iowq_max_workers() and io_ring_exit_work(). Before the sq thread releases CPU resources, unlocking sqd->lock will provide the user a better experience because it can respond quickly to user requests. Signed-off-by: Kanchan Joshi Signed-off-by: Wenwen Chen Link: https://lore.kernel.org/r/20230525082626.577862-1-wenwen.chen@samsung.com Signed-off-by: Jens Axboe commit 51bba254edc79fbb1b04e207e036c0c68576f1a4 Author: Conor Dooley Date: Mon May 22 10:37:01 2023 +0100 MAINTAINERS: update arm64 Microchip entries Krzysztof noticed that patches for arch/arm64/boot/dts/microchip were getting lost & the listed tree was inactive. Nicolas and I are willing to shepherd patches to Arnd, using the existing at91 tree, so add a new entry covering arch/arm64/boot/dts/microchip, listing us as maintainers. Drop the tree from the existing sparx5 entry & narrow the devicetree pattern to just sparx devices, leaving Lars, Steen and Daniel looking after support for their SoCs. CC: Rob Herring CC: Krzysztof Kozlowski CC: Conor Dooley CC: Nicolas Ferre CC: Claudiu Beznea CC: soc@kernel.org CC: Lars Povlsen CC: Steen Hegelund CC: Daniel Machon Signed-off-by: Conor Dooley Acked-by: Nicolas Ferre Acked-by: Steen Hegelund Acked-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230522-wagon-stencil-a164ec39322a@wendy Signed-off-by: Arnd Bergmann commit 66bbb329788c5e3dd79b73292536edf8b55558d9 Merge: 0bfa36f9bc665 0f554e37dad41 Author: Arnd Bergmann Date: Thu May 25 17:22:37 2023 +0200 Merge tag 'imx-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.4: - A couple of i.MX8MN/P video clock changes from Adam Ford to fix issue with clock re-parenting. - Add missing pvcie-supply regulator for imx6qdl-mba6 board. - A series of colibri-imx8x board fixes on pin configuration. - Set and limit the mode for PMIC bucks for imx6ull-dhcor board to fix stability problems. - A couple of changes from Frank Li to correct cdns,usb3 bindings cdns,on-chip-buff-size property and fix USB 3.0 gadget failure on i.MX8QM & QXPB0. - Add a required PHY deassert delay for imx8mn-var-som board to fix PHY detection failure. * tag 'imx-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8: fix USB 3.0 Gadget Failure in QM & QXPB0 at super speed dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type arm64: dts: colibri-imx8x: delete adc1 and dsp arm64: dts: colibri-imx8x: fix iris pinctrl configuration arm64: dts: colibri-imx8x: move pinctrl property from SoM to eval board arm64: dts: colibri-imx8x: fix eval board pin configuration arm64: dts: imx8mp: Fix video clock parents ARM: dts: imx6qdl-mba6: Add missing pvcie-supply regulator ARM: dts: imx6ull-dhcor: Set and limit the mode for PMIC buck 1, 2 and 3 arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay arm64: dts: imx8mn: Fix video clock parents Link: https://lore.kernel.org/r/20230516133625.GI767028@dragon Signed-off-by: Arnd Bergmann commit 0bfa36f9bc6651806f57d7fb8513d9b2448a1ad1 Merge: d14b555c3354c 44e8d5ad2dc01 Author: Arnd Bergmann Date: Thu May 25 17:21:36 2023 +0200 Merge tag 'scmi-fix-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI fix for v6.4 Single fix for incorrect invocation of alloc_workqueue() where WQ_SYSFS flag is passed as @max_active parameter instead of OR'ing with the other flags in the @flags parameter. * tag 'scmi-fix-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix incorrect alloc_workqueue() invocation Link: https://lore.kernel.org/r/20230509143529.1188812-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit d14b555c3354c4b2b305cc005a1f1626f6c02b07 Merge: 9bafc2bb469ce 55b37d9c8ba23 Author: Arnd Bergmann Date: Thu May 25 17:19:06 2023 +0200 Merge tag 'juno-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FVP/Vexpress fixes for v6.4 Couple of fixes to address the missing required 'cache-unified' property in the level 2 and 3 caches on some of the FVP/vexpress platforms. * tag 'juno-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: arm: add missing cache properties ARM: dts: vexpress: add missing cache properties Link: https://lore.kernel.org/r/20230509143508.1188786-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 9bafc2bb469ce62de611adf4eb37ca68786453e7 Merge: 44c026a73be80 654d031000714 Author: Arnd Bergmann Date: Thu May 25 17:16:45 2023 +0200 Merge tag 'optee-async-notif-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Fixes an uninitialized variable in OP-TEE driver * tag 'optee-async-notif-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee: optee: fix uninited async notif value Link: https://lore.kernel.org/r/20230421075443.GA3136581@rayden Signed-off-by: Arnd Bergmann commit ad42a35bdfc6d3c0fc4cb4027d7b2757ce665665 Author: Kuniyuki Iwashima Date: Tue May 23 09:33:05 2023 -0700 udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). syzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using IPPROTO_UDPLITE (0x88): 14:25:52 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x88) We had a similar report [1] for probably sk_memory_allocated_add() in __sk_mem_raise_allocated(), and commit c915fe13cbaa ("udplite: fix NULL pointer dereference") fixed it by setting .memory_allocated for udplite_prot and udplitev6_prot. To fix the variant, we need to set either .sysctl_wmem_offset or .sysctl_rmem. Now UDP and UDPLITE share the same value for .memory_allocated, so we use the same .sysctl_wmem_offset for UDP and UDPLITE. [0]: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 6829 Comm: syz-executor.1 Not tainted 6.4.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 RIP: 0010:sk_get_rmem0 include/net/sock.h:2907 [inline] RIP: 0010:__sk_mem_raise_allocated+0x806/0x17a0 net/core/sock.c:3006 Code: c1 ea 03 80 3c 02 00 0f 85 23 0f 00 00 48 8b 44 24 08 48 8b 98 38 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 0f 8d 6f 0a 00 00 8b RSP: 0018:ffffc90005d7f450 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004d92000 RDX: 0000000000000000 RSI: ffffffff88066482 RDI: ffffffff8e2ccbb8 RBP: ffff8880173f7000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000030000 R13: 0000000000000001 R14: 0000000000000340 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9800000(0063) knlGS:00000000f7f1cb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002e82f000 CR3: 0000000034ff0000 CR4: 00000000003506f0 Call Trace: __sk_mem_schedule+0x6c/0xe0 net/core/sock.c:3077 udp_rmem_schedule net/ipv4/udp.c:1539 [inline] __udp_enqueue_schedule_skb+0x776/0xb30 net/ipv4/udp.c:1581 __udpv6_queue_rcv_skb net/ipv6/udp.c:666 [inline] udpv6_queue_rcv_one_skb+0xc39/0x16c0 net/ipv6/udp.c:775 udpv6_queue_rcv_skb+0x194/0xa10 net/ipv6/udp.c:793 __udp6_lib_mcast_deliver net/ipv6/udp.c:906 [inline] __udp6_lib_rcv+0x1bda/0x2bd0 net/ipv6/udp.c:1013 ip6_protocol_deliver_rcu+0x2e7/0x1250 net/ipv6/ip6_input.c:437 ip6_input_finish+0x150/0x2f0 net/ipv6/ip6_input.c:482 NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ip6_input+0xa0/0xd0 net/ipv6/ip6_input.c:491 ip6_mc_input+0x40b/0xf50 net/ipv6/ip6_input.c:585 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ipv6_rcv+0x250/0x380 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5491 __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5605 netif_receive_skb_internal net/core/dev.c:5691 [inline] netif_receive_skb+0x133/0x7a0 net/core/dev.c:5750 tun_rx_batched+0x4b3/0x7a0 drivers/net/tun.c:1553 tun_get_user+0x2452/0x39c0 drivers/net/tun.c:1989 tun_chr_write_iter+0xdf/0x200 drivers/net/tun.c:2035 call_write_iter include/linux/fs.h:1868 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x945/0xd50 fs/read_write.c:584 ksys_write+0x12b/0x250 fs/read_write.c:637 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 RIP: 0023:0xf7f21579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f7f1c590 EFLAGS: 00000282 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000020000040 RDX: 0000000000000083 RSI: 00000000f734e000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: Link: https://lore.kernel.org/netdev/CANaxB-yCk8hhP68L4Q2nFOJht8sqgXGGQO2AftpHs0u1xyGG5A@mail.gmail.com/ [1] Fixes: 850cbaddb52d ("udp: use it's own memory accounting schema") Reported-by: syzbot+444ca0907e96f7c5e48b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=444ca0907e96f7c5e48b Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230523163305.66466-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni commit fd936fd8ac105ba3eb764185e8ba483c789c893e Author: Arnd Bergmann Date: Tue May 23 21:01:30 2023 +0200 efi: fix missing prototype warnings The cper.c file needs to include an extra header, and efi_zboot_entry needs an extern declaration to avoid these 'make W=1' warnings: drivers/firmware/efi/libstub/zboot.c:65:1: error: no previous prototype for 'efi_zboot_entry' [-Werror=missing-prototypes] drivers/firmware/efi/efi.c:176:16: error: no previous prototype for 'efi_attr_is_visible' [-Werror=missing-prototypes] drivers/firmware/efi/cper.c:626:6: error: no previous prototype for 'cper_estatus_print' [-Werror=missing-prototypes] drivers/firmware/efi/cper.c:649:5: error: no previous prototype for 'cper_estatus_check_header' [-Werror=missing-prototypes] drivers/firmware/efi/cper.c:662:5: error: no previous prototype for 'cper_estatus_check' [-Werror=missing-prototypes] To make this easier, move the cper specific declarations to include/linux/cper.h. Signed-off-by: Arnd Bergmann Acked-by: Rafael J. Wysocki Signed-off-by: Ard Biesheuvel commit 095aabe338d166f3a9c87bcc9b9b84ba80fdaddf Author: Ard Biesheuvel Date: Mon May 22 08:24:49 2023 +0200 efi/libstub: zboot: Avoid eager evaluation of objcopy flags The Make variable containing the objcopy flags may be constructed from the output of build tools operating on build artifacts, and these may not exist when doing a make clean. So avoid evaluating them eagerly, to prevent spurious build warnings. Suggested-by: Pedro Falcato Tested-by: Alan Bartlett Signed-off-by: Ard Biesheuvel commit aa015a204b6094f909ee9863cd41e50b426dea7d Merge: 1de5900c816a9 71460c9ec5c74 Author: Jakub Kicinski Date: Wed May 24 22:14:29 2023 -0700 Merge branch 'net-phy-mscc-support-vsc8501' David Epping says: ==================== net: phy: mscc: support VSC8501 this updated series of patches adds support for the VSC8501 Ethernet PHY and fixes support for the VSC8502 PHY in cases where no other software (like U-Boot) has initialized the PHY after power up. The first patch simply adds the VSC8502 to the MODULE_DEVICE_TABLE, where I guess it was unintentionally missing. I have no hardware to test my change. The second patch adds the VSC8501 PHY with exactly the same driver implementation as the existing VSC8502. The (new) third patch removes phydev locking from vsc85xx_rgmii_set_skews(), as discussed for v2 of the patch set. The (now) fourth patch fixes the initialization for VSC8501 and VSC8502. I have tested this patch with VSC8501 on hardware in RGMII mode only. https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/DataSheets/VSC8501-03_Datasheet_60001741A.PDF https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/DataSheets/VSC8502-03_Datasheet_60001742B.pdf Table 4-42 "RGMII CONTROL, ADDRESS 20E2 (0X14)" Bit 11 for each of them. By default the RX_CLK is disabled for these PHYs. In cases where no other software, like U-Boot, enabled the clock, this results in no received packets being handed to the MAC. The patch enables this clock output. According to Microchip support (case number 01268776) this applies to all modes (RGMII, GMII, and MII). Other PHYs sharing the same register map and code, like VSC8530/31/40/41 have the clock enabled and the relevant bit 11 is reserved and read-only for them. As per previous discussion the patch still clears the bit on these PHYs, too, possibly more easily supporting other future PHYs implementing this functionality. For the VSC8572 family of PHYs, having a different register map, no such changes are applied. ==================== Link: https://lore.kernel.org/r/20230523153108.18548-1-david.epping@missinglinkelectronics.com Signed-off-by: Jakub Kicinski commit 71460c9ec5c743e9ffffca3c874d66267c36345e Author: David Epping Date: Tue May 23 17:31:08 2023 +0200 net: phy: mscc: enable VSC8501/2 RGMII RX clock By default the VSC8501 and VSC8502 RGMII/GMII/MII RX_CLK output is disabled. To allow packet forwarding towards the MAC it needs to be enabled. For other PHYs supported by this driver the clock output is enabled by default. Fixes: d3169863310d ("net: phy: mscc: add support for VSC8502") Signed-off-by: David Epping Reviewed-by: Russell King (Oracle) Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 7df0b33d7993338a06e4039ec025bb67851ee41d Author: David Epping Date: Tue May 23 17:31:07 2023 +0200 net: phy: mscc: remove unnecessary phydev locking Holding the struct phy_device (phydev) lock is unnecessary when accessing phydev->interface in the PHY driver .config_init method, which is the only place that vsc85xx_rgmii_set_skews() is called from. The phy_modify_paged() function implements required MDIO bus level locking, which can not be achieved by a phydev lock. Signed-off-by: David Epping Reviewed-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit fb055ce4a9e3a115f5dc42011a97cf0cfc7820e4 Author: David Epping Date: Tue May 23 17:31:06 2023 +0200 net: phy: mscc: add support for VSC8501 The VSC8501 PHY can use the same driver implementation as the VSC8502. Adding the PHY ID and copying the handler functions of VSC8502 is sufficient to operate it. Signed-off-by: David Epping Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 57fb54ab9f6945e204740b696bd4cee61ee04e5e Author: David Epping Date: Tue May 23 17:31:05 2023 +0200 net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE The mscc driver implements support for VSC8502, so its ID should be in the MODULE_DEVICE_TABLE for automatic loading. Signed-off-by: David Epping Fixes: d3169863310d ("net: phy: mscc: add support for VSC8502") Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 1de5900c816a9535cf2e18a6bb19832facff8275 Merge: 0c615f1cc3b33 26fb5480a27d3 Author: Jakub Kicinski Date: Wed May 24 22:05:25 2023 -0700 Merge branch 'bug-fixes-for-net-handshake' Chuck Lever says: ==================== Bug fixes for net/handshake Paolo observed that there is a possible leak of sock->file. I haven't looked into that yet, but it seems to be separate from the fixes in this series, so no need to hold these up. ==================== The submissions mentions net-next but it means netdev (perhaps merge window left over when trees are converged). In any case, it should have gone into net, but was instead applied to net-next as commit deb2e484baf9 ("Merge branch 'net-handshake-fixes'"). These are fixes tho, and Chuck needs them to make progress with the client so double-merging them into net... it is what it is :( Link: https://lore.kernel.org/r/168381978252.84244.1933636428135211300.stgit@91.116.238.104.host.secureserver.net Signed-off-by: Jakub Kicinski commit 26fb5480a27d34975cc2b680b77af189620dd740 Author: Chuck Lever Date: Thu May 11 11:49:50 2023 -0400 net/handshake: Enable the SNI extension to work properly Enable the upper layer protocol to specify the SNI peername. This avoids the need for tlshd to use a DNS lookup, which can return a hostname that doesn't match the incoming certificate's SubjectName. Fixes: 2fd5532044a8 ("net/handshake: Add a kernel API for requesting a TLSv1.3 handshake") Reviewed-by: Simon Horman Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 1ce77c998f0415d7d9d91cb9bd7665e25c8f75f1 Author: Chuck Lever Date: Thu May 11 11:49:17 2023 -0400 net/handshake: Unpin sock->file if a handshake is cancelled If user space never calls DONE, sock->file's reference count remains elevated. Enable sock->file to be freed eventually in this case. Reported-by: Jakub Kacinski Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit fc490880e39d86c65ab2bcbd357af1950fa55e48 Author: Chuck Lever Date: Thu May 11 11:48:45 2023 -0400 net/handshake: handshake_genl_notify() shouldn't ignore @flags Reported-by: Dan Carpenter Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Reviewed-by: Simon Horman Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 7afc6d0a107ffbd448c96eb2458b9e64a5af7860 Author: Chuck Lever Date: Thu May 11 11:48:13 2023 -0400 net/handshake: Fix uninitialized local variable trace_handshake_cmd_done_err() simply records the pointer in @req, so initializing it to NULL is sufficient and safe. Reported-by: Dan Carpenter Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Reviewed-by: Simon Horman Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 7ea9c1ec66bc099b0bfba961a8a46dfe25d7d8e4 Author: Chuck Lever Date: Thu May 11 11:47:40 2023 -0400 net/handshake: Fix handshake_dup() ref counting If get_unused_fd_flags() fails, we ended up calling fput(sock->file) twice. Reported-by: Dan Carpenter Suggested-by: Paolo Abeni Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit a095326e2c0f33743ce8e887d5b90edf3f36cced Author: Chuck Lever Date: Thu May 11 11:47:09 2023 -0400 net/handshake: Remove unneeded check from handshake_dup() handshake_req_submit() now verifies that the socket has a file. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Reviewed-by: Simon Horman Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 0c615f1cc3b333775b9c0b56e369f8dbca1e0226 Merge: 878ecb0897f47 f726e03564ef4 Author: Jakub Kicinski Date: Wed May 24 21:57:57 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-05-24 We've added 19 non-merge commits during the last 10 day(s) which contain a total of 20 files changed, 738 insertions(+), 448 deletions(-). The main changes are: 1) Batch of BPF sockmap fixes found when running against NGINX TCP tests, from John Fastabend. 2) Fix a memleak in the LRU{,_PERCPU} hash map when bucket locking fails, from Anton Protopopov. 3) Init the BPF offload table earlier than just late_initcall, from Jakub Kicinski. 4) Fix ctx access mask generation for 32-bit narrow loads of 64-bit fields, from Will Deacon. 5) Remove a now unsupported __fallthrough in BPF samples, from Andrii Nakryiko. 6) Fix a typo in pkg-config call for building sign-file, from Jeremy Sowden. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, sockmap: Test progs verifier error with latest clang bpf, sockmap: Test FIONREAD returns correct bytes in rx buffer with drops bpf, sockmap: Test FIONREAD returns correct bytes in rx buffer bpf, sockmap: Test shutdown() correctly exits epoll and recv()=0 bpf, sockmap: Build helper to create connected socket pair bpf, sockmap: Pull socket helpers out of listen test for general use bpf, sockmap: Incorrectly handling copied_seq bpf, sockmap: Wake up polling after data copy bpf, sockmap: TCP data stall on recv before accept bpf, sockmap: Handle fin correctly bpf, sockmap: Improved check for empty queue bpf, sockmap: Reschedule is now done through backlog bpf, sockmap: Convert schedule_work into delayed_work bpf, sockmap: Pass skb ownership through read_skb bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields samples/bpf: Drop unnecessary fallthrough bpf: netdev: init the offload table earlier selftests/bpf: Fix pkg-config call building sign-file ==================== Link: https://lore.kernel.org/r/20230524170839.13905-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 661a4f089317c877aecd598fb70cd46510cc8d29 Author: Konrad Dybcio Date: Wed May 17 04:18:50 2023 +0200 arm64: dts: qcom: sm8550: Use the correct LLCC register scheme During the ABI-breaking (for good reasons) conversion of the LLCC register description, SM8550 was not taken into account, resulting in LLCC being broken on any kernel containing the patch referenced in the fixes tag. Fix it by describing the regions properly. Fixes: ee13b5008707 ("qcom: llcc/edac: Fix the base address used for accessing LLCC banks") Signed-off-by: Konrad Dybcio Acked-by: Manivannan Sadhasivam Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230517-topic-kailua-llcc-v1-2-d57bd860c43e@linaro.org commit b317cebff59d9994ba041240654acb3c06b2f1f0 Author: Konrad Dybcio Date: Wed May 17 04:18:49 2023 +0200 dt-bindings: cache: qcom,llcc: Fix SM8550 description SM8550 (LLCCv4.1) has 4 register regions, this was not described between its addition and the restructurization that happened in the commit referenced in the fixes tag. Fix it. Fixes: 43aa006e074c ("dt-bindings: arm: msm: Fix register regions used for LLCC banks") Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Acked-by: Manivannan Sadhasivam Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230517-topic-kailua-llcc-v1-1-d57bd860c43e@linaro.org commit 3a735530c159b75e1402c08abe1ba4eb99a1f7a3 Author: Douglas Anderson Date: Mon May 15 17:19:29 2023 -0700 arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards In general, the three SKUs of sc7180 (lite, normal, and pro) are handled dynamically. The cpufreq table in sc7180.dtsi includes the superset of all CPU frequencies. The "qcom-cpufreq-hw" driver in Linux shows that we can dynamically detect which frequencies are actually available on the currently running CPU and then we can just enable those ones. The GPU is similarly dynamic. The nvmem has a fuse in it (see "gpu_speed_bin" in sc7180.dtsi) that the GPU driver can use to figure out which frequencies to enable. There is one part, however, that is not so dynamic. The way SDRAM frequency works in sc7180 is that it's tied to cpufreq. At the busiest cpufreq operating points we'll pick the top supported SDRAM frequency. They ramp down together. For the "pro" SKU of sc7180, we only enable one extra cpufreq step. That extra cpufreq step runs SDRAM at the same speed as the step below. Thus, for normal and pro things are OK. There is no sc7180-pro device tree snippet. For the "lite" SKU if sc7180, however, things aren't so easy. The "lite" SKU drops 3 cpufreq entries but can still run SDRAM at max frequency. That messed things up with the whole scheme. This is why we added the "sc7180-lite" fragment in commit 8fd01e01fd6f ("arm64: dts: qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite"). When the lite scheme came about, it was agreed that the WiFi SKUs of lazor would _always_ be "lite" and would, in fact, be the only "lite" devices. Unfortunately, this decision changed and folks didn't realize that it would be a problem. Specifically, some later lazor WiFi-only devices were built with "pro" CPUs. Building WiFi-only lazor with "pro" CPUs isn't the end of the world. The SDRAM will ramp up a little sooner than it otherwise would, but aside from a small power hit things work OK. One problem, though, is that the SDRAM scaling becomes a bit quirky. Specifically, with the current tables we'll max out SDRAM frequency at 2.1GHz but then _lower_ it at 2.2GHz / 2.3GHz only to raise it back to max for 2.4GHz and 2.55GHz. Let's at least fix this so that the SDRAM frequency doesn't go down in that quirky way. On true "lite" SKUs this change will be a no-op because the operating points we're touching are disabled. This change is only useful when a board that thinks it has a "lite" CPU actually has a "normal" or "pro" one stuffed. Fixes: 8fd01e01fd6f ("arm64: dts: qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite") Signed-off-by: Douglas Anderson Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230515171929.1.Ic8dee2cb79ce39ffc04eab2a344dde47b2f9459f@changeid commit bb72b94c659f5032850e9ab070d850bc743e3a0e Author: Bagas Sanjaya Date: Wed May 10 10:54:15 2023 +0700 Documentation: net/mlx5: Wrap notes in admonition blocks Wrap note paragraphs in note:: directive as it better fit for the purpose of noting devlink commands. Fixes: f2d51e579359b7 ("net/mlx5: Separate mlx5 driver documentation into multiple pages") Fixes: cf14af140a5ad0 ("net/mlx5e: Add vnic devlink health reporter to representors") Reviewed-by: Leon Romanovsky Signed-off-by: Bagas Sanjaya Signed-off-by: Saeed Mahameed commit 92059da65d84227fcc7cabbd96c0cca19880f4ff Author: Bagas Sanjaya Date: Wed May 10 10:54:14 2023 +0700 Documentation: net/mlx5: Add blank line separator before numbered lists The doc forgets to add separator before numbered lists, which causes the lists to be appended to previous paragraph inline instead. Add the missing separator. Fixes: f2d51e579359b7 ("net/mlx5: Separate mlx5 driver documentation into multiple pages") Reviewed-by: Leon Romanovsky Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed commit 565b8c60e90f7f2d4763f5979c7aaa43697ab950 Author: Bagas Sanjaya Date: Wed May 10 10:54:13 2023 +0700 Documentation: net/mlx5: Use bullet and definition lists for vnic counters description "vnic reporter" section contains unformatted description for vnic counters, which is rendered as one long paragraph instead of list. Use bullet and definition lists to match other lists. Fixes: b0bc615df488ab ("net/mlx5: Add vnic devlink health reporter to PFs/VFs") Reviewed-by: Leon Romanovsky Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Reviewed-by: Daniel Machon Signed-off-by: Saeed Mahameed commit c3acc46c602f1aa0449ea687057758e5224ae3da Author: Bagas Sanjaya Date: Wed May 10 10:54:12 2023 +0700 Documentation: net/mlx5: Wrap vnic reporter devlink commands in code blocks Sphinx reports htmldocs warnings: Documentation/networking/device_drivers/ethernet/mellanox/mlx5/devlink.rst:287: WARNING: Unexpected indentation. Documentation/networking/device_drivers/ethernet/mellanox/mlx5/devlink.rst:288: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/networking/device_drivers/ethernet/mellanox/mlx5/devlink.rst:290: WARNING: Unexpected indentation. Fix above warnings by wrapping diagnostic devlink commands in "vnic reporter" section in code blocks to be consistent with other devlink command snippets. Fixes: b0bc615df488ab ("net/mlx5: Add vnic devlink health reporter to PFs/VFs") Fixes: cf14af140a5ad0 ("net/mlx5e: Add vnic devlink health reporter to representors") Reviewed-by: Leon Romanovsky Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed commit d5972f1000c1e6b5185ded0fc194f21984f26e14 Author: Dan Carpenter Date: Fri May 19 22:43:03 2023 +0300 net/mlx5: Fix check for allocation failure in comp_irqs_request_pci() This function accidentally dereferences "cpus" instead of returning directly. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202305200354.KV3jU94w-lkp@intel.com/ Fixes: b48a0f72bc3e ("net/mlx5: Refactor completion irq request/release code") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit fe5c2d3aef9352ac36a6acbc2bff5f732211ce3b Author: Yevgeny Kliteynik Date: Wed May 17 17:54:30 2023 +0300 net/mlx5: DR, Add missing mutex init/destroy in pattern manager Add missing mutex init/destroy as caught by the lock's debug warning: DEBUG_LOCKS_WARN_ON(lock->magic != lock) Fixes: da5d0027d666 ("net/mlx5: DR, Add cache for modify header pattern") Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit c4c24fc30cc417ace332ceceaba4f70f81dcd521 Author: Jianbo Liu Date: Tue May 16 02:28:02 2023 +0000 net/mlx5e: Move Ethernet driver debugfs to profile init callback As priv->dfs_root is cleared, and therefore missed, when change eswitch mode, move the creation of the root debugfs to the init callback of mlx5e_nic_profile and mlx5e_uplink_rep_profile, and the destruction to the cleanup callback for symmeter. Fixes: 288eca60cc31 ("net/mlx5e: Add Ethernet driver debugfs") Signed-off-by: Jianbo Liu Signed-off-by: Saeed Mahameed commit bdf274750fca17b289404ef03453c4070725302c Author: Dmytro Linkin Date: Wed Oct 13 14:39:24 2021 +0300 net/mlx5e: Don't attach netdev profile while handling internal error As part of switchdev mode disablement, driver changes port netdevice profile from uplink to nic. If this process is triggered by health recovery flow (PCI reset, for ex.) profile attach would fail because all fw commands aborted when internal error flag is set. As a result, nic netdevice profile is not attached and driver fails to rollback to uplink profile, which leave driver in broken state and cause crash later. To handle broken state do netdevice profile initialization only instead of full attachment and release mdev resources on driver suspend as expected. Actual netdevice attachment is done during driver load. Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") Signed-off-by: Dmytro Linkin Signed-off-by: Saeed Mahameed commit 5d862ec631f3d3cc3b4f8cdb5b9fc5879663f1d3 Author: Vlad Buslov Date: Mon May 22 14:48:52 2023 +0200 net/mlx5: Fix post parse infra to only parse every action once Caller of mlx5e_tc_act_post_parse() needs it to parse only the subset of actions starting after previous split and ending at the current action. However, that range is not provided as arguments and mlx5e_tc_act_post_parse() uses generic flow_action_for_each() that iterates over all flow actions. Not only this is redundant, it also causes a bug when mlx5e_tc_act->post_parse() callback is not idempotent since it will be called for every split. For example, ct action tc_act_post_parse_ct() callback obtains a reference to mlx5_ct_ft instance and calling it several times during parsing stage will cause reference counter imbalance. Fix the issue by providing a proper action range of the current split subset to mlx5e_tc_act_post_parse() and only calling mlx5e_tc_act->post_parse() for actions inside the subset range. Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 1db1f21caebbb1b6e9b1e7657df613616be3fb49 Author: Dragos Tatulea Date: Thu Apr 13 15:48:30 2023 +0300 net/mlx5e: Use query_special_contexts cmd only once per mdev Don't query the firmware so many times (num rqs * num wqes * wqe frags) because it slows down linearly the interface creation time when the product is larger. Do it only once per mdev and store the result in mlx5e_param. Due to helper function being called from different files, move it to an appropriate location. Rename the function with a proper prefix and add a small cleanup. This fix applies only for legacy rq. Fixes: 1b1e4868836a ("net/mlx5e: Use query_special_contexts for mkeys") Signed-off-by: Dragos Tatulea Reviewed-by: Or Har-Toov Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 341a80de2468f481b1f771683709b5649cbfe513 Author: Shay Drory Date: Sat Apr 29 20:41:41 2023 +0300 net/mlx5: fw_tracer, Fix event handling mlx5 driver needs to parse traces with event_id inside the range of first_string_trace and num_string_trace. However, mlx5 is parsing all events with event_id >= first_string_trace. Fix it by checking for the correct range. Fixes: c71ad41ccb0c ("net/mlx5: FW tracer, events handling") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit b4646da0573fae9dfa2b8f1f10936cb6eedd7230 Author: Shay Drory Date: Mon Apr 24 12:46:06 2023 +0300 net/mlx5: SF, Drain health before removing device There is no point in recovery during device removal. Also, if health work started need to wait for it to avoid races and NULL pointer access. Hence, drain health WQ before removing device. Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 824c8dc4a470040bf0e56ba716543839c2498d49 Author: Shay Drory Date: Mon Apr 24 12:31:59 2023 +0300 net/mlx5: Drain health before unregistering devlink mlx5 health mechanism is using devlink APIs, which are using devlink notify APIs. After the cited patch, using devlink notify APIs after devlink is unregistered triggers a WARN_ON(). Hence, drain health WQ before devlink is unregistered. Fixes: cf530217408e ("devlink: Notify users when objects are accessible") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 623efc4cbd6115db36716e31037cb6d1f3ce6754 Author: Maher Sanalla Date: Tue May 9 17:56:01 2023 +0300 net/mlx5e: Do not update SBCM when prio2buffer command is invalid The shared buffer pools configuration which are stored in the SBCM register are updated when the user changes the prio2buffer mapping. However, in case the user desired prio2buffer change is invalid, which can occur due to mapping a lossless priority to a not large enough buffer, the SBCM update should not be performed, as the user command is failed. Thus, Perform the SBCM update only after xoff threshold calculation is performed and the user prio2buffer mapping is validated. Fixes: a440030d8946 ("net/mlx5e: Update shared buffer along with device buffer changes") Signed-off-by: Maher Sanalla Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 81fe2be062915e2a2fdc494c3cd90e946e946c25 Author: Maher Sanalla Date: Mon May 1 17:31:40 2023 +0300 net/mlx5e: Consider internal buffers size in port buffer calculations Currently, when a user triggers a change in port buffer headroom (buffers 0-7), the driver checks that the requested headroom does not exceed the total port buffer size. However, this check does not take into account the internal buffers (buffers 8-9), which are also part of the total port buffer. This can result in treating invalid port buffer change requests as valid, causing unintended changes to the shared buffer. To address this, include the internal buffers size in the calculation of available port buffer space which ensures that port buffer requests do not exceed the correct limit. Furthermore, remove internal buffers (8-9) size from the total_size calculation as these buffers are reserved for internal use and are not exposed to the user. While at it, add verbosity to the debug prints in mlx5e_port_query_buffer() function to ease future debugging. Fixes: ecdf2dadee8e ("net/mlx5e: Receive buffer support for DCBX") Signed-off-by: Maher Sanalla Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 37c3b9fa7ccf5caad6d87ba4d42bf00be46be1cf Author: Chris Mi Date: Tue Feb 21 04:41:41 2023 +0200 net/mlx5e: Prevent encap offload when neigh update is running The cited commit adds a compeletion to remove dependency on rtnl lock. But it causes a deadlock for multiple encapsulations: crash> bt ffff8aece8a64000 PID: 1514557 TASK: ffff8aece8a64000 CPU: 3 COMMAND: "tc" #0 [ffffa6d14183f368] __schedule at ffffffffb8ba7f45 #1 [ffffa6d14183f3f8] schedule at ffffffffb8ba8418 #2 [ffffa6d14183f418] schedule_preempt_disabled at ffffffffb8ba8898 #3 [ffffa6d14183f428] __mutex_lock at ffffffffb8baa7f8 #4 [ffffa6d14183f4d0] mutex_lock_nested at ffffffffb8baabeb #5 [ffffa6d14183f4e0] mlx5e_attach_encap at ffffffffc0f48c17 [mlx5_core] #6 [ffffa6d14183f628] mlx5e_tc_add_fdb_flow at ffffffffc0f39680 [mlx5_core] #7 [ffffa6d14183f688] __mlx5e_add_fdb_flow at ffffffffc0f3b636 [mlx5_core] #8 [ffffa6d14183f6f0] mlx5e_tc_add_flow at ffffffffc0f3bcdf [mlx5_core] #9 [ffffa6d14183f728] mlx5e_configure_flower at ffffffffc0f3c1d1 [mlx5_core] #10 [ffffa6d14183f790] mlx5e_rep_setup_tc_cls_flower at ffffffffc0f3d529 [mlx5_core] #11 [ffffa6d14183f7a0] mlx5e_rep_setup_tc_cb at ffffffffc0f3d714 [mlx5_core] #12 [ffffa6d14183f7b0] tc_setup_cb_add at ffffffffb8931bb8 #13 [ffffa6d14183f810] fl_hw_replace_filter at ffffffffc0dae901 [cls_flower] #14 [ffffa6d14183f8d8] fl_change at ffffffffc0db5c57 [cls_flower] #15 [ffffa6d14183f970] tc_new_tfilter at ffffffffb8936047 #16 [ffffa6d14183fac8] rtnetlink_rcv_msg at ffffffffb88c7c31 #17 [ffffa6d14183fb50] netlink_rcv_skb at ffffffffb8942853 #18 [ffffa6d14183fbc0] rtnetlink_rcv at ffffffffb88c1835 #19 [ffffa6d14183fbd0] netlink_unicast at ffffffffb8941f27 #20 [ffffa6d14183fc18] netlink_sendmsg at ffffffffb8942245 #21 [ffffa6d14183fc98] sock_sendmsg at ffffffffb887d482 #22 [ffffa6d14183fcb8] ____sys_sendmsg at ffffffffb887d81a #23 [ffffa6d14183fd38] ___sys_sendmsg at ffffffffb88806e2 #24 [ffffa6d14183fe90] __sys_sendmsg at ffffffffb88807a2 #25 [ffffa6d14183ff28] __x64_sys_sendmsg at ffffffffb888080f #26 [ffffa6d14183ff38] do_syscall_64 at ffffffffb8b9b6a8 #27 [ffffa6d14183ff50] entry_SYSCALL_64_after_hwframe at ffffffffb8c0007c crash> bt 0xffff8aeb07544000 PID: 1110766 TASK: ffff8aeb07544000 CPU: 0 COMMAND: "kworker/u20:9" #0 [ffffa6d14e6b7bd8] __schedule at ffffffffb8ba7f45 #1 [ffffa6d14e6b7c68] schedule at ffffffffb8ba8418 #2 [ffffa6d14e6b7c88] schedule_timeout at ffffffffb8baef88 #3 [ffffa6d14e6b7d10] wait_for_completion at ffffffffb8ba968b #4 [ffffa6d14e6b7d60] mlx5e_take_all_encap_flows at ffffffffc0f47ec4 [mlx5_core] #5 [ffffa6d14e6b7da0] mlx5e_rep_update_flows at ffffffffc0f3e734 [mlx5_core] #6 [ffffa6d14e6b7df8] mlx5e_rep_neigh_update at ffffffffc0f400bb [mlx5_core] #7 [ffffa6d14e6b7e50] process_one_work at ffffffffb80acc9c #8 [ffffa6d14e6b7ed0] worker_thread at ffffffffb80ad012 #9 [ffffa6d14e6b7f10] kthread at ffffffffb80b615d #10 [ffffa6d14e6b7f50] ret_from_fork at ffffffffb8001b2f After the first encap is attached, flow will be added to encap entry's flows list. If neigh update is running at this time, the following encaps of the flow can't hold the encap_tbl_lock and sleep. If neigh update thread is waiting for that flow's init_done, deadlock happens. Fix it by holding lock outside of the for loop. If neigh update is running, prevent encap flows from offloading. Since the lock is held outside of the for loop, concurrent creation of encap entries is not allowed. So remove unnecessary wait_for_completion call for res_ready. Fixes: 95435ad7999b ("net/mlx5e: Only access fully initialized flows in neigh update") Signed-off-by: Chris Mi Reviewed-by: Roi Dayan Reviewed-by: Vlad Buslov Signed-off-by: Saeed Mahameed commit e2ab5aa11f191b54514f063a5b5c29f3559f4ab7 Author: Chris Mi Date: Wed Mar 1 10:50:53 2023 +0200 net/mlx5e: Extract remaining tunnel encap code to dedicated file Move set_encap_dests() and clean_encap_dests() to the tunnel encap dedicated file. And rename them to mlx5e_tc_tun_encap_dests_set() and mlx5e_tc_tun_encap_dests_unset(). No functional change in this patch. It is needed in the next patch. Signed-off-by: Chris Mi Signed-off-by: Saeed Mahameed commit 4c8bb2d567588ccbfbf374c079f291a1402c4454 Author: Krzysztof Kozlowski Date: Tue Apr 18 11:57:34 2023 +0200 arm64: dts: qcom: sm8550: use uint16 for Soundwire interval The Soundwire bindings changed during review, after the SM8550 DTS Soundwire nodes were merged. Switch to uint16 for Soundwire qcom,ports-sinterval property, to match with current bindings. Fixes: 61b006389bb7 ("arm64: dts: qcom: sm8550: add Soundwire controllers") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230418095734.669858-1-krzysztof.kozlowski@linaro.org commit 4a08af2f22ba3c2fb26287dc27fa07bf298acb34 Author: Konrad Dybcio Date: Tue Apr 11 15:47:16 2023 +0200 soc: qcom: rpmhpd: Add SA8155P power domains Add the power domains exposed by RPMh in the Qualcomm SA8155P platform. Turns out they differ from SM8150. Signed-off-by: Konrad Dybcio Tested-by: Bartosz Golaszewski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230411-topic-hanaau-v2-2-fd3d70844b31@linaro.org commit 52ebee922b638c828d427345fadacc936fd2807f Merge: 47820d3263a4a 672b584c68de3 Author: Bjorn Andersson Date: Wed May 24 20:39:16 2023 -0700 Merge branch '20230411-topic-hanaau-v2-1-fd3d70844b31@linaro.org' into drivers-fixes-for-6.4 Merge the RPMPD DeviceTree binding update through a topic branch, so make the constants available to both driver and DeviceTree source branches. Keep the two parts on separate branches to allow merge-back if necessary towards v6.5. commit 8c67e554754ca669911625412ae9a6cd8cee1c82 Author: Konrad Dybcio Date: Tue Apr 11 15:47:17 2023 +0200 arm64: dts: qcom: Split out SA8155P and use correct RPMh power domains The RPMhPD setup on SA8155P is different compared to SM8150. Correct it to ensure the platform will not try accessing forbidden/missing RPMh entries at boot, as a bad vote will hang the machine. Signed-off-by: Konrad Dybcio Tested-by: Bartosz Golaszewski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230411-topic-hanaau-v2-3-fd3d70844b31@linaro.org commit 57a9d4bdb49a7d811140aba591295659c86aa5b8 Merge: a14da6144d16e 672b584c68de3 Author: Bjorn Andersson Date: Wed May 24 20:37:20 2023 -0700 Merge branch '20230411-topic-hanaau-v2-1-fd3d70844b31@linaro.org' into arm64-fixes-for-6.4 Merge the RPMPD DeviceTree binding update through a topic branch, so make the constants available to both driver and DeviceTree source branches. Keep the two parts on separate branches to allow merge-back if necessary towards v6.5. commit 672b584c68de309017cd2ce8938856c9b7c1b70e Author: Konrad Dybcio Date: Tue Apr 11 15:47:15 2023 +0200 dt-bindings: power: qcom,rpmpd: Add SA8155P Add a compatible for SA8155P platforms and relevant defines to the include file. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Tested-by: Bartosz Golaszewski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230411-topic-hanaau-v2-1-fd3d70844b31@linaro.org commit 47820d3263a4a7ba258fe2efe26ae5afb5b83036 Author: Abel Vesa Date: Tue May 16 11:28:56 2023 +0300 soc: qcom: Rename ice to qcom_ice to avoid module name conflict The following error was reported when building x86_64 allmodconfig: error: the following would cause module name conflict: drivers/soc/qcom/ice.ko drivers/net/ethernet/intel/ice/ice.ko Seems the 'ice' module name is already used by some Intel ethernet driver, so lets rename the Qualcomm Inline Crypto Engine (ICE) module from 'ice' to 'qcom_ice' to avoid any kind of errors/confusions. Reported-by: Stephen Rothwell Fixes: 2afbf43a4aec ("soc: qcom: Make the Qualcomm UFS/SDCC ICE a dedicated driver") Acked-by: Mukesh Ojha Signed-off-by: Abel Vesa Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230516082856.150214-1-abel.vesa@linaro.org commit 7b374a2fc8665bfb8a0d93b617463cc0732f533a Author: Dan Carpenter Date: Fri Apr 21 13:44:21 2023 +0300 soc: qcom: rmtfs: Fix error code in probe() Return an error code if of_property_count_u32_elems() fails. Don't return success. Fixes: e656cd0bcf3d ("soc: qcom: rmtfs: Optionally map RMTFS to more VMs") Signed-off-by: Dan Carpenter Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/76b21a14-70ff-4ca9-927d-587543c6699c@kili.mountain commit b3d0dcc8e359cf5d57fb6308bc9750af5da574b3 Author: Christophe JAILLET Date: Mon Apr 17 00:29:35 2023 +0200 soc: qcom: ramp_controller: Fix an error handling path in qcom_ramp_controller_probe() 'qrc' is known to be non-NULL at this point. Checking for 'qrc->desc' was expected instead, so use it. Fixes: a723c95fa137 ("soc: qcom: Add Qualcomm Ramp Controller driver") Signed-off-by: Christophe JAILLET Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/84727a79d0261b4112411aec23b553504015c02c.1681684138.git.christophe.jaillet@wanadoo.fr commit ab6cacf833ba337b41700ee193d2c8936f1d049e Author: Steve French Date: Mon May 22 09:50:33 2023 -0500 smb3: move Documentation/filesystems/cifs to Documentation/filesystems/smb Documentation/filesystems/cifs contains both server and client information so its pathname is misleading. In addition, the directory fs/smb now contains both server and client, so move Documentation/filesystems/cifs to Documentation/filesystems/smb Suggested-by: Namjae Jeon Acked-by: Namjae Jeon Signed-off-by: Steve French commit bf8a352d4997147b1e63020ed17cb4ee94392608 Author: Steve French Date: Sun May 21 22:52:04 2023 -0500 cifs: correct references in Documentation to old fs/cifs path The fs/cifs directory has moved to fs/smb/client, correct mentions of this in Documentation and comments. Acked-by: Namjae Jeon Signed-off-by: Steve French commit 38c8a9a52082579090e34c033d439ed2cd1a462d Author: Steve French Date: Sun May 21 20:46:30 2023 -0500 smb: move client and server files to common directory fs/smb Move CIFS/SMB3 related client and server files (cifs.ko and ksmbd.ko and helper modules) to new fs/smb subdirectory: fs/cifs --> fs/smb/client fs/ksmbd --> fs/smb/server fs/smbfs_common --> fs/smb/common Suggested-by: Linus Torvalds Acked-by: Namjae Jeon Signed-off-by: Steve French commit cb8b02fd6343228966324528adf920bfb8b8e681 Author: Steve French Date: Wed May 24 03:26:19 2023 -0500 cifs: mapchars mount option ignored There are two ways that special characters (not allowed in some other operating systems like Windows, but allowed in POSIX) have been mapped in the past ("SFU" and "SFM" mappings) to allow them to be stored in a range reserved for special chars. The default for Linux has been to use "mapposix" (ie the SFM mapping) but the conversion to the new mount API in the 5.11 kernel broke the ability to override the default mapping of the reserved characters (like '?' and '*' and '\') via "mapchars" mount option. This patch fixes that - so can now mount with "mapchars" mount option to override the default ("mapposix" ie SFM) mapping. Reported-by: Tyler Spivey Fixes: 24e0a1eff9e2 ("cifs: switch to new mount api") Signed-off-by: Steve French commit 8b4dd44f9b4702d42362b97b81c91b33a6dcea58 Author: Steve French Date: Tue May 23 20:25:47 2023 -0500 smb3: display debug information better for encryption Fix /proc/fs/cifs/DebugData to use the same case for "encryption" (ie "Encryption" with init capital letter was used in one place). In addition, if gcm256 encryption (intead of gcm128) is used on a connection to a server, note that in the DebugData as well. It now displays (when gcm256 negotiated): Security type: RawNTLMSSP SessionId: 0x86125800bc000b0d encrypted(gcm256) Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit 72a7804a667eeac98888610521179f0418883158 Author: Paulo Alcantara Date: Tue May 23 17:38:38 2023 -0300 cifs: fix smb1 mount regression cifs.ko maps NT_STATUS_NOT_FOUND to -EIO when SMB1 servers couldn't resolve referral paths. Proceed to tree connect when we get -EIO from dfs_get_referral() as well. Reported-by: Kris Karas (Bug Reporting) Tested-by: Woody Suwalski Fixes: 8e3554150d6c ("cifs: fix sharing of DFS connections") Cc: stable@vger.kernel.org # v6.2+ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 482e6ad9adde69d9da08864b4ccf4dfd53edb2f0 Author: Fangzhi Zuo Date: Wed May 10 16:43:30 2023 -0400 drm/amd/display: Have Payload Properly Created After Resume At drm suspend sequence, MST dc_sink is removed. When commit cached MST stream back in drm resume sequence, the MST stream payload is not properly created and added into the payload table. After resume, topology change is reprobed by removing existing streams first. That leads to no payload is found in the existing payload table as below error "[drm] ERROR No payload for [MST PORT:] found in mst state" 1. In encoder .atomic_check routine, remove check existance of dc_sink 2. Bypass MST by checking existence of MST root port. dc_link_type cannot differentiate MST port before topology is rediscovered. Reviewed-by: Wayne Lin Acked-by: Tom Chung Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 137f9cee113df91107cf91c130d5c414c4b191f0 Author: Alan Liu Date: Tue May 2 17:54:50 2023 +0800 drm/amd/display: Fix warning in disabling vblank irq [Why] During gpu-reset, we toggle vblank irq by calling dc_interrupt_set() instead of amdgpu_irq_get/put() because we don't want to change the irq source's refcount. However, we see the warning when vblank irq is enabled by dc_interrupt_set() during gpu-reset but disabled by amdgpu_irq_put() after gpu-reset. [How] Only in dm_gpureset_toggle_interrupts() we toggle vblank interrupts by calling dc_interrupt_set(). Apart from this we call dm_set_vblank() which uses amdgpu_irq_get/put() to operate vblank irq. Reviewed-by: Bhawanpreet Lakha Acked-by: Tom Chung Signed-off-by: Alan Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 38776cc45eb7603df4735a0410f42cffff8e71a1 Author: Kan Liang Date: Mon May 8 07:02:06 2023 -0700 perf/x86/uncore: Correct the number of CHAs on SPR The number of CHAs from the discovery table on some SPR variants is incorrect, because of a firmware issue. An accurate number can be read from the MSR UNC_CBO_CONFIG. Fixes: 949b11381f81 ("perf/x86/intel/uncore: Add Sapphire Rapids server CHA support") Reported-by: Stephane Eranian Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Tested-by: Stephane Eranian Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230508140206.283708-1-kan.liang@linux.intel.com commit 40baba5693b9af586dc1063af603d05a79e57a6b Author: Jonatas Esteves Date: Sat May 20 10:39:52 2023 -0300 drm/amd/pm: Fix output of pp_od_clk_voltage Printing the other clock types should not be conditioned on being able to print OD_SCLK. Some GPUs currently have limited capability of only printing a subset of these. Since this condition was introduced in v5.18-rc1, reading from `pp_od_clk_voltage` has been returning empty on the Asus ROG Strix G15 (2021). Fixes: 79c65f3fcbb1 ("drm/amd/pm: do not expose power implementation details to amdgpu_pm.c") Reviewed-by: Evan Quan Signed-off-by: Jonatas Esteves Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 0d2dd02d74e6377268f56b90261de0fae8f0d2cb Author: Evan Quan Date: Fri May 19 14:20:17 2023 +0800 drm/amd/pm: add missing NotifyPowerSource message mapping for SMU13.0.7 Otherwise, the power source switching will fail due to message unavailable. Fixes: bf4823267a81 ("drm/amd/pm: fix possible power mode mismatch between driver and PMFW") Signed-off-by: Evan Quan Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit a34fc1bcd2c4d8b09dcfc0b95ac65bca1e579bd7 Author: Alex Deucher Date: Thu May 18 12:38:22 2023 -0400 drm/radeon: reintroduce radeon_dp_work_func content Put back the radeon_dp_work_func logic. It seems that handling DP RX interrupts is necessary to make some panels work. This was removed with the MST support, but it regresses some systems so add it back. While we are here, add the proper mutex locking. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2567 Fixes: 01ad1d9c2888 ("drm/radeon: Drop legacy MST support") Reviewed-by: Lyude Paul Signed-off-by: Alex Deucher Cc: Lyude Paul Cc: stable@vger.kernel.org commit 7fc602dbfd548045862df096910b7d21e6d300bf Author: Jesse Zhang Date: Thu May 18 09:46:22 2023 +0800 drm/amdgpu: don't enable secure display on incompatible platforms [why] [drm] psp gfx command LOAD_TA(0x1) failed and response status is (0x7) [drm] psp gfx command INVOKE_CMD(0x3) failed and response status is (0x4) amdgpu 0000:04:00.0: amdgpu: Secure display: Generic Failure. [how] don't enable secure display on incompatible platforms Suggested-by: Aaron Liu Signed-off-by: Jesse zhang Reviewed-by: Aaron Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 60ecaaf54886b0642d5c4744f7fbf1ff0d6b3e42 Author: Sukrut Bellary Date: Wed May 3 16:15:07 2023 -0700 drm:amd:amdgpu: Fix missing buffer object unlock in failure path smatch warning - 1) drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:3615 gfx_v9_0_kiq_resume() warn: inconsistent returns 'ring->mqd_obj->tbo.base.resv'. 2) drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:6901 gfx_v10_0_kiq_resume() warn: inconsistent returns 'ring->mqd_obj->tbo.base.resv'. Signed-off-by: Sukrut Bellary Signed-off-by: Alex Deucher commit 933174ae28ba72ab8de5b35cb7c98fc211235096 Merge: f767b330d8d7c 6afe2ae8dc48e Author: Linus Torvalds Date: Wed May 24 11:43:08 2023 -0700 Merge tag 'spi-fix-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A collection of fixes that came in since the merge window, plus an update to MAINTAINERS. The Cadence fixes are coming from the addition of device mode support, they required a couple of incremental updates in order to get something that works robustly for both device and controller modes" * tag 'spi-fix-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-cadence: Interleave write of TX and read of RX FIFO spi: dw: Replace spi->chip_select references with function calls spi: MAINTAINERS: drop Krzysztof Kozlowski from Samsung SPI spi: spi-cadence: Only overlap FIFO transactions in slave mode spi: spi-cadence: Avoid read of RX FIFO before its ready spi: spi-geni-qcom: Select FIFO mode for chip select commit f767b330d8d7c27d6cc0abe594c0ab24e7f6e429 Merge: 203fc3177dd74 a511637502b1c Author: Linus Torvalds Date: Wed May 24 11:37:03 2023 -0700 Merge tag 'regulator-fix-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "Some fixes that came in since the merge window, nothing terribly exciting - a couple of driver specific fixes and a fix for the error handling when setting up the debugfs for the devices" * tag 'regulator-fix-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: mt6359: add read check for PMIC MT6359 regulator: Fix error checking for debugfs_create_dir regulator: pca9450: Fix BUCK2 enable_mask commit 203fc3177dd7427a1f87ec33de201c6d67b5c5cb Merge: 9d646009f65d6 81dce1490e284 Author: Linus Torvalds Date: Wed May 24 11:31:37 2023 -0700 Merge tag 'mmc-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix error propagation for the non-block-device I/O paths MMC host: - sdhci-cadence: Fix an error path during probe - sdhci-esdhc-imx: Fix support for the 'no-mmc-hs400' DT property" * tag 'mmc-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works mmc: sdhci-cadence: Fix an error handling path in sdhci_cdns_probe() mmc: block: ensure error propagation for non-blk commit 5f7fdb0f255756b594cc45c2c08b0140bc4a1761 Author: Srinivas Pandruvada Date: Mon May 22 15:38:44 2023 -0700 thermal: intel: int340x: Add new line for UUID display Prior to the commit "763bd29fd3d1 ("thermal: int340x_thermal: Use sysfs_emit_at() instead of scnprintf()", there was a new line after each UUID string. With the newline removed, existing user space like "thermald" fails to compare each supported UUID as it is using getline() to read UUID and apply correct thermal table. To avoid breaking existing user space, add newline after each UUID string. Signed-off-by: Srinivas Pandruvada Fixes: 763bd29fd3d1 ("thermal: int340x_thermal: Use sysfs_emit_at() instead of scnprintf()") Cc: 6.3+ # 6.3+ Signed-off-by: Rafael J. Wysocki commit 8557dc27126949c702bd3aafe8a7e0b7e4fcb44c Author: Yu Kuai Date: Wed May 24 09:41:18 2023 +0800 md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk() 'end_sector' is compared to 'rdev->recovery_offset', which is offset to rdev, however, commit e82ed3a4fbb5 ("md/raid6: refactor raid5_read_one_chunk") changes the calculation of 'end_sector' to offset to the array. Fix this miscalculation. Fixes: e82ed3a4fbb5 ("md/raid6: refactor raid5_read_one_chunk") Cc: stable@vger.kernel.org # v5.12+ Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230524014118.3172781-1-yukuai1@huaweicloud.com commit 249b62c448de7117c18531d626aed6e153cdfd75 Author: Wyes Karny Date: Wed May 17 16:28:16 2023 +0000 cpufreq: amd-pstate: Remove fast_switch_possible flag from active driver amd_pstate active mode driver is only compatible with static governors. Therefore it doesn't need fast_switch functionality. Remove fast_switch_possible flag from amd_pstate active mode driver. Fixes: ffa5096a7c33 ("cpufreq: amd-pstate: implement Pstate EPP support for the AMD processors") Signed-off-by: Wyes Karny Signed-off-by: Rafael J. Wysocki commit 4badf2eb1e986bdbf34dd2f5d4c979553a86fe54 Author: Gautham R. Shenoy Date: Wed May 17 16:28:15 2023 +0000 cpufreq: amd-pstate: Add ->fast_switch() callback Schedutil normally calls the adjust_perf callback for drivers with adjust_perf callback available and fast_switch_possible flag set. However, when frequency invariance is disabled and schedutil tries to invoke fast_switch. So, there is a chance of kernel crash if this function pointer is not set. To protect against this scenario add fast_switch callback to amd_pstate driver. Fixes: 1d215f0319c2 ("cpufreq: amd-pstate: Add fast switch function for AMD P-State") Signed-off-by: Gautham R. Shenoy Signed-off-by: Wyes Karny Signed-off-by: Rafael J. Wysocki commit 61e150fb310729c98227a5edf6e4a3619edc3702 Author: Helge Deller Date: Wed May 24 17:07:07 2023 +0200 parisc: Fix flush_dcache_page() for usage from irq context Since at least kernel 6.1, flush_dcache_page() is called with IRQs disabled, e.g. from aio_complete(). But the current implementation for flush_dcache_page() on parisc unintentionally re-enables IRQs, which may lead to deadlocks. Fix it by using xa_lock_irqsave() and xa_unlock_irqrestore() for the flush_dcache_mmap_*lock() macros instead. Cc: linux-parisc@vger.kernel.org Cc: stable@kernel.org # 5.18+ Signed-off-by: Helge Deller commit 335b4223466dd75f9f3ea4918187afbadd22e5c8 Author: Maximilian Heyne Date: Wed May 3 13:16:53 2023 +0000 x86/pci/xen: populate MSI sysfs entries Commit bf5e758f02fc ("genirq/msi: Simplify sysfs handling") reworked the creation of sysfs entries for MSI IRQs. The creation used to be in msi_domain_alloc_irqs_descs_locked after calling ops->domain_alloc_irqs. Then it moved into __msi_domain_alloc_irqs which is an implementation of domain_alloc_irqs. However, Xen comes with the only other implementation of domain_alloc_irqs and hence doesn't run the sysfs population code anymore. Commit 6c796996ee70 ("x86/pci/xen: Fixup fallout from the PCI/MSI overhaul") set the flag MSI_FLAG_DEV_SYSFS for the xen msi_domain_info but that doesn't actually have an effect because Xen uses it's own domain_alloc_irqs implementation. Fix this by making use of the fallback functions for sysfs population. Fixes: bf5e758f02fc ("genirq/msi: Simplify sysfs handling") Signed-off-by: Maximilian Heyne Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20230503131656.15928-1-mheyne@amazon.de Signed-off-by: Juergen Gross commit 8fafac202d18230bb9926bda48e563fd2cce2a4f Author: Dan Carpenter Date: Wed May 3 18:11:35 2023 +0300 xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() In the pvcalls_new_active_socket() function, most error paths call pvcalls_back_release_active(fedata->dev, fedata, map) which calls sock_release() on "sock". The bug is that the caller also frees sock. Fix this by making every error path in pvcalls_new_active_socket() release the sock, and don't free it in the caller. Fixes: 5db4d286a8ef ("xen/pvcalls: implement connect command") Signed-off-by: Dan Carpenter Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/e5f98dc2-0305-491f-a860-71bbd1398a2f@kili.mountain Signed-off-by: Juergen Gross commit b6ebaa8100090092aa602530d7e8316816d0c98d Author: Ross Lagerwall Date: Wed Apr 26 17:40:05 2023 +0100 xen/blkfront: Only check REQ_FUA for writes The existing code silently converts read operations with the REQ_FUA bit set into write-barrier operations. This results in data loss as the backend scribbles zeroes over the data instead of returning it. While the REQ_FUA bit doesn't make sense on a read operation, at least one well-known out-of-tree kernel module does set it and since it results in data loss, let's be safe here and only look at REQ_FUA for writes. Signed-off-by: Ross Lagerwall Acked-by: Juergen Gross Link: https://lore.kernel.org/r/20230426164005.2213139-1-ross.lagerwall@citrix.com Signed-off-by: Juergen Gross commit 3eb96946f0be6bf447cbdf219aba22bc42672f92 Author: Christoph Hellwig Date: Wed May 24 08:05:38 2023 +0200 block: make bio_check_eod work for zero sized devices Since the dawn of time bio_check_eod has a check for a non-zero size of the device. This doesn't really make any sense as we never want to send I/O to a device that's been set to zero size, or never moved out of that. I am a bit surprised we haven't caught this for a long time, but the removal of the extra validation inside of zram caused syzbot to trip over this issue recently. I've added a Fixes tag for that commit, but the issue really goes back way before git history. Fixes: 9fe95babc742 ("zram: remove valid_io_request") Reported-by: syzbot+b8d61a58b7c7ebd2c8e0@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230524060538.1593686-1-hch@lst.de Signed-off-by: Jens Axboe commit 33d418da6f476b15e4510e0a590062583f63cd36 Author: Alexandre Ghiti Date: Fri May 19 15:13:11 2023 +0200 riscv: Fix unused variable warning when BUILTIN_DTB is set commit ef69d2559fe9 ("riscv: Move early dtb mapping into the fixmap region") wrongly moved the #ifndef CONFIG_BUILTIN_DTB surrounding the pa variable definition in create_fdt_early_page_table(), so move it back to its right place to quiet the following warning: ../arch/riscv/mm/init.c: In function ‘create_fdt_early_page_table’: ../arch/riscv/mm/init.c:925:12: warning: unused variable ‘pa’ [-Wunused-variable] 925 | uintptr_t pa = dtb_pa & ~(PMD_SIZE - 1); Fixes: ef69d2559fe9 ("riscv: Move early dtb mapping into the fixmap region") Signed-off-by: Alexandre Ghiti Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230519131311.391960-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 6888ff04e37d01295620a73f3f7efbc79f6ef152 Author: Helge Deller Date: Wed May 24 14:34:58 2023 +0200 parisc: Handle kgdb breakpoints only in kernel context The kernel kgdb break instructions should only be handled when running in kernel context. Cc: # v5.4+ Signed-off-by: Helge Deller commit df419492e428b6a2bce98d0f613c58a13da6666c Author: Helge Deller Date: Wed May 24 14:31:14 2023 +0200 parisc: Handle kprobes breakpoints only in kernel context The kernel kprobes break instructions should only be handled when running in kernel context. Cc: # v5.18+ Signed-off-by: Helge Deller commit 2028315cf59bb899a5ac7e87dc48ecb8fac7ac24 Author: Helge Deller Date: Mon May 22 22:57:30 2023 +0200 parisc: Allow to reboot machine after system halt In case a machine can't power-off itself on system shutdown, allow the user to reboot it by pressing the RETURN key. Cc: # v4.14+ Signed-off-by: Helge Deller commit a9f0e3d5a089d0844abb679a5e99f15010d53e25 Author: Fuad Tabba Date: Mon May 22 11:32:58 2023 +0100 KVM: arm64: Reload PTE after invoking walker callback on preorder traversal The preorder callback on the kvm_pgtable_stage2_map() path can replace a table with a block, then recursively free the detached table. The higher-level walking logic stashes the old page table entry and then walks the freed table, invoking the leaf callback and potentially freeing pgtable pages prematurely. In normal operation, the call to tear down the detached stage-2 is indirected and uses an RCU callback to trigger the freeing. RCU is not available to pKVM, which is where this bug is triggered. Change the behavior of the walker to reload the page table entry after invoking the walker callback on preorder traversal, as it does for leaf entries. Tested on Pixel 6. Fixes: 5c359cca1faf ("KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make") Suggested-by: Oliver Upton Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230522103258.402272-1-tabba@google.com commit d282fa3c5ccb7a0029c418f358143689553b6447 Author: Marc Zyngier Date: Mon May 15 21:46:01 2023 +0100 KVM: arm64: Handle trap of tagged Set/Way CMOs We appear to have missed the Set/Way CMOs when adding MTE support. Not that we really expect anyone to use them, but you never know what stupidity some people can come up with... Treat these mostly like we deal with the classic S/W CMOs, only with an additional check that MTE really is enabled. Signed-off-by: Marc Zyngier Reviewed-by: Cornelia Huck Reviewed-by: Steven Price Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20230515204601.1270428-3-maz@kernel.org commit 8d0f019e4c4f2ee2de81efd9bf1c27e9fb3c0460 Author: Marc Zyngier Date: Mon May 15 21:46:00 2023 +0100 arm64: Add missing Set/Way CMO encodings Add the missing Set/Way CMOs that apply to tagged memory. Signed-off-by: Marc Zyngier Reviewed-by: Cornelia Huck Reviewed-by: Steven Price Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20230515204601.1270428-2-maz@kernel.org commit 0b5d5c436a5c572a45f976cfd34a6741e143e5d9 Author: Marek Vasut Date: Sat May 13 21:23:52 2023 +0200 mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order Chapter "5.3 Power-Up/Down Sequence" of WILC1000 [1] and WILC3000 [2] states that CHIP_EN must be pulled HIGH first, RESETN second. Fix the order of these signals in the driver. Use the mmc_pwrseq_ops as driver data as the delay between signals is specific to SDIO card type anyway. [1] https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/DataSheets/ATWILC1000-MR110XB-IEEE-802.11-b-g-n-Link-Controller-Module-DS70005326E.pdf [2] https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/IEEE-802.11-b-g-n-Link-Controller-Module-with-Integrated-Bluetooth-5.0-DS70005327B.pdf Fixes: b2832b96fcf5 ("mmc: pwrseq: sd8787: add support for wilc1000") Signed-off-by: Marek Vasut Reviewed-by: Claudiu Beznea Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230513192352.479627-1-marex@denx.de Signed-off-by: Ulf Hansson commit a99d21cefd351c8aaa20b83a3c942340e5789d45 Author: Deren Wu Date: Sat May 13 22:48:15 2023 +0800 mmc: vub300: fix invalid response handling We may get an empty response with zero length at the beginning of the driver start and get following UBSAN error. Since there is no content(SDRT_NONE) for the response, just return and skip the response handling to avoid this problem. Test pass : SDIO wifi throughput test with this patch [ 126.980684] UBSAN: array-index-out-of-bounds in drivers/mmc/host/vub300.c:1719:12 [ 126.980709] index -1 is out of range for type 'u32 [4]' [ 126.980729] CPU: 4 PID: 9 Comm: kworker/u16:0 Tainted: G E 6.3.0-rc4-mtk-local-202304272142 #1 [ 126.980754] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020 [ 126.980770] Workqueue: kvub300c vub300_cmndwork_thread [vub300] [ 126.980833] Call Trace: [ 126.980845] [ 126.980860] dump_stack_lvl+0x48/0x70 [ 126.980895] dump_stack+0x10/0x20 [ 126.980916] ubsan_epilogue+0x9/0x40 [ 126.980944] __ubsan_handle_out_of_bounds+0x70/0x90 [ 126.980979] vub300_cmndwork_thread+0x58e7/0x5e10 [vub300] [ 126.981018] ? _raw_spin_unlock+0x18/0x40 [ 126.981042] ? finish_task_switch+0x175/0x6f0 [ 126.981070] ? __switch_to+0x42e/0xda0 [ 126.981089] ? __switch_to_asm+0x3a/0x80 [ 126.981129] ? __pfx_vub300_cmndwork_thread+0x10/0x10 [vub300] [ 126.981174] ? __kasan_check_read+0x11/0x20 [ 126.981204] process_one_work+0x7ee/0x13d0 [ 126.981246] worker_thread+0x53c/0x1240 [ 126.981291] kthread+0x2b8/0x370 [ 126.981312] ? __pfx_worker_thread+0x10/0x10 [ 126.981336] ? __pfx_kthread+0x10/0x10 [ 126.981359] ret_from_fork+0x29/0x50 [ 126.981400] Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Signed-off-by: Deren Wu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/048cd6972c50c33c2e8f81d5228fed928519918b.1683987673.git.deren.wu@mediatek.com Signed-off-by: Ulf Hansson commit adf8e96a7ea670d45b5de7594acc67e8f4787ae6 Author: Helge Deller Date: Tue May 23 09:06:40 2023 +0200 parisc: Enable LOCKDEP support Cc: # v6.0+ Signed-off-by: Helge Deller commit 15e64ef6520ea8702998db05b87fa5c3d3d40710 Author: Helge Deller Date: Mon May 22 15:11:16 2023 +0200 parisc: Add lightweight spinlock checks Add a lightweight spinlock check which uses only two instructions per spinlock call. It detects if a spinlock has been trashed by some memory corruption and then halts the kernel. It will not detect uninitialized spinlocks, for which CONFIG_DEBUG_SPINLOCK needs to be enabled. This lightweight spinlock check shouldn't influence runtime, so it's safe to enable it by default. The __ARCH_SPIN_LOCK_UNLOCKED_VAL constant has been choosen small enough to be able to be loaded by one LDI assembler statement. Signed-off-by: Helge Deller commit 4ca110cab46561cd74a2acd9b447435acb4bec5f Author: Bin Li Date: Wed May 24 19:37:55 2023 +0800 ALSA: hda/realtek: Enable headset onLenovo M70/M90 Lenovo M70/M90 Gen4 are equipped with ALC897, and they need ALC897_FIXUP_HEADSET_MIC_PIN quirk to make its headset mic work. The previous quirk for M70/M90 is for Gen3. Signed-off-by: Bin Li Cc: Link: https://lore.kernel.org/r/20230524113755.1346928-1-bin.li@canonical.com Signed-off-by: Takashi Iwai commit e79d85c6c217221ea32354a5ac0587a7ccea02b9 Author: Geert Uytterhoeven Date: Tue May 23 17:06:20 2023 +0200 drm/fb-helper: Fix height, width, and accel_flags in fb_var Fbtest contains some very simple validation of the fbdev userspace API contract. When used with shmob-drm, it reports the following warnings and errors: height changed from 68 to 0 height was rounded down width changed from 111 to 0 width was rounded down accel_flags changed from 0 to 1 The first part happens because __fill_var() resets the physical dimensions of the first connector, as filled in by drm_setup_crtcs_fb(). Fix this by retaining the original values. The last part happens because __fill_var() forces the FB_ACCELF_TEXT flag on, while fbtest disables all acceleration on purpose, so it can draw safely to the frame buffer. Fix this by setting accel_flags to zero, as DRM does not implement any text console acceleration. Note that this issue can also be seen in the output of fbset, which reports "accel true". Fixes: ee4cce0a8f03a333 ("drm/fb-helper: fix input validation gaps in check_var") Signed-off-by: Geert Uytterhoeven Reviewed-by: Daniel Vetter Tested-by: Sui Jingfeng Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/57e6b334dae8148b1b8ae6ef308ce9a83810a850.1684854344.git.geert+renesas@glider.be commit 0cc6578048e0980d254aee345130cced4912f723 Author: Mark Brown Date: Tue May 23 23:18:19 2023 +0100 regmap: maple: Drop the RCU read lock while syncing registers Unfortunately the maple tree requires us to explicitly lock it so we need to take the RCU read lock while iterating. When syncing this means that we end up trying to write out register values while holding the RCU read lock which triggers lockdep issues since that is an atomic context but most buses can't be used in atomic context. Pause the iteration and drop the lock for each register we check to avoid this. Reported-by: Pierre-Louis Bossart Tested-by: Pierre-Louis Bossart Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230523-regcache-maple-sync-lock-v1-1-530e4d68dfab@kernel.org Signed-off-by: Mark Brown commit 95856d1f3c223c015780fffb8373a827fc4efd2e Author: Srinivas Kandagatla Date: Tue May 23 16:47:47 2023 +0100 regmap: sdw: check for invalid multi-register writes config SoundWire code as it is only supports Bulk register writes and it does not support multi-register writes. Any drivers that set can_multi_write and use regmap_multi_reg_write() will easily endup with programming the hardware incorrectly without any errors. So, add this check in bus code to be able to validate the drivers config. Fixes: 522272047dc6 ("regmap: sdw: Remove 8-bit value size restriction") Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230523154747.5429-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 2d7c2f9272de6347a9cec0fc07708913692c0ae3 Author: Srinivas Kandagatla Date: Tue May 23 17:54:14 2023 +0100 ASoC: codecs: wcd938x-sdw: do not set can_multi_write flag regmap-sdw does not support multi register writes, so there is no point in setting this flag. This also leads to incorrect programming of WSA codecs with regmap_multi_reg_write() call. This invalid configuration should have been rejected by regmap-sdw. Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230523165414.14560-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 6e7a6d4797ef521c0762914610ed682e102b9d36 Author: Srinivas Kandagatla Date: Tue May 23 16:46:05 2023 +0100 ASoC: codecs: wsa881x: do not set can_multi_write flag regmap-sdw does not support multi register writes, so there is no point in setting this flag. This also leads to incorrect programming of WSA codecs with regmap_multi_reg_write() call. This invalid configuration should have been rejected by regmap-sdw. Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support") Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230523154605.4284-2-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 40ba0411074485e2cf1bf8ee0f3db27bdff88394 Author: Srinivas Kandagatla Date: Tue May 23 16:46:04 2023 +0100 ASoC: codecs: wsa883x: do not set can_multi_write flag regmap-sdw does not support multi register writes, so there is no point in setting this flag. This also leads to incorrect programming of WSA codecs with regmap_multi_reg_write() call. This invalid configuration should have been rejected by regmap-sdw. Fixes: 43b8c7dc85a1 ("ASoC: codecs: add wsa883x amplifier support") Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230523154605.4284-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit bac4d8220b7227e317caeadf5ed05c61cd5dc21c Merge: 81302b1c7c997 011a8719d6105 Author: Takashi Iwai Date: Wed May 24 12:14:24 2023 +0200 Merge tag 'asoc-fix-v6.4-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.4 A collection of fixes for v6.4, mostly driver specific but there's also one fix for DPCM to avoid incorrectly repeated calls to prepare() which can trigger issues on some systems. commit 6ab39f99927eed605728b02d512438d828183c97 Author: Ard Biesheuvel Date: Tue May 16 20:14:19 2023 +0200 crypto: x86/aria - Use 16 byte alignment for GFNI constant vectors The GFNI routines in the AVX version of the ARIA implementation now use explicit VMOVDQA instructions to load the constant input vectors, which means they must be 16 byte aligned. So ensure that this is the case, by dropping the section split and the incorrect .align 8 directive, and emitting the constants into the 16-byte aligned section instead. Note that the AVX2 version of this code deviates from this pattern, and does not require a similar fix, given that it loads these contants as 8-byte memory operands, for which AVX2 permits any alignment. Cc: Taehee Yoo Fixes: 8b84475318641c2b ("crypto: x86/aria-avx - Do not use avx2 instructions") Reported-by: syzbot+a6abcf08bad8b18fd198@syzkaller.appspotmail.com Tested-by: syzbot+a6abcf08bad8b18fd198@syzkaller.appspotmail.com Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 6b0db163ff9200a55dc77a652dad1d4b0a853f63 Author: Claudiu Beznea Date: Tue May 23 08:27:50 2023 +0300 ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc There is no atmel,shdwc-debouncer property for SHDWC. The right DT property is debounce-delay-us. Use it. Fixes: 16b161bcf5d4 ("ARM: dts: at91: sama7g5: add shdwc node") Signed-off-by: Claudiu Beznea Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20230523052750.184223-1-claudiu.beznea@microchip.com commit ccd4923d18d5698a5910d516646ce125b9155d47 Author: Claudiu Beznea Date: Thu May 18 09:25:11 2023 +0300 ARM: at91: pm: fix imbalanced reference counter for ethernet devices The of_find_device_by_node() function is returning a struct platform_device object with the embedded struct device member's reference counter incremented. This needs to be dropped when done with the platform device returned by of_find_device_by_node(). at91_pm_eth_quirk_is_valid() calls of_find_device_by_node() on suspend and resume path. On suspend it calls of_find_device_by_node() and on resume and failure paths it drops the counter of struct platform_device::dev. In case ethernet device may not wakeup there is a put_device() on at91_pm_eth_quirk_is_valid() which is wrong as it colides with put_device() on resume path leading to the reference counter of struct device embedded in struct platform_device to be messed, stack trace to be displayed (after 5 consecutive suspend/resume cycles) and execution to hang. Along with this the error path of at91_pm_config_quirks() had been also adapted to decrement propertly the reference counter of struct device embedded in struct platform_device. Fixes: b7fc72c63399 ("ARM: at91: pm: add quirks for pm") Signed-off-by: Claudiu Beznea Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20230518062511.2988500-1-claudiu.beznea@microchip.com commit 878ecb0897f4737a4c9401f3523fd49589025671 Author: Gavrilov Ilia Date: Tue May 23 08:29:44 2023 +0000 ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c61a40432509 ("[IPV6]: Find option offset by type.") Signed-off-by: Gavrilov Ilia Reviewed-by: Jiri Pirko Reviewed-by: David Ahern Signed-off-by: David S. Miller commit ba46c96db93905f93ebee8ed824cae6790a5ce34 Merge: 04910d8cbfed6 1da438c0ae023 Author: David S. Miller Date: Wed May 24 08:40:14 2023 +0100 Merge tag 'mlx5-fixes-2023-05-22' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-fixes-2023-05-22 This series provides bug fixes for the mlx5 driver. Please pull and let me know if there is any problem. ==================== Signed-off-by: David S. Miller commit 04910d8cbfed65dad21c31723c6c1a8d9f990fb6 Author: Arınç ÜNAL Date: Mon May 22 13:57:43 2023 +0300 net: ethernet: mtk_eth_soc: fix QoS on DSA MAC on non MTK_NETSYS_V2 SoCs The commit c6d96df9fa2c ("net: ethernet: mtk_eth_soc: drop generic vlan rx offload, only use DSA untagging") makes VLAN RX offloading to be only used on the SoCs without the MTK_NETSYS_V2 ability (which are not just MT7621 and MT7622). The commit disables the proper handling of special tagged (DSA) frames, added with commit 87e3df4961f4 ("net-next: ethernet: mediatek: add CDM able to recognize the tag for DSA"), for non MTK_NETSYS_V2 SoCs when it finds a MAC that does not use DSA. So if the other MAC uses DSA, the CDMQ component transmits DSA tagged frames to the CPU improperly. This issue can be observed on frames with TCP, for example, a TCP speed test using iperf3 won't work. The commit disables the proper handling of special tagged (DSA) frames because it assumes that these SoCs don't use more than one MAC, which is wrong. Although I made Frank address this false assumption on the patch log when they sent the patch on behalf of Felix, the code still made changes with this assumption. Therefore, the proper handling of special tagged (DSA) frames must be kept enabled in all circumstances as it doesn't affect non DSA tagged frames. Hardware DSA untagging, introduced with the commit 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging"), and VLAN RX offloading are operations on the two CDM components of the frame engine, CDMP and CDMQ, which connect to Packet DMA (PDMA) and QoS DMA (QDMA) and are between the MACs and the CPU. These operations apply to all MACs of the SoC so if one MAC uses DSA and the other doesn't, the hardware DSA untagging operation will cause the CDMP component to transmit non DSA tagged frames to the CPU improperly. Since the VLAN RX offloading feature configuration was dropped, VLAN RX offloading can only be used along with hardware DSA untagging. So, for the case above, we need to disable both features and leave it to the CPU, therefore software, to untag the DSA and VLAN tags. So the correct way to handle this is: For all SoCs: Enable the proper handling of special tagged (DSA) frames (MTK_CDMQ_IG_CTRL). For non MTK_NETSYS_V2 SoCs: Enable hardware DSA untagging (MTK_CDMP_IG_CTRL). Enable VLAN RX offloading (MTK_CDMP_EG_CTRL). When a non MTK_NETSYS_V2 SoC MAC does not use DSA: Disable hardware DSA untagging (MTK_CDMP_IG_CTRL). Disable VLAN RX offloading (MTK_CDMP_EG_CTRL). Fixes: c6d96df9fa2c ("net: ethernet: mtk_eth_soc: drop generic vlan rx offload, only use DSA untagging") Signed-off-by: Arınç ÜNAL Signed-off-by: David S. Miller commit e14fd2af7a1d621c167dad761f729135a7a76ff4 Author: Peter Rosin Date: Tue May 23 19:20:47 2023 +0200 dmaengine: at_hdmac: Extend the Flow Controller bitfield to three bits Some chips have two bits (e.g SAMA5D3), and some have three (e.g. SAM9G45). A field width of three is compatible as long as valid values are used for the different chips. There is no current use of any value needing three bits, so the fixed bug is relatively benign. Fixes: d8840a7edcf0 ("dmaengine: at_hdmac: Use bitfield access macros") Cc: stable@vger.kernel.org Reviewed-by: Tudor Ambarus Signed-off-by: Peter Rosin Link: https://lore.kernel.org/r/e2c898ba-c3a3-5dd3-384b-0585661c79f2@axentia.se Signed-off-by: Vinod Koul commit 2a6c7e8cc74e58ba94b8c897035a8ef7f7349f76 Author: Peter Rosin Date: Tue May 23 19:20:37 2023 +0200 dmaengine: at_hdmac: Repair bitfield macros for peripheral ID handling The MSB part of the peripheral IDs need to go into the ATC_SRC_PER_MSB and ATC_DST_PER_MSB fields. Not the LSB part. This fixes a severe regression for TSE-850 devices (compatible axentia,tse850v3) where output to the audio I2S codec (the main purpose of the device) simply do not work. Fixes: d8840a7edcf0 ("dmaengine: at_hdmac: Use bitfield access macros") Cc: stable@vger.kernel.org Signed-off-by: Peter Rosin Reviewed-by: Tudor Ambarus Link: https://lore.kernel.org/r/01e5dae1-d4b0-cf31-516b-423b11b077f1@axentia.se Signed-off-by: Vinod Koul commit a1a5f2c887252dec161c1e12e04303ca9ba56fa9 Author: Randy Dunlap Date: Tue May 23 21:53:10 2023 -0700 dmaengine: pl330: rename _start to prevent build error "_start" is used in several arches and proably should be reserved for ARCH usage. Using it in a driver for a private symbol can cause a build error when it conflicts with ARCH usage of the same symbol. Therefore rename pl330's "_start" to "pl330_start_thread" so that there is no conflict and no build error. drivers/dma/pl330.c:1053:13: error: '_start' redeclared as different kind of symbol 1053 | static bool _start(struct pl330_thread *thrd) | ^~~~~~ In file included from ../include/linux/interrupt.h:21, from ../drivers/dma/pl330.c:18: arch/riscv/include/asm/sections.h:11:13: note: previous declaration of '_start' with type 'char[]' 11 | extern char _start[]; | ^~~~~~ Fixes: b7d861d93945 ("DMA: PL330: Merge PL330 driver into drivers/dma/") Fixes: ae43b3289186 ("ARM: 8202/1: dmaengine: pl330: Add runtime Power Management support v12") Signed-off-by: Randy Dunlap Cc: Jaswinder Singh Cc: Boojin Kim Cc: Krzysztof Kozlowski Cc: Russell King Cc: Vinod Koul Cc: dmaengine@vger.kernel.org Cc: linux-riscv@lists.infradead.org Link: https://lore.kernel.org/r/20230524045310.27923-1-rdunlap@infradead.org Signed-off-by: Vinod Koul commit 7e7b3b097a9d95cd76fb462f83dc740b71bd73c0 Author: Jakub Kicinski Date: Mon May 22 16:09:03 2023 -0700 docs: netdev: document the existence of the mail bot We had a good run, but after 4 weeks of use we heard someone asking about pw-bot commands. Let's explain its existence in the docs. It's not a complete documentation but hopefully it's enough for the casual contributor. The project and scope are in flux so the details would likely become out of date, if we were to document more in depth. Link: https://lore.kernel.org/all/20230522140057.GB18381@nucnuc.mle/ Reviewed-by: Andrew Lunn Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230522230903.1853151-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8a02fb71d7192ff1a9a47c9d937624966c6e09af Author: Pratyush Yadav Date: Mon May 22 17:30:20 2023 +0200 net: fix skb leak in __skb_tstamp_tx() Commit 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with zerocopy skbs. But it ended up adding a leak of its own. When skb_orphan_frags_rx() fails, the function just returns, leaking the skb it just cloned. Free it before returning. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") Signed-off-by: Pratyush Yadav Reviewed-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230522153020.32422-1-ptyadav@amazon.de Signed-off-by: Jakub Kicinski commit f1aab363438cd1c55a3c5420db2a17c0e29ef625 Author: Steven Rostedt (Google) Date: Tue May 23 22:54:29 2023 -0400 tracing/selftests: Update synthetic event selftest to use common_stacktrace With the rename of the stacktrace field to common_stacktrace, update the selftests to reflect this change. Copy the current selftest to test the backward compatibility "stacktrace" keyword. Also the "requires" of that test was incorrect, so it would never actually ran before. That is fixed now. Link: https://lore.kernel.org/linux-trace-kernel/20230523225402.55951f2f@rorschach.local.home Cc: Masami Hiramatsu Cc: Tom Zanussi Cc: Mark Rutland Cc: Shuah Khan Cc: Shuah Khan Signed-off-by: Steven Rostedt (Google) commit 4b512860bdbdddcf41467ebd394f27cb8dfb528c Author: Steven Rostedt (Google) Date: Tue May 23 23:09:13 2023 -0400 tracing: Rename stacktrace field to common_stacktrace The histogram and synthetic events can use a pseudo event called "stacktrace" that will create a stacktrace at the time of the event and use it just like it was a normal field. We have other pseudo events such as "common_cpu" and "common_timestamp". To stay consistent with that, convert "stacktrace" to "common_stacktrace". As this was used in older kernels, to keep backward compatibility, this will act just like "common_cpu" did with "cpu". That is, "cpu" will be the same as "common_cpu" unless the event has a "cpu" field. In which case, the event's field is used. The same is true with "stacktrace". Also update the documentation to reflect this change. Link: https://lore.kernel.org/linux-trace-kernel/20230523230913.6860e28d@rorschach.local.home Cc: Masami Hiramatsu Cc: Tom Zanussi Cc: Mark Rutland Signed-off-by: Steven Rostedt (Google) commit d6c36cbc5e533f48bd89a7b5f339bd82b8b4378a Author: Sebastian Andrzej Siewior Date: Mon May 22 15:41:21 2023 +0200 r8169: Use a raw_spinlock_t for the register locks. The driver's interrupt service routine is requested with the IRQF_NO_THREAD if MSI is available. This means that the routine is invoked in hardirq context even on PREEMPT_RT. The routine itself is relatively short and schedules a worker, performs register access and schedules NAPI. On PREEMPT_RT, scheduling NAPI from hardirq results in waking ksoftirqd for further processing so using NAPI threads with this driver is highly recommended since it NULL routes the threaded-IRQ efforts. Adding rtl_hw_aspm_clkreq_enable() to the ISR is problematic on PREEMPT_RT because the function uses spinlock_t locks which become sleeping locks on PREEMPT_RT. The locks are only used to protect register access and don't nest into other functions or locks. They are also not used for unbounded period of time. Therefore it looks okay to convert them to raw_spinlock_t. Convert the three locks which are used from the interrupt service routine to raw_spinlock_t. Fixes: e1ed3e4d9111 ("r8169: disable ASPM during NAPI poll") Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Heiner Kallweit Link: https://lore.kernel.org/r/20230522134121.uxjax0F5@linutronix.de Signed-off-by: Jakub Kicinski commit 368d3cb406cdd074d1df2ad9ec06d1bfcb664882 Author: Yunsheng Lin Date: Mon May 22 11:17:14 2023 +0800 page_pool: fix inconsistency for page_pool_ring_[un]lock() page_pool_ring_[un]lock() use in_softirq() to decide which spin lock variant to use, and when they are called in the context with in_softirq() being false, spin_lock_bh() is called in page_pool_ring_lock() while spin_unlock() is called in page_pool_ring_unlock(), because spin_lock_bh() has disabled the softirq in page_pool_ring_lock(), which causes inconsistency for spin lock pair calling. This patch fixes it by returning in_softirq state from page_pool_producer_lock(), and use it to decide which spin lock variant to use in page_pool_producer_unlock(). As pool->ring has both producer and consumer lock, so rename it to page_pool_producer_[un]lock() to reflect the actual usage. Also move them to page_pool.c as they are only used there, and remove the 'inline' as the compiler may have better idea to do inlining or not. Fixes: 7886244736a4 ("net: page_pool: Add bulk support for ptr_ring") Signed-off-by: Yunsheng Lin Acked-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Link: https://lore.kernel.org/r/20230522031714.5089-1-linyunsheng@huawei.com Signed-off-by: Jakub Kicinski commit e30fbc618e97b38dbb49f1d44dcd0778d3f23b8c Author: Steven Rostedt (Google) Date: Tue May 23 22:11:08 2023 -0400 tracing/histograms: Allow variables to have some modifiers Modifiers are used to change the behavior of keys. For instance, they can grouped into buckets, converted to syscall names (from the syscall identifier), show task->comm of the current pid, be an array of longs that represent a stacktrace, and more. It was found that nothing stopped a value from taking a modifier. As values are simple counters. If this happened, it would call code that was not expecting a modifier and crash the kernel. This was fixed by having the ___create_val_field() function test if a modifier was present and fail if one was. This fixed the crash. Now there's a problem with variables. Variables are used to pass fields from one event to another. Variables are allowed to have some modifiers, as the processing may need to happen at the time of the event (like stacktraces and comm names of the current pid). The issue is that it too uses __create_val_field(). Now that fails on modifiers, variables can no longer use them (this is a regression). As not all modifiers are for variables, have them use a separate check. Link: https://lore.kernel.org/linux-trace-kernel/20230523221108.064a5d82@rorschach.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Tom Zanussi Cc: Mark Rutland Fixes: e0213434fe3e4 ("tracing: Do not let histogram values have some modifiers") Signed-off-by: Steven Rostedt (Google) commit 9d646009f65d62d32815f376465a3b92d8d9b046 Merge: 27e462c8fad4b 95a9359ee22ff Author: Linus Torvalds Date: Tue May 23 19:18:06 2023 -0700 Merge tag 'tpmdd-v6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fix from Jarkko Sakkinen: "A fix to add a new entry to the deny for list for tpm_tis interrupts" * tag 'tpmdd-v6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: tpm_tis: Disable interrupts for AEON UPX-i11 commit ff9e1632d69e596d8ca256deb07433a8f3565038 Author: Beau Belgrave Date: Fri May 19 16:07:41 2023 -0700 tracing/user_events: Document user_event_mm one-shot list usage During 6.4 development it became clear that the one-shot list used by the user_event_mm's next field was confusing to others. It is not clear how this list is protected or what the next field usage is for unless you are familiar with the code. Add comments into the user_event_mm struct indicating lock requirement and usage. Also document how and why this approach was used via comments in both user_event_enabler_update() and user_event_mm_get_all() and the rules to properly use it. Link: https://lkml.kernel.org/r/20230519230741.669-5-beaub@linux.microsoft.com Link: https://lore.kernel.org/linux-trace-kernel/CAHk-=wicngggxVpbnrYHjRTwGE0WYscPRM+L2HO2BF8ia1EXgQ@mail.gmail.com/ Suggested-by: Linus Torvalds Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit dcbd1ac2668b5fa02069ea96d581ca3f70a7543c Author: Beau Belgrave Date: Fri May 19 16:07:40 2023 -0700 tracing/user_events: Rename link fields for clarity Currently most list_head fields of various structs within user_events are simply named link. This causes folks to keep additional context in their head when working with the code, which can be confusing. Instead of using link, describe what the actual link is, for example: list_del_rcu(&mm->link); Changes into: list_del_rcu(&mm->mms_link); The reader now is given a hint the link is to the mms global list instead of having to remember or spot check within the code. Link: https://lkml.kernel.org/r/20230519230741.669-4-beaub@linux.microsoft.com Link: https://lore.kernel.org/linux-trace-kernel/CAHk-=wicngggxVpbnrYHjRTwGE0WYscPRM+L2HO2BF8ia1EXgQ@mail.gmail.com/ Suggested-by: Linus Torvalds Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit aaecdaf922835ed9a8ce56cdd9a8d40fe630257a Author: Linus Torvalds Date: Fri May 19 16:07:39 2023 -0700 tracing/user_events: Remove RCU lock while pinning pages pin_user_pages_remote() can reschedule which means we cannot hold any RCU lock while using it. Now that enablers are not exposed out to the tracing register callbacks during fork(), there is clearly no need to require the RCU lock as event_mutex is enough to protect changes. Remove unneeded RCU usages when pinning pages and walking enablers with event_mutex held. Cleanup a misleading "safe" list walk that is not needed. During fork() duplication, remove unneeded RCU list add, since the list is not exposed yet. Link: https://lkml.kernel.org/r/20230519230741.669-3-beaub@linux.microsoft.com Link: https://lore.kernel.org/linux-trace-kernel/CAHk-=wiiBfT4zNS29jA0XEsy8EmbqTH1hAPdRJCDAJMD8Gxt5A@mail.gmail.com/ Fixes: 7235759084a4 ("tracing/user_events: Use remote writes for event enablement") Signed-off-by: Linus Torvalds [ change log written by Beau Belgrave ] Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 3e0fea09b17fa2255f6cb0108bbffd4a505f8925 Author: Linus Torvalds Date: Fri May 19 16:07:38 2023 -0700 tracing/user_events: Split up mm alloc and attach When a new mm is being created in a fork() path it currently is allocated and then attached in one go. This leaves the mm exposed out to the tracing register callbacks while any parent enabler locations are copied in. This should not happen. Split up mm alloc and attach as unique operations. When duplicating enablers, first alloc, then duplicate, and only upon success, attach. This prevents any timing window outside of the event_reg mutex for enablement walking. This allows for dropping RCU requirement for enablement walking in later patches. Link: https://lkml.kernel.org/r/20230519230741.669-2-beaub@linux.microsoft.com Link: https://lore.kernel.org/linux-trace-kernel/CAHk-=whTBvXJuoi_kACo3qi5WZUmRrhyA-_=rRFsycTytmB6qw@mail.gmail.com/ Signed-off-by: Linus Torvalds [ change log written by Beau Belgrave ] Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 95a9359ee22ff2efbad6b090fcfa3a97f5902f95 Author: Peter Ujfalusi Date: Wed May 17 15:29:31 2023 +0300 tpm: tpm_tis: Disable interrupts for AEON UPX-i11 Interrupts got recently enabled for tpm_tis. The interrupts initially works on the device but they will stop arriving after circa ~200 interrupts. On system reboot/shutdown this will cause a long wait (120000 jiffies). [jarkko@kernel.org: fix a merge conflict and adjust the commit message] Fixes: e644b2f498d2 ("tpm, tpm_tis: Enable interrupt test") Signed-off-by: Peter Ujfalusi Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 27e462c8fad4bf04ec4f81f8539ce6fa947ead3a Merge: 5fe326b446768 034f4a7877c32 Author: Linus Torvalds Date: Tue May 23 15:21:34 2023 -0700 Merge tag 'xtensa-20230523' of https://github.com/jcmvbkbc/linux-xtensa Pull Xtensa fixes from Max Filippov: - fix signal delivery to FDPIC process - add __bswap{si,di}2 helpers * tag 'xtensa-20230523' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: add __bswap{si,di}2 helpers xtensa: fix signal delivery to FDPIC process commit 4be47a5d59cbc9396a6ffd327913eb4c8d67a32f Author: Daniel Golle Date: Mon May 1 19:33:14 2023 +0100 spi: mt65xx: make sure operations completed before unloading When unloading the spi-mt65xx kernel module during an ongoing spi-mem operation the kernel will Oops shortly after unloading the module. This is because wait_for_completion_timeout was still running and returning into the no longer loaded module: Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: [many, but spi-mt65xx is no longer there] CPU: 0 PID: 2578 Comm: block Tainted: G W O 6.3.0-next-20230428+ #0 Hardware name: Bananapi BPI-R3 (DT) pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __lock_acquire+0x18c/0x20e8 lr : __lock_acquire+0x9b8/0x20e8 sp : ffffffc009ec3400 x29: ffffffc009ec3400 x28: 0000000000000001 x27: 0000000000000004 x26: ffffff80082888c8 x25: 0000000000000000 x24: 0000000000000000 x23: ffffffc009609da8 x22: ffffff8008288000 x21: ffffff8008288968 x20: 00000000000003c2 x19: ffffff8008be7990 x18: 00000000000002af x17: 0000000000000000 x16: 0000000000000000 x15: ffffffc008d78970 x14: 000000000000080d x13: 00000000000002af x12: 00000000ffffffea x11: 00000000ffffefff x10: ffffffc008dd0970 x9 : ffffffc008d78918 x8 : 0000000000017fe8 x7 : 0000000000000001 x6 : 0000000000000000 x5 : ffffff807fb53910 x4 : 0000000000000000 x3 : 0000000000000027 x2 : 0000000000000027 x1 : 0000000000000000 x0 : 00000000000c03c2 Call trace: __lock_acquire+0x18c/0x20e8 lock_acquire+0x100/0x2a4 _raw_spin_lock_irq+0x58/0x74 __wait_for_common+0xe0/0x1b4 wait_for_completion_timeout+0x1c/0x24 0xffffffc000acc8a4 <--- used to be mtk_spi_transfer_wait spi_mem_exec_op+0x390/0x3ec spi_mem_no_dirmap_read+0x6c/0x88 spi_mem_dirmap_read+0xcc/0x12c spinand_read_page+0xf8/0x1dc spinand_mtd_read+0x1b4/0x2fc mtd_read_oob_std+0x58/0x7c mtd_read_oob+0x8c/0x148 mtd_read+0x50/0x6c ... Prevent this by completing in mtk_spi_remove if needed. Fixes: 9f763fd20da7 ("spi: mediatek: add spi memory support for ipm design") Signed-off-by: Daniel Golle Link: https://lore.kernel.org/r/ZFAF6pJxMu1z6k4w@makrotopia.org Signed-off-by: Mark Brown commit feee70f4568650cf44c573488798ffc0a2faeea3 Author: Ismael Ferreras Morezuelas Date: Tue May 23 14:45:10 2023 -0700 Input: xpad - delete a Razer DeathAdder mouse VID/PID entry While doing my research to improve the xpad device names I noticed that the 1532:0037 VID/PID seems to be used by the DeathAdder 2013, so that Razer Sabertooth instance looked wrong and very suspect to me. I didn't see any mention in the official drivers, either. After doing more research, it turns out that the xpad list is used by many other projects (like Steam) as-is [1], this issue was reported [2] and Valve/Sam Lantinga fixed it [3]: [1]: https://github.com/libsdl-org/SDL/blob/dcc5eef0e2395854b254ea2873a4899edab347c6/src/joystick/controller_type.h#L251 [2]: https://steamcommunity.com/app/353380/discussions/0/1743392486228754770/ [3]: https://hg.libsdl.org/SDL/rev/29809f6f0271 (With multiple Internet users reporting similar issues, not linked here) After not being able to find the correct VID/PID combination anywhere on the Internet and not receiving any reply from Razer support I did some additional detective work, it seems like it presents itself as "Razer Sabertooth Gaming Controller (XBOX360)", code 1689:FE00. Leaving us with this: * Razer Sabertooth (1689:fe00) * Razer Sabertooth Elite (24c6:5d04) * Razer DeathAdder 2013 (1532:0037) [note: not a gamepad] So, to sum things up; remove this conflicting/duplicate entry: { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, As the real/correct one is already present there, even if the Internet as a whole insists on presenting it as the Razer Sabertooth Elite, which (by all accounts) is not: { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, Actual change in SDL2 referencing this kernel issue: https://github.com/libsdl-org/SDL/commit/e5e54169754ca5d3e86339d968b20126d9da0a15 For more information of the device, take a look here: https://github.com/xboxdrv/xboxdrv/pull/59 You can see a lsusb dump here: https://github.com/xboxdrv/xboxdrv/files/76581/Qa6dBcrv.txt Fixes: f554f619b70 ("Input: xpad - sync device IDs with xboxdrv") Signed-off-by: Ismael Ferreras Morezuelas Reviewed-by: Cameron Gutman Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/5c12dbdb-5774-fc68-5c58-ca596383663e@gmail.com Signed-off-by: Dmitry Torokhov commit 011a8719d6105dcb48077ea7a6a88ac019d4aa50 Author: Maxim Kochetkov Date: Fri May 12 14:03:42 2023 +0300 ASoC: dwc: move DMA init to snd_soc_dai_driver probe() When using DMA mode we are facing with Oops: [ 396.458157] Unable to handle kernel access to user memory without uaccess routines at virtual address 000000000000000c [ 396.469374] Oops [#1] [ 396.471839] Modules linked in: [ 396.475144] CPU: 0 PID: 114 Comm: arecord Not tainted 6.0.0-00164-g9a8eccdaf2be-dirty #68 [ 396.483619] Hardware name: YMP ELCT FPGA (DT) [ 396.488156] epc : dmaengine_pcm_open+0x1d2/0x342 [ 396.493227] ra : dmaengine_pcm_open+0x1d2/0x342 [ 396.498140] epc : ffffffff807fe346 ra : ffffffff807fe346 sp : ffffffc804e138f0 [ 396.505602] gp : ffffffff817bf730 tp : ffffffd8042c8ac0 t0 : 6500000000000000 [ 396.513045] t1 : 0000000000000064 t2 : 656e69676e65616d s0 : ffffffc804e13990 [ 396.520477] s1 : ffffffd801b86a18 a0 : 0000000000000026 a1 : ffffffff816920f8 [ 396.527897] a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000 [ 396.535319] a5 : 0000000000000000 a6 : ffffffd801b87040 a7 : 0000000000000038 [ 396.542740] s2 : ffffffd801b94a00 s3 : 0000000000000000 s4 : ffffffd80427f5e8 [ 396.550153] s5 : ffffffd80427f5e8 s6 : ffffffd801b44410 s7 : fffffffffffffff5 [ 396.557569] s8 : 0000000000000800 s9 : 0000000000000001 s10: ffffffff8066d254 [ 396.564978] s11: ffffffd8059cf768 t3 : ffffffff817d5577 t4 : ffffffff817d5577 [ 396.572391] t5 : ffffffff817d5578 t6 : ffffffc804e136e8 [ 396.577876] status: 0000000200000120 badaddr: 000000000000000c cause: 000000000000000d [ 396.586007] [] snd_soc_component_open+0x1a/0x68 [ 396.592439] [] __soc_pcm_open+0xf0/0x502 [ 396.598217] [] soc_pcm_open+0x2e/0x4e [ 396.603741] [] snd_pcm_open_substream+0x442/0x68e [ 396.610313] [] snd_pcm_open+0xfa/0x212 [ 396.615868] [] snd_pcm_capture_open+0x3a/0x60 [ 396.622048] [] snd_open+0xa8/0x17a [ 396.627421] [] chrdev_open+0xa0/0x218 [ 396.632893] [] do_dentry_open+0x17c/0x2a6 [ 396.638713] [] vfs_open+0x1e/0x26 [ 396.643850] [] path_openat+0x96e/0xc96 [ 396.649518] [] do_filp_open+0x7c/0xf6 [ 396.655034] [] do_sys_openat2+0x8a/0x11e [ 396.660765] [] sys_openat+0x50/0x7c [ 396.666068] [] ret_from_syscall+0x0/0x2 [ 396.674964] ---[ end trace 0000000000000000 ]--- It happens because of play_dma_data/capture_dma_data pointers are NULL. Current implementation assigns these pointers at snd_soc_dai_driver startup() callback and reset them back to NULL at shutdown(). But soc_pcm_open() sequence uses DMA pointers in dmaengine_pcm_open() before snd_soc_dai_driver startup(). Most generic DMA capable I2S drivers use snd_soc_dai_driver probe() callback to init DMA pointers only once at probe. So move DMA init to dw_i2s_dai_probe and drop shutdown() and startup() callbacks. Signed-off-by: Maxim Kochetkov Link: https://lore.kernel.org/r/20230512110343.66664-1-fido_max@inbox.ru Signed-off-by: Mark Brown commit 4ef4aee67eed640064fff95a693c0184cedb7bec Author: David Howells Date: Tue May 23 13:48:41 2023 +0100 cifs: Fix cifs_limit_bvec_subset() to correctly check the maxmimum size Fix cifs_limit_bvec_subset() so that it limits the span to the maximum specified and won't return with a size greater than max_size. Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Cc: stable@vger.kernel.org # 6.3 Reported-by: Shyam Prasad N Reviewed-by: Shyam Prasad N Signed-off-by: David Howells cc: Steve French cc: Rohith Surabattula cc: Paulo Alcantara cc: Tom Talpey cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 4752354af71043e6fd72ef5490ed6da39e6cab4a Author: Yan Zhao Date: Fri May 19 14:58:43 2023 +0800 vfio/type1: check pfn valid before converting to struct page Check physical PFN is valid before converting the PFN to a struct page pointer to be returned to caller of vfio_pin_pages(). vfio_pin_pages() pins user pages with contiguous IOVA. If the IOVA of a user page to be pinned belongs to vma of vm_flags VM_PFNMAP, pin_user_pages_remote() will return -EFAULT without returning struct page address for this PFN. This is because usually this kind of PFN (e.g. MMIO PFN) has no valid struct page address associated. Upon this error, vaddr_get_pfns() will obtain the physical PFN directly. While previously vfio_pin_pages() returns to caller PFN arrays directly, after commit 34a255e67615 ("vfio: Replace phys_pfn with pages for vfio_pin_pages()"), PFNs will be converted to "struct page *" unconditionally and therefore the returned "struct page *" array may contain invalid struct page addresses. Given current in-tree users of vfio_pin_pages() only expect "struct page * returned, check PFN validity and return -EINVAL to let the caller be aware of IOVAs to be pinned containing PFN not able to be returned in "struct page *" array. So that, the caller will not consume the returned pointer (e.g. test PageReserved()) and avoid error like "supervisor read access in kernel mode". Fixes: 34a255e67615 ("vfio: Replace phys_pfn with pages for vfio_pin_pages()") Cc: Sean Christopherson Reviewed-by: Jason Gunthorpe Signed-off-by: Yan Zhao Reviewed-by: Sean Christopherson Link: https://lore.kernel.org/r/20230519065843.10653-1-yan.y.zhao@intel.com Signed-off-by: Alex Williamson commit 320805ab61e5f1e2a5729ae266e16bec2904050c Author: Michael Kelley Date: Thu May 18 08:13:52 2023 -0700 Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs vmbus_wait_for_unload() may be called in the panic path after other CPUs are stopped. vmbus_wait_for_unload() currently loops through online CPUs looking for the UNLOAD response message. But the values of CONFIG_KEXEC_CORE and crash_kexec_post_notifiers affect the path used to stop the other CPUs, and in one of the paths the stopped CPUs are removed from cpu_online_mask. This removal happens in both x86/x64 and arm64 architectures. In such a case, vmbus_wait_for_unload() only checks the panic'ing CPU, and misses the UNLOAD response message except when the panic'ing CPU is CPU 0. vmbus_wait_for_unload() eventually times out, but only after waiting 100 seconds. Fix this by looping through *present* CPUs in vmbus_wait_for_unload(). The cpu_present_mask is not modified by stopping the other CPUs in the panic path, nor should it be. Also, in a CoCo VM the synic_message_page is not allocated in hv_synic_alloc(), but is set and cleared in hv_synic_enable_regs() and hv_synic_disable_regs() such that it is set only when the CPU is online. If not all present CPUs are online when vmbus_wait_for_unload() is called, the synic_message_page might be NULL. Add a check for this. Fixes: cd95aad55793 ("Drivers: hv: vmbus: handle various crash scenarios") Cc: stable@vger.kernel.org Reported-by: John Starks Signed-off-by: Michael Kelley Reviewed-by: Vitaly Kuznetsov Link: https://lore.kernel.org/r/1684422832-38476-1-git-send-email-mikelley@microsoft.com Signed-off-by: Wei Liu commit 9728fb3ce11729aa8c276825ddf504edeb00611d Author: Clark Wang Date: Fri May 5 14:35:57 2023 +0800 spi: lpspi: disable lpspi module irq in DMA mode When all bits of IER are set to 0, we still can observe the lpspi irq events when using DMA mode to transfer data. So disable irq to avoid the too much irq events. Signed-off-by: Clark Wang Link: https://lore.kernel.org/r/20230505063557.3962220-1-xiaoning.wang@nxp.com Signed-off-by: Mark Brown commit e2d035f5a7d597bbabc268e236ec6c0408c4af0e Author: Stefan Binding Date: Fri Apr 14 16:25:51 2023 +0100 ASoC: cs35l41: Fix default regmap values for some registers Several values do not match the defaults of CS35L41, fix them. Signed-off-by: Stefan Binding Acked-by: Mark Brown Link: https://lore.kernel.org/r/20230414152552.574502-4-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit 5fe326b4467689ef3690491ee2ad25ff4d81fe59 Merge: ae8373a5add4e cf7f2732b4b83 Author: Linus Torvalds Date: Tue May 23 10:47:32 2023 -0700 Merge tag 'erofs-for-6.4-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "One patch addresses a null-ptr-deref issue reported by syzbot weeks ago, which is caused by the new long xattr name prefix feature and needs to be fixed. The remaining two patches are minor cleanups to avoid unnecessary compilation and adjust per-cpu kworker configuration. Summary: - Fix null-ptr-deref related to long xattr name prefixes - Avoid pcpubuf compilation if CONFIG_EROFS_FS_ZIP is off - Use high priority kthreads by default if per-cpu kthread workers are enabled" * tag 'erofs-for-6.4-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: use HIPRI by default if per-cpu kthreads are enabled erofs: avoid pcpubuf.c inclusion if CONFIG_EROFS_FS_ZIP is off erofs: fix null-ptr-deref caused by erofs_xattr_prefixes_init commit 46930b7cc7727271c9c27aac1fdc97a8645e2d00 Author: Anuj Gupta Date: Tue May 23 16:47:09 2023 +0530 block: fix bio-cache for passthru IO commit <8af870aa5b847> ("block: enable bio caching use for passthru IO") introduced bio-cache for passthru IO. In case when nr_vecs are greater than BIO_INLINE_VECS, bio and bvecs are allocated from mempool (instead of percpu cache) and REQ_ALLOC_CACHE is cleared. This causes the side effect of not freeing bio/bvecs into mempool on completion. This patch lets the passthru IO fallback to allocation using bio_kmalloc when nr_vecs are greater than BIO_INLINE_VECS. The corresponding bio is freed during call to blk_mq_map_bio_put during completion. Cc: stable@vger.kernel.org # 6.1 fixes <8af870aa5b847> ("block: enable bio caching use for passthru IO") Signed-off-by: Anuj Gupta Signed-off-by: Kanchan Joshi Link: https://lore.kernel.org/r/20230523111709.145676-1-anuj20.g@samsung.com Signed-off-by: Jens Axboe commit da8d2fe717db06c9cf36b51e4628b2c0ece35b43 Author: Paolo Valente Date: Tue May 23 11:17:24 2023 +0200 block, bfq: update Paolo's address in maintainer list Current email address of Paolo Valente is no longer valid, use a good one. Signed-off-by: Paolo Valente Link: https://lore.kernel.org/r/20230523091724.26636-1-paolo.valente@unimore.it Signed-off-by: Jens Axboe commit 3e94d54e83cafd2b562bb6d15bb2f72d76200fb5 Author: Tian Lan Date: Mon May 22 17:05:55 2023 -0400 blk-mq: fix race condition in active queue accounting If multiple CPUs are sharing the same hardware queue, it can cause leak in the active queue counter tracking when __blk_mq_tag_busy() is executed simultaneously. Fixes: ee78ec1077d3 ("blk-mq: blk_mq_tag_busy is no need to return a value") Signed-off-by: Tian Lan Reviewed-by: Ming Lei Reviewed-by: Damien Le Moal Reviewed-by: John Garry Link: https://lore.kernel.org/r/20230522210555.794134-1-tilan7663@gmail.com Signed-off-by: Jens Axboe commit 8a2b20a997a3779ae9fcae268f2959eb82ec05a1 Author: Yu Kuai Date: Mon May 22 20:18:54 2023 +0800 blk-wbt: fix that wbt can't be disabled by default commit b11d31ae01e6 ("blk-wbt: remove unnecessary check in wbt_enable_default()") removes the checking of CONFIG_BLK_WBT_MQ by mistake, which is used to control enable or disable wbt by default. Fix the problem by adding back the checking. This patch also do a litter cleanup to make related code more readable. Fixes: b11d31ae01e6 ("blk-wbt: remove unnecessary check in wbt_enable_default()") Reported-by: Lukas Bulwahn Link: https://lore.kernel.org/lkml/CAKXUXMzfKq_J9nKHGyr5P5rvUETY4B-fxoQD4sO+NYjFOfVtZA@mail.gmail.com/t/ Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230522121854.2928880-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit b6405f0829d7b1dd926ba3ca5f691cab835abfaa Author: Helge Deller Date: Fri May 19 12:12:06 2023 +0200 parisc: Use num_present_cpus() in alternative patching code When patching the kernel code some alternatives depend on SMP vs. !SMP. Use the value of num_present_cpus() instead of num_online_cpus() to decide, otherwise we may run into issues if and additional CPU is enabled after having loaded a module while only one CPU was enabled. Signed-off-by: Helge Deller Cc: # v6.1+ commit 632478a05821bc1c9b55c3a1dd0fb1be7bfa1acc Author: Daniel Bristot de Oliveira Date: Thu May 11 18:32:01 2023 +0200 tracing/timerlat: Always wakeup the timerlat thread While testing rtla timerlat auto analysis, I reach a condition where the interface was not receiving tracing data. I was able to manually reproduce the problem with these steps: # echo 0 > tracing_on # disable trace # echo 1 > osnoise/stop_tracing_us # stop trace if timerlat irq > 1 us # echo timerlat > current_tracer # enable timerlat tracer # sleep 1 # wait... that is the time when rtla # apply configs like prio or cgroup # echo 1 > tracing_on # start tracing # cat trace # tracer: timerlat # # _-----=> irqs-off # / _----=> need-resched # | / _---=> hardirq/softirq # || / _--=> preempt-depth # ||| / _-=> migrate-disable # |||| / delay # ||||| ACTIVATION # TASK-PID CPU# ||||| TIMESTAMP ID CONTEXT LATENCY # | | | ||||| | | | | NOTHING! Then, trying to enable tracing again with echo 1 > tracing_on resulted in no change: the trace was still not tracing. This problem happens because the timerlat IRQ hits the stop tracing condition while tracing is off, and do not wake up the timerlat thread, so the timerlat threads are kept sleeping forever, resulting in no trace, even after re-enabling the tracer. Avoid this condition by always waking up the threads, even after stopping tracing, allowing the tracer to return to its normal operating after a new tracing on. Link: https://lore.kernel.org/linux-trace-kernel/1ed8f830638b20a39d535d27d908e319a9a3c4e2.1683822622.git.bristot@kernel.org Cc: Juri Lelli Cc: stable@vger.kernel.org Fixes: a955d7eac177 ("trace: Add timerlat tracer") Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit e997c218ad736fd6f524d73a987bad9d94128d3d Author: Jeffrey Hugo Date: Wed May 17 13:35:40 2023 -0600 accel/qaic: Fix NNC message corruption If msg_xfer() is unable to queue part of a NNC message because the MHI ring is full, it will attempt to give the QSM some time to drain the queue. However, if QSM fails to make any room, msg_xfer() will fail and tell the caller to try again. This is problematic because part of the message may have been committed to the ring and there is no mechanism to revoke that content. This will cause QSM to receive a corrupt message. The better way to do this is to check if the ring has enough space for the entire message before committing any of the message. Since msg_xfer() is under the cntl_mutex no one else can come in and consume the space. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Jeffrey Hugo Reviewed-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Carl Vanderlip Link: https://patchwork.freedesktop.org/patch/msgid/20230517193540.14323-6-quic_jhugo@quicinc.com commit 75af0a585af93183ba68bb1b45d0d7a61e963712 Author: Pranjal Ramajor Asha Kanojiya Date: Wed May 17 13:35:39 2023 -0600 accel/qaic: Grab ch_lock during QAIC_ATTACH_SLICE_BO During QAIC_ATTACH_SLICE_BO, we associate a BO to its DBC. We need to grab the dbc->ch_lock to make sure that DBC does not goes away while QAIC_ATTACH_SLICE_BO is still running. Fixes: ff13be830333 ("accel/qaic: Add datapath") Signed-off-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Carl Vanderlip Reviewed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/20230517193540.14323-5-quic_jhugo@quicinc.com commit faa7c4eee412ca14dd6a107cb6122d31c4277cbe Author: Pranjal Ramajor Asha Kanojiya Date: Wed May 17 13:35:38 2023 -0600 accel/qaic: Flush the transfer list again Before calling synchronize_srcu() we clear the transfer list, this is to allow all the QAIC_WAIT_BO callers to exit otherwise the system could deadlock. There could be a corner case where more elements get added to transfer list after we have flushed it. Re-flush the transfer list once all the holders of dbc->ch_lock have completed execution i.e. synchronize_srcu() is complete. Fixes: ff13be830333 ("accel/qaic: Add datapath") Signed-off-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Carl Vanderlip Reviewed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/20230517193540.14323-4-quic_jhugo@quicinc.com commit 2e0904efc945ed5b04a9b251b9cefdd6754f5e15 Author: Pranjal Ramajor Asha Kanojiya Date: Wed May 17 13:35:37 2023 -0600 accel/qaic: Validate if BO is sliced before slicing QAIC_ATTACH_SLICE_BO attaches slicing configuration to a BO. Validate if given BO is already sliced. An already sliced BO cannot be sliced again. Fixes: ff13be830333 ("accel/qaic: Add datapath") Signed-off-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Carl Vanderlip Reviewed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/20230517193540.14323-3-quic_jhugo@quicinc.com commit d3b277b7aa1c74a65c84019b8fbe7856f841841a Author: Pranjal Ramajor Asha Kanojiya Date: Wed May 17 13:35:36 2023 -0600 accel/qaic: Validate user data before grabbing any lock Validating user data does not need to be protected by any lock and it is safe to move it out of critical region. Fixes: ff13be830333 ("accel/qaic: Add datapath") Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Carl Vanderlip Reviewed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/20230517193540.14323-2-quic_jhugo@quicinc.com commit 0e163e54c34c12369ccf6562e74e8f0a800f4aad Author: Tom Rix Date: Wed May 17 10:56:05 2023 -0600 accel/qaic: initialize ret variable to 0 clang static analysis reports drivers/accel/qaic/qaic_data.c:610:2: warning: Undefined or garbage value returned to caller [core.uninitialized.UndefReturn] return ret; ^~~~~~~~~~ From a code analysis of the function, the ret variable is only set some of the time but is always returned. This suggests ret can return uninitialized garbage. However BO allocation will ensure ret is always set in reality. Initialize ret to 0 to silence the warning. Fixes: ff13be830333 ("accel/qaic: Add datapath") Signed-off-by: Tom Rix [jhugo: Reword commit text] Signed-off-by: Jeffrey Hugo Reviewed-by: Carl Vanderlip Reviewed-by: Pranjal Ramajor Asha Kanojiya Link: https://patchwork.freedesktop.org/patch/msgid/20230517165605.16770-1-quic_jhugo@quicinc.com commit ee7751b564a90f337330efc1221df40647d68756 Author: Beau Belgrave Date: Fri May 5 13:58:55 2023 -0700 tracing/user_events: Use long vs int for atomic bit ops Each event stores a int to track which bit to set/clear when enablement changes. On big endian 64-bit configurations, it's possible this could cause memory corruption when it's used for atomic bit operations. Use unsigned long for enablement values to ensure any possible corruption cannot occur. Downcast to int after mask for the bit target. Link: https://lore.kernel.org/all/6f758683-4e5e-41c3-9b05-9efc703e827c@kili.mountain/ Link: https://lore.kernel.org/linux-trace-kernel/20230505205855.6407-1-beaub@linux.microsoft.com Fixes: dcb8177c1395 ("tracing/user_events: Add ioctl for disabling addresses") Reported-by: Dan Carpenter Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit f726e03564ef4e754dd93beb54303e2e1671049e Author: John Fastabend Date: Mon May 22 19:56:18 2023 -0700 bpf, sockmap: Test progs verifier error with latest clang With a relatively recent clang (7090c10273119) and with this commit to fix warnings in selftests (c8ed668593972) that uses __sink(err) to resolve unused variables. We get the following verifier error. root@6e731a24b33a:/host/tools/testing/selftests/bpf# ./test_sockmap libbpf: prog 'bpf_sockmap': BPF program load failed: Permission denied libbpf: prog 'bpf_sockmap': -- BEGIN PROG LOAD LOG -- 0: R1=ctx(off=0,imm=0) R10=fp0 ; op = (int) skops->op; 0: (61) r2 = *(u32 *)(r1 +0) ; R1=ctx(off=0,imm=0) R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) ; switch (op) { 1: (16) if w2 == 0x4 goto pc+5 ; R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) 2: (56) if w2 != 0x5 goto pc+15 ; R2_w=5 ; lport = skops->local_port; 3: (61) r2 = *(u32 *)(r1 +68) ; R1=ctx(off=0,imm=0) R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) ; if (lport == 10000) { 4: (56) if w2 != 0x2710 goto pc+13 18: R1=ctx(off=0,imm=0) R2=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) R10=fp0 ; __sink(err); 18: (bc) w1 = w0 R0 !read_ok processed 18 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 1 -- END PROG LOAD LOG -- libbpf: prog 'bpf_sockmap': failed to load: -13 libbpf: failed to load object 'test_sockmap_kern.bpf.o' load_bpf_file: (-1) No such file or directory ERROR: (-1) load bpf failed libbpf: prog 'bpf_sockmap': BPF program load failed: Permission denied libbpf: prog 'bpf_sockmap': -- BEGIN PROG LOAD LOG -- 0: R1=ctx(off=0,imm=0) R10=fp0 ; op = (int) skops->op; 0: (61) r2 = *(u32 *)(r1 +0) ; R1=ctx(off=0,imm=0) R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) ; switch (op) { 1: (16) if w2 == 0x4 goto pc+5 ; R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) 2: (56) if w2 != 0x5 goto pc+15 ; R2_w=5 ; lport = skops->local_port; 3: (61) r2 = *(u32 *)(r1 +68) ; R1=ctx(off=0,imm=0) R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) ; if (lport == 10000) { 4: (56) if w2 != 0x2710 goto pc+13 18: R1=ctx(off=0,imm=0) R2=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) R10=fp0 ; __sink(err); 18: (bc) w1 = w0 R0 !read_ok processed 18 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 1 -- END PROG LOAD LOG -- libbpf: prog 'bpf_sockmap': failed to load: -13 libbpf: failed to load object 'test_sockhash_kern.bpf.o' load_bpf_file: (-1) No such file or directory ERROR: (-1) load bpf failed libbpf: prog 'bpf_sockmap': BPF program load failed: Permission denied libbpf: prog 'bpf_sockmap': -- BEGIN PROG LOAD LOG -- 0: R1=ctx(off=0,imm=0) R10=fp0 ; op = (int) skops->op; 0: (61) r2 = *(u32 *)(r1 +0) ; R1=ctx(off=0,imm=0) R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) ; switch (op) { 1: (16) if w2 == 0x4 goto pc+5 ; R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) 2: (56) if w2 != 0x5 goto pc+15 ; R2_w=5 ; lport = skops->local_port; 3: (61) r2 = *(u32 *)(r1 +68) ; R1=ctx(off=0,imm=0) R2_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) ; if (lport == 10000) { 4: (56) if w2 != 0x2710 goto pc+13 18: R1=ctx(off=0,imm=0) R2=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) R10=fp0 ; __sink(err); 18: (bc) w1 = w0 R0 !read_ok processed 18 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 1 -- END PROG LOAD LOG -- To fix simply remove the err value because its not actually used anywhere in the testing. We can investigate the root cause later. Future patch should probably actually test the err value as well. Although if the map updates fail they will get caught eventually by userspace. Fixes: c8ed668593972 ("selftests/bpf: fix lots of silly mistakes pointed out by compiler") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-15-john.fastabend@gmail.com commit 80e24d22267597b2ace54686735e3c4cb26a523f Author: John Fastabend Date: Mon May 22 19:56:17 2023 -0700 bpf, sockmap: Test FIONREAD returns correct bytes in rx buffer with drops When BPF program drops pkts the sockmap logic 'eats' the packet and updates copied_seq. In the PASS case where the sk_buff is accepted we update copied_seq from recvmsg path so we need a new test to handle the drop case. Original patch series broke this resulting in test_sockmap_skb_verdict_fionread:PASS:ioctl(FIONREAD) error 0 nsec test_sockmap_skb_verdict_fionread:FAIL:ioctl(FIONREAD) unexpected ioctl(FIONREAD): actual 1503041772 != expected 256 After updated patch with fix. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-14-john.fastabend@gmail.com commit bb516f98c731cafe27900f43c0ef0aa7b5a9a44b Author: John Fastabend Date: Mon May 22 19:56:16 2023 -0700 bpf, sockmap: Test FIONREAD returns correct bytes in rx buffer A bug was reported where ioctl(FIONREAD) returned zero even though the socket with a SK_SKB verdict program attached had bytes in the msg queue. The result is programs may hang or more likely try to recover, but use suboptimal buffer sizes. Add a test to check that ioctl(FIONREAD) returns the correct number of bytes. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-13-john.fastabend@gmail.com commit 1fa1fe8ff161cc34620e31295235dc1e6d0dce77 Author: John Fastabend Date: Mon May 22 19:56:15 2023 -0700 bpf, sockmap: Test shutdown() correctly exits epoll and recv()=0 When session gracefully shutdowns epoll needs to wake up and any recv() readers should return 0 not the -EAGAIN they previously returned. Note we use epoll instead of select to test the epoll wake on shutdown event as well. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-12-john.fastabend@gmail.com commit 298970c8af9d73a9f3df4ac871a4456f87fd4cab Author: John Fastabend Date: Mon May 22 19:56:14 2023 -0700 bpf, sockmap: Build helper to create connected socket pair A common operation for testing is to spin up a pair of sockets that are connected. Then we can use these to run specific tests that need to send data, check BPF programs and so on. The sockmap_listen programs already have this logic lets move it into the new sockmap_helpers header file for general use. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-11-john.fastabend@gmail.com commit 4e02588d9a95b21f8d25d66cb6c24f9df1532f6b Author: John Fastabend Date: Mon May 22 19:56:13 2023 -0700 bpf, sockmap: Pull socket helpers out of listen test for general use No functional change here we merely pull the helpers in sockmap_listen.c into a header file so we can use these in other programs. The tests we are about to add aren't really _listen tests so doesn't make sense to add them here. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-10-john.fastabend@gmail.com commit e5c6de5fa025882babf89cecbed80acf49b987fa Author: John Fastabend Date: Mon May 22 19:56:12 2023 -0700 bpf, sockmap: Incorrectly handling copied_seq The read_skb() logic is incrementing the tcp->copied_seq which is used for among other things calculating how many outstanding bytes can be read by the application. This results in application errors, if the application does an ioctl(FIONREAD) we return zero because this is calculated from the copied_seq value. To fix this we move tcp->copied_seq accounting into the recv handler so that we update these when the recvmsg() hook is called and data is in fact copied into user buffers. This gives an accurate FIONREAD value as expected and improves ACK handling. Before we were calling the tcp_rcv_space_adjust() which would update 'number of bytes copied to user in last RTT' which is wrong for programs returning SK_PASS. The bytes are only copied to the user when recvmsg is handled. Doing the fix for recvmsg is straightforward, but fixing redirect and SK_DROP pkts is a bit tricker. Build a tcp_psock_eat() helper and then call this from skmsg handlers. This fixes another issue where a broken socket with a BPF program doing a resubmit could hang the receiver. This happened because although read_skb() consumed the skb through sock_drop() it did not update the copied_seq. Now if a single reccv socket is redirecting to many sockets (for example for lb) the receiver sk will be hung even though we might expect it to continue. The hang comes from not updating the copied_seq numbers and memory pressure resulting from that. We have a slight layer problem of calling tcp_eat_skb even if its not a TCP socket. To fix we could refactor and create per type receiver handlers. I decided this is more work than we want in the fix and we already have some small tweaks depending on caller that use the helper skb_bpf_strparser(). So we extend that a bit and always set the strparser bit when it is in use and then we can gate the seq_copied updates on this. Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-9-john.fastabend@gmail.com commit 6df7f764cd3cf5a03a4a47b23be47e57e41fcd85 Author: John Fastabend Date: Mon May 22 19:56:11 2023 -0700 bpf, sockmap: Wake up polling after data copy When TCP stack has data ready to read sk_data_ready() is called. Sockmap overwrites this with its own handler to call into BPF verdict program. But, the original TCP socket had sock_def_readable that would additionally wake up any user space waiters with sk_wake_async(). Sockmap saved the callback when the socket was created so call the saved data ready callback and then we can wake up any epoll() logic waiting on the read. Note we call on 'copied >= 0' to account for returning 0 when a FIN is received because we need to wake up user for this as well so they can do the recvmsg() -> 0 and detect the shutdown. Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-8-john.fastabend@gmail.com commit ea444185a6bf7da4dd0df1598ee953e4f7174858 Author: John Fastabend Date: Mon May 22 19:56:10 2023 -0700 bpf, sockmap: TCP data stall on recv before accept A common mechanism to put a TCP socket into the sockmap is to hook the BPF_SOCK_OPS_{ACTIVE_PASSIVE}_ESTABLISHED_CB event with a BPF program that can map the socket info to the correct BPF verdict parser. When the user adds the socket to the map the psock is created and the new ops are assigned to ensure the verdict program will 'see' the sk_buffs as they arrive. Part of this process hooks the sk_data_ready op with a BPF specific handler to wake up the BPF verdict program when data is ready to read. The logic is simple enough (posted here for easy reading) static void sk_psock_verdict_data_ready(struct sock *sk) { struct socket *sock = sk->sk_socket; if (unlikely(!sock || !sock->ops || !sock->ops->read_skb)) return; sock->ops->read_skb(sk, sk_psock_verdict_recv); } The oversight here is sk->sk_socket is not assigned until the application accepts() the new socket. However, its entirely ok for the peer application to do a connect() followed immediately by sends. The socket on the receiver is sitting on the backlog queue of the listening socket until its accepted and the data is queued up. If the peer never accepts the socket or is slow it will eventually hit data limits and rate limit the session. But, important for BPF sockmap hooks when this data is received TCP stack does the sk_data_ready() call but the read_skb() for this data is never called because sk_socket is missing. The data sits on the sk_receive_queue. Then once the socket is accepted if we never receive more data from the peer there will be no further sk_data_ready calls and all the data is still on the sk_receive_queue(). Then user calls recvmsg after accept() and for TCP sockets in sockmap we use the tcp_bpf_recvmsg_parser() handler. The handler checks for data in the sk_msg ingress queue expecting that the BPF program has already run from the sk_data_ready hook and enqueued the data as needed. So we are stuck. To fix do an unlikely check in recvmsg handler for data on the sk_receive_queue and if it exists wake up data_ready. We have the sock locked in both read_skb and recvmsg so should avoid having multiple runners. Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-7-john.fastabend@gmail.com commit 901546fd8f9ca4b5c481ce00928ab425ce9aacc0 Author: John Fastabend Date: Mon May 22 19:56:09 2023 -0700 bpf, sockmap: Handle fin correctly The sockmap code is returning EAGAIN after a FIN packet is received and no more data is on the receive queue. Correct behavior is to return 0 to the user and the user can then close the socket. The EAGAIN causes many apps to retry which masks the problem. Eventually the socket is evicted from the sockmap because its released from sockmap sock free handling. The issue creates a delay and can cause some errors on application side. To fix this check on sk_msg_recvmsg side if length is zero and FIN flag is set then set return to zero. A selftest will be added to check this condition. Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Tested-by: William Findlay Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-6-john.fastabend@gmail.com commit 405df89dd52cbcd69a3cd7d9a10d64de38f854b2 Author: John Fastabend Date: Mon May 22 19:56:08 2023 -0700 bpf, sockmap: Improved check for empty queue We noticed some rare sk_buffs were stepping past the queue when system was under memory pressure. The general theory is to skip enqueueing sk_buffs when its not necessary which is the normal case with a system that is properly provisioned for the task, no memory pressure and enough cpu assigned. But, if we can't allocate memory due to an ENOMEM error when enqueueing the sk_buff into the sockmap receive queue we push it onto a delayed workqueue to retry later. When a new sk_buff is received we then check if that queue is empty. However, there is a problem with simply checking the queue length. When a sk_buff is being processed from the ingress queue but not yet on the sockmap msg receive queue its possible to also recv a sk_buff through normal path. It will check the ingress queue which is zero and then skip ahead of the pkt being processed. Previously we used sock lock from both contexts which made the problem harder to hit, but not impossible. To fix instead of popping the skb from the queue entirely we peek the skb from the queue and do the copy there. This ensures checks to the queue length are non-zero while skb is being processed. Then finally when the entire skb has been copied to user space queue or another socket we pop it off the queue. This way the queue length check allows bypassing the queue only after the list has been completely processed. To reproduce issue we run NGINX compliance test with sockmap running and observe some flakes in our testing that we attributed to this issue. Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Suggested-by: Jakub Sitnicki Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Tested-by: William Findlay Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-5-john.fastabend@gmail.com commit bce22552f92ea7c577f49839b8e8f7d29afaf880 Author: John Fastabend Date: Mon May 22 19:56:07 2023 -0700 bpf, sockmap: Reschedule is now done through backlog Now that the backlog manages the reschedule() logic correctly we can drop the partial fix to reschedule from recvmsg hook. Rescheduling on recvmsg hook was added to address a corner case where we still had data in the backlog state but had nothing to kick it and reschedule the backlog worker to run and finish copying data out of the state. This had a couple limitations, first it required user space to kick it introducing an unnecessary EBUSY and retry. Second it only handled the ingress case and egress redirects would still be hung. With the correct fix, pushing the reschedule logic down to where the enomem error occurs we can drop this fix. Fixes: bec217197b412 ("skmsg: Schedule psock work if the cached skb exists on the psock") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-4-john.fastabend@gmail.com commit 29173d07f79883ac94f5570294f98af3d4287382 Author: John Fastabend Date: Mon May 22 19:56:06 2023 -0700 bpf, sockmap: Convert schedule_work into delayed_work Sk_buffs are fed into sockmap verdict programs either from a strparser (when the user might want to decide how framing of skb is done by attaching another parser program) or directly through tcp_read_sock. The tcp_read_sock is the preferred method for performance when the BPF logic is a stream parser. The flow for Cilium's common use case with a stream parser is, tcp_read_sock() sk_psock_verdict_recv ret = bpf_prog_run_pin_on_cpu() sk_psock_verdict_apply(sock, skb, ret) // if system is under memory pressure or app is slow we may // need to queue skb. Do this queuing through ingress_skb and // then kick timer to wake up handler skb_queue_tail(ingress_skb, skb) schedule_work(work); The work queue is wired up to sk_psock_backlog(). This will then walk the ingress_skb skb list that holds our sk_buffs that could not be handled, but should be OK to run at some later point. However, its possible that the workqueue doing this work still hits an error when sending the skb. When this happens the skbuff is requeued on a temporary 'state' struct kept with the workqueue. This is necessary because its possible to partially send an skbuff before hitting an error and we need to know how and where to restart when the workqueue runs next. Now for the trouble, we don't rekick the workqueue. This can cause a stall where the skbuff we just cached on the state variable might never be sent. This happens when its the last packet in a flow and no further packets come along that would cause the system to kick the workqueue from that side. To fix we could do simple schedule_work(), but while under memory pressure it makes sense to back off some instead of continue to retry repeatedly. So instead to fix convert schedule_work to schedule_delayed_work and add backoff logic to reschedule from backlog queue on errors. Its not obvious though what a good backoff is so use '1'. To test we observed some flakes whil running NGINX compliance test with sockmap we attributed these failed test to this bug and subsequent issue. >From on list discussion. This commit bec217197b41("skmsg: Schedule psock work if the cached skb exists on the psock") was intended to address similar race, but had a couple cases it missed. Most obvious it only accounted for receiving traffic on the local socket so if redirecting into another socket we could still get an sk_buff stuck here. Next it missed the case where copied=0 in the recv() handler and then we wouldn't kick the scheduler. Also its sub-optimal to require userspace to kick the internal mechanisms of sockmap to wake it up and copy data to user. It results in an extra syscall and requires the app to actual handle the EAGAIN correctly. Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Tested-by: William Findlay Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-3-john.fastabend@gmail.com commit 78fa0d61d97a728d306b0c23d353c0e340756437 Author: John Fastabend Date: Mon May 22 19:56:05 2023 -0700 bpf, sockmap: Pass skb ownership through read_skb The read_skb hook calls consume_skb() now, but this means that if the recv_actor program wants to use the skb it needs to inc the ref cnt so that the consume_skb() doesn't kfree the sk_buff. This is problematic because in some error cases under memory pressure we may need to linearize the sk_buff from sk_psock_skb_ingress_enqueue(). Then we get this, skb_linearize() __pskb_pull_tail() pskb_expand_head() BUG_ON(skb_shared(skb)) Because we incremented users refcnt from sk_psock_verdict_recv() we hit the bug on with refcnt > 1 and trip it. To fix lets simply pass ownership of the sk_buff through the skb_read call. Then we can drop the consume from read_skb handlers and assume the verdict recv does any required kfree. Bug found while testing in our CI which runs in VMs that hit memory constraints rather regularly. William tested TCP read_skb handlers. [ 106.536188] ------------[ cut here ]------------ [ 106.536197] kernel BUG at net/core/skbuff.c:1693! [ 106.536479] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 106.536726] CPU: 3 PID: 1495 Comm: curl Not tainted 5.19.0-rc5 #1 [ 106.537023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.16.0-1 04/01/2014 [ 106.537467] RIP: 0010:pskb_expand_head+0x269/0x330 [ 106.538585] RSP: 0018:ffffc90000138b68 EFLAGS: 00010202 [ 106.538839] RAX: 000000000000003f RBX: ffff8881048940e8 RCX: 0000000000000a20 [ 106.539186] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff8881048940e8 [ 106.539529] RBP: ffffc90000138be8 R08: 00000000e161fd1a R09: 0000000000000000 [ 106.539877] R10: 0000000000000018 R11: 0000000000000000 R12: ffff8881048940e8 [ 106.540222] R13: 0000000000000003 R14: 0000000000000000 R15: ffff8881048940e8 [ 106.540568] FS: 00007f277dde9f00(0000) GS:ffff88813bd80000(0000) knlGS:0000000000000000 [ 106.540954] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.541227] CR2: 00007f277eeede64 CR3: 000000000ad3e000 CR4: 00000000000006e0 [ 106.541569] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 106.541915] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 106.542255] Call Trace: [ 106.542383] [ 106.542487] __pskb_pull_tail+0x4b/0x3e0 [ 106.542681] skb_ensure_writable+0x85/0xa0 [ 106.542882] sk_skb_pull_data+0x18/0x20 [ 106.543084] bpf_prog_b517a65a242018b0_bpf_skskb_http_verdict+0x3a9/0x4aa9 [ 106.543536] ? migrate_disable+0x66/0x80 [ 106.543871] sk_psock_verdict_recv+0xe2/0x310 [ 106.544258] ? sk_psock_write_space+0x1f0/0x1f0 [ 106.544561] tcp_read_skb+0x7b/0x120 [ 106.544740] tcp_data_queue+0x904/0xee0 [ 106.544931] tcp_rcv_established+0x212/0x7c0 [ 106.545142] tcp_v4_do_rcv+0x174/0x2a0 [ 106.545326] tcp_v4_rcv+0xe70/0xf60 [ 106.545500] ip_protocol_deliver_rcu+0x48/0x290 [ 106.545744] ip_local_deliver_finish+0xa7/0x150 Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Reported-by: William Findlay Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Tested-by: William Findlay Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230523025618.113937-2-john.fastabend@gmail.com commit d53d70084d27f56bcdf5074328f2c9ec861be596 Author: Jeff Layton Date: Wed May 17 12:26:44 2023 -0400 nfsd: make a copy of struct iattr before calling notify_change notify_change can modify the iattr structure. In particular it can end up setting ATTR_MODE when ATTR_KILL_SUID is already set, causing a BUG() if the same iattr is passed to notify_change more than once. Make a copy of the struct iattr before calling notify_change. Reported-by: Zhi Li Link: https://bugzilla.redhat.com/show_bug.cgi?id=2207969 Tested-by: Zhi Li Fixes: 34b91dda7124 ("NFSD: Make nfsd4_setattr() wait before returning NFS4ERR_DELAY") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 3632679d9e4f879f49949bb5b050e0de553e4739 Author: Nicolas Dichtel Date: Mon May 22 14:08:20 2023 +0200 ipv{4,6}/raw: fix output xfrm lookup wrt protocol With a raw socket bound to IPPROTO_RAW (ie with hdrincl enabled), the protocol field of the flow structure, build by raw_sendmsg() / rawv6_sendmsg()), is set to IPPROTO_RAW. This breaks the ipsec policy lookup when some policies are defined with a protocol in the selector. For ipv6, the sin6_port field from 'struct sockaddr_in6' could be used to specify the protocol. Just accept all values for IPPROTO_RAW socket. For ipv4, the sin_port field of 'struct sockaddr_in' could not be used without breaking backward compatibility (the value of this field was never checked). Let's add a new kind of control message, so that the userland could specify which protocol is used. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable@vger.kernel.org Signed-off-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20230522120820.1319391-1-nicolas.dichtel@6wind.com Signed-off-by: Paolo Abeni commit 16a9c24f24fbe4564284eb575b18cc20586b9270 Author: Denis Arefev Date: Thu Apr 27 14:47:45 2023 +0300 HID: wacom: Add error check to wacom_parse_and_register() Added a variable check and transition in case of an error Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Denis Arefev Reviewed-by: Ping Cheng Signed-off-by: Jiri Kosina commit ed84c4517a5bc536e8572a01dfa11bc22a280d06 Author: Sung-Chi Li Date: Mon Apr 24 10:37:36 2023 +0800 HID: google: add jewel USB id Add 1 additional hammer-like device. Signed-off-by: Sung-Chi Li Signed-off-by: Jiri Kosina commit bd249b91977b768ea02bf84d04625d2690ad2b98 Author: Nikita Zhandarovich Date: Mon Apr 17 09:01:48 2023 -0700 HID: wacom: avoid integer overflow in wacom_intuos_inout() If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic operations and integer promotions are done, high bits in wacom->serial[idx] will be filled with 1s as well. Avoid this, albeit unlikely, issue by specifying left operand's __u64 type for the right operand. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization") Signed-off-by: Nikita Zhandarovich Reviewed-by: Ping Cheng Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit d9eef346b601afb0bd74b49e0db06f6a5cebd030 Author: Jason Gerecke Date: Fri Apr 14 11:22:10 2023 -0700 HID: wacom: Check for string overflow from strscpy calls The strscpy function is able to return an error code when a copy would overflow the size of the destination. The copy is stopped and the buffer terminated before overflow actually occurs so it is safe to continue execution, but we should still produce a warning should this occur. Signed-off-by: Jason Gerecke Reviewed-by: Ping Cheng Reviewed-by: Peter Hutterer Signed-off-by: Jiri Kosina commit 600761245952d7f70280add6ce02894f1528992b Author: Horatiu Vultur Date: Mon May 22 14:00:38 2023 +0200 lan966x: Fix unloading/loading of the driver It was noticing that after a while when unloading/loading the driver and sending traffic through the switch, it would stop working. It would stop forwarding any traffic and the only way to get out of this was to do a power cycle of the board. The root cause seems to be that the switch core is initialized twice. Apparently initializing twice the switch core disturbs the pointers in the queue systems in the HW, so after a while it would stop sending the traffic. Unfortunetly, it is not possible to use a reset of the switch here, because the reset line is connected to multiple devices like MDIO, SGPIO, FAN, etc. So then all the devices will get reseted when the network driver will be loaded. So the fix is to check if the core is initialized already and if that is the case don't initialize it again. Fixes: db8bcaad5393 ("net: lan966x: add the basic lan966x driver") Signed-off-by: Horatiu Vultur Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230522120038.3749026-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 3279decb2c3c8d58cb0b70ed5235c480735a36ee Author: David Arcari Date: Tue May 23 06:54:00 2023 -0400 platform/x86/intel/ifs: Annotate work queue on stack so object debug does not complain Object Debug results in the following warning while attempting to load ifs firmware: [ 220.007422] ODEBUG: object 000000003bf952db is on stack 00000000e843994b, but NOT annotated. [ 220.007459] ------------[ cut here ]------------ [ 220.007461] WARNING: CPU: 0 PID: 11774 at lib/debugobjects.c:548 __debug_object_init.cold+0x22e/0x2d5 [ 220.137476] RIP: 0010:__debug_object_init.cold+0x22e/0x2d5 [ 220.254774] Call Trace: [ 220.257641] [ 220.265606] scan_chunks_sanity_check+0x368/0x5f0 [intel_ifs] [ 220.288292] ifs_load_firmware+0x2a3/0x400 [intel_ifs] [ 220.332793] current_batch_store+0xea/0x160 [intel_ifs] [ 220.357947] kernfs_fop_write_iter+0x355/0x530 [ 220.363048] new_sync_write+0x28e/0x4a0 [ 220.381226] vfs_write+0x62a/0x920 [ 220.385160] ksys_write+0xf9/0x1d0 [ 220.399421] do_syscall_64+0x59/0x90 [ 220.440635] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 220.566845] ---[ end trace 3a01b299db142b41 ]--- Correct this by calling INIT_WORK_ONSTACK instead of INIT_WORK. Fixes: 684ec215706d ("platform/x86/intel/ifs: Authenticate and copy to secured memory") Signed-off-by: David Arcari Cc: Jithu Joseph Cc: Ashok Raj Cc: Tony Luck Cc: Hans de Goede Cc: Mark Gross Cc: Greg Kroah-Hartman Cc: Thomas Gleixner Cc: Dan Williams Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230523105400.674152-1-darcari@redhat.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit bbb320bfe2c3e9740fe89cfa0a7089b4e8bfc4ff Author: Steve Wahl Date: Fri May 19 11:04:20 2023 -0500 platform/x86: ISST: Remove 8 socket limit Stop restricting the PCI search to a range of PCI domains fed to pci_get_domain_bus_and_slot(). Instead, use for_each_pci_dev() and look at all PCI domains in one pass. On systems with more than 8 sockets, this avoids error messages like "Information: Invalid level, Can't get TDP control information at specified levels on cpu 480" from the intel speed select utility. Fixes: aa2ddd242572 ("platform/x86: ISST: Use numa node id for cpu pci dev mapping") Signed-off-by: Steve Wahl Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20230519160420.2588475-1-steve.wahl@hpe.com Signed-off-by: Hans de Goede commit 4897a898a216058dec55e5e5902534e6e224fcdf Author: Liviu Dudau Date: Tue May 9 18:29:21 2023 +0100 mips: Move initrd_start check after initrd address sanitisation. PAGE_OFFSET is technically a virtual address so when checking the value of initrd_start against it we should make sure that it has been sanitised from the values passed by the bootloader. Without this change, even with a bootloader that passes correct addresses for an initrd, we are failing to load it on MT7621 boards, for example. Signed-off-by: Liviu Dudau Signed-off-by: Thomas Bogendoerfer commit 2d645604f69f3a772d58ead702f9a8e84ab2b342 Author: Manuel Lauss Date: Thu May 11 17:30:10 2023 +0200 MIPS: Alchemy: fix dbdma2 Various fixes for the Au1200/Au1550/Au1300 DBDMA2 code: - skip cache invalidation if chip has working coherency circuitry. - invalidate KSEG0-portion of the (physical) data address. - force the dma channel doorbell write out to bus immediately with a sync. Signed-off-by: Thomas Bogendoerfer commit f2041708dee30a3425f680265c337acd28293782 Author: Manuel Lauss Date: Wed May 10 12:33:23 2023 +0200 MIPS: Restore Au1300 support The Au1300, at least the one I have to test, uses the NetLogic vendor ID, but commit 95b8a5e0111a ("MIPS: Remove NETLOGIC support") also dropped Au1300 detection. Restore Au1300 detection. Tested on DB1300 with Au1380 chip. Signed-off-by: Manuel Lauss Signed-off-by: Thomas Bogendoerfer commit 75b18aac6fa39a1720677970cfcb52ecea1eb44c Author: Manuel Lauss Date: Tue May 9 20:57:44 2023 +0200 MIPS: unhide PATA_PLATFORM Alchemy DB1200/DB1300 boards can use the pata_platform driver. Unhide the config entry in all of MIPS. Signed-off-by: Manuel Lauss Signed-off-by: Thomas Bogendoerfer commit cf7f2732b4b83026842832e7e4e04bf862108ac2 Author: Gao Xiang Date: Mon May 22 17:21:41 2023 +0800 erofs: use HIPRI by default if per-cpu kthreads are enabled As Sandeep shown [1], high priority RT per-cpu kthreads are typically helpful for Android scenarios to minimize the scheduling latencies. Switch EROFS_FS_PCPU_KTHREAD_HIPRI on by default if EROFS_FS_PCPU_KTHREAD is on since it's the typical use cases for EROFS_FS_PCPU_KTHREAD. Also clean up unneeded sched_set_normal(). [1] https://lore.kernel.org/r/CAB=BE-SBtO6vcoyLNA9F-9VaN5R0t3o_Zn+FW8GbO6wyUqFneQ@mail.gmail.com Reviewed-by: Yue Hu Reviewed-by: Sandeep Dhavale Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230522092141.124290-1-hsiangkao@linux.alibaba.com commit 285d0f85dae6510aea31416c72670ded54fc4b0c Author: Yue Hu Date: Mon May 15 17:57:58 2023 +0800 erofs: avoid pcpubuf.c inclusion if CONFIG_EROFS_FS_ZIP is off The function of pcpubuf.c is just for low-latency decompression algorithms (e.g. lz4). Signed-off-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230515095758.10391-1-zbestahu@gmail.com Signed-off-by: Gao Xiang commit 0a17567b4a85243ac1620886b75b3813acde41fc Author: Jingbo Xu Date: Mon May 15 18:39:41 2023 +0800 erofs: fix null-ptr-deref caused by erofs_xattr_prefixes_init Fragments and dedupe share one feature bit, and thus packed inode may not exist when fragment feature bit (dedupe feature bit exactly) is set, e.g. when deduplication feature is in use while fragments feature is not. In this case, sbi->packed_inode could be NULL while fragments feature bit is set. Fix this by accessing packed inode only when it exists. Reported-by: syzbot+902d5a9373ae8f748a94@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=902d5a9373ae8f748a94 Reported-and-tested-by: syzbot+bbb353775d51424087f2@syzkaller.appspotmail.com Fixes: 9e382914617c ("erofs: add helpers to load long xattr name prefixes") Fixes: 6a318ccd7e08 ("erofs: enable long extended attribute name prefixes") Signed-off-by: Jingbo Xu Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230515103941.129784-1-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 3002b8642f016d7fe3ff56240dacea1075f6b877 Author: Henning Schild Date: Thu Apr 27 17:20:55 2023 +0200 gpio-f7188x: fix chip name and pin count on Nuvoton chip In fact the device with chip id 0xD283 is called NCT6126D, and that is the chip id the Nuvoton code was written for. Correct that name to avoid confusion, because a NCT6116D in fact exists as well but has another chip id, and is currently not supported. The look at the spec also revealed that GPIO group7 in fact has 8 pins, so correct the pin count in that group as well. Fixes: d0918a84aff0 ("gpio-f7188x: Add GPIO support for Nuvoton NCT6116") Reported-by: Xing Tong Wu Signed-off-by: Henning Schild Acked-by: Simon Guinot Signed-off-by: Bartosz Golaszewski commit 3c845304d2d723f20d5b91fef5d133ff94825d76 Author: Like Xu Date: Wed May 17 21:38:08 2023 +0800 perf/x86/intel: Save/restore cpuc->active_pebs_data_cfg when using guest PEBS After commit b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG"), the cpuc->pebs_data_cfg may save some bits that are not supported by real hardware, such as PEBS_UPDATE_DS_SW. This would cause the VMX hardware MSR switching mechanism to save/restore invalid values for PEBS_DATA_CFG MSR, thus crashing the host when PEBS is used for guest. Fix it by using the active host value from cpuc->active_pebs_data_cfg. Fixes: b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG") Signed-off-by: Like Xu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20230517133808.67885-1-likexu@tencent.com commit 11c439a19466e7feaccdbce148a75372fddaf4e9 Author: Vasant Hegde Date: Thu May 18 05:43:51 2023 +0000 iommu/amd/pgtbl_v2: Fix domain max address IOMMU v2 page table supports 4 level (47 bit) or 5 level (56 bit) virtual address space. Current code assumes it can support 64bit IOVA address space. If IOVA allocator allocates virtual address > 47/56 bit (depending on page table level) then it will do wrong mapping and cause invalid translation. Hence adjust aperture size to use max address supported by the page table. Reported-by: Jerry Snitselaar Fixes: aaac38f61487 ("iommu/amd: Initial support for AMD IOMMU v2 page table") Cc: # v6.0+ Cc: Suravee Suthikulpanit Signed-off-by: Vasant Hegde Reviewed-by: Jerry Snitselaar Link: https://lore.kernel.org/r/20230518054351.9626-1-vasant.hegde@amd.com Signed-off-by: Joerg Roedel commit 1da438c0ae02396dc5018b63237492cb5908608d Author: Shay Drory Date: Mon Apr 17 10:57:50 2023 +0300 net/mlx5: Fix indexing of mlx5_irq After the cited patch, mlx5_irq xarray index can be different then mlx5_irq MSIX table index. Fix it by storing both mlx5_irq xarray index and MSIX table index. Fixes: 3354822cde5a ("net/mlx5: Use dynamic msix vectors allocation") Signed-off-by: Shay Drory Reviewed-by: Eli Cohen Signed-off-by: Saeed Mahameed commit ef8c063cf88e1a3d99ab4ada1cbab5ba7248a4f2 Author: Shay Drory Date: Sun Apr 16 08:54:04 2023 +0300 net/mlx5: Fix irq affinity management The cited patch deny the user of changing the affinity of mlx5 irqs, which break backward compatibility. Hence, allow the user to change the affinity of mlx5 irqs. Fixes: bbac70c74183 ("net/mlx5: Use newer affinity descriptor") Signed-off-by: Shay Drory Reviewed-by: Eli Cohen Signed-off-by: Saeed Mahameed commit 9c2d08010963a61a171e8cb2852d3ce015b60cb4 Author: Shay Drory Date: Thu Apr 13 22:15:31 2023 +0300 net/mlx5: Free irqs only on shutdown callback Whenever a shutdown is invoked, free irqs only and keep mlx5_irq synthetic wrapper intact in order to avoid use-after-free on system shutdown. for example: ================================================================== BUG: KASAN: use-after-free in _find_first_bit+0x66/0x80 Read of size 8 at addr ffff88823fc0d318 by task kworker/u192:0/13608 CPU: 25 PID: 13608 Comm: kworker/u192:0 Tainted: G B W O 6.1.21-cloudflare-kasan-2023.3.21 #1 Hardware name: GIGABYTE R162-R2-GEN0/MZ12-HD2-CD, BIOS R14 05/03/2021 Workqueue: mlx5e mlx5e_tx_timeout_work [mlx5_core] Call Trace: dump_stack_lvl+0x34/0x48 print_report+0x170/0x473 ? _find_first_bit+0x66/0x80 kasan_report+0xad/0x130 ? _find_first_bit+0x66/0x80 _find_first_bit+0x66/0x80 mlx5e_open_channels+0x3c5/0x3a10 [mlx5_core] ? console_unlock+0x2fa/0x430 ? _raw_spin_lock_irqsave+0x8d/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x80 ? preempt_count_add+0x7d/0x150 ? __wake_up_klogd.part.0+0x7d/0xc0 ? vprintk_emit+0xfe/0x2c0 ? mlx5e_trigger_napi_sched+0x40/0x40 [mlx5_core] ? dev_attr_show.cold+0x35/0x35 ? devlink_health_do_dump.part.0+0x174/0x340 ? devlink_health_report+0x504/0x810 ? mlx5e_reporter_tx_timeout+0x29d/0x3a0 [mlx5_core] ? mlx5e_tx_timeout_work+0x17c/0x230 [mlx5_core] ? process_one_work+0x680/0x1050 mlx5e_safe_switch_params+0x156/0x220 [mlx5_core] ? mlx5e_switch_priv_channels+0x310/0x310 [mlx5_core] ? mlx5_eq_poll_irq_disabled+0xb6/0x100 [mlx5_core] mlx5e_tx_reporter_timeout_recover+0x123/0x240 [mlx5_core] ? __mutex_unlock_slowpath.constprop.0+0x2b0/0x2b0 devlink_health_reporter_recover+0xa6/0x1f0 devlink_health_report+0x2f7/0x810 ? vsnprintf+0x854/0x15e0 mlx5e_reporter_tx_timeout+0x29d/0x3a0 [mlx5_core] ? mlx5e_reporter_tx_err_cqe+0x1a0/0x1a0 [mlx5_core] ? mlx5e_tx_reporter_timeout_dump+0x50/0x50 [mlx5_core] ? mlx5e_tx_reporter_dump_sq+0x260/0x260 [mlx5_core] ? newidle_balance+0x9b7/0xe30 ? psi_group_change+0x6a7/0xb80 ? mutex_lock+0x96/0xf0 ? __mutex_lock_slowpath+0x10/0x10 mlx5e_tx_timeout_work+0x17c/0x230 [mlx5_core] process_one_work+0x680/0x1050 worker_thread+0x5a0/0xeb0 ? process_one_work+0x1050/0x1050 kthread+0x2a2/0x340 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Freed by task 1: kasan_save_stack+0x23/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x169/0x1d0 slab_free_freelist_hook+0xd2/0x190 __kmem_cache_free+0x1a1/0x2f0 irq_pool_free+0x138/0x200 [mlx5_core] mlx5_irq_table_destroy+0xf6/0x170 [mlx5_core] mlx5_core_eq_free_irqs+0x74/0xf0 [mlx5_core] shutdown+0x194/0x1aa [mlx5_core] pci_device_shutdown+0x75/0x120 device_shutdown+0x35c/0x620 kernel_restart+0x60/0xa0 __do_sys_reboot+0x1cb/0x2c0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x4b/0xb5 The buggy address belongs to the object at ffff88823fc0d300 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 24 bytes inside of 192-byte region [ffff88823fc0d300, ffff88823fc0d3c0) The buggy address belongs to the physical page: page:0000000010139587 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23fc0c head:0000000010139587 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff) raw: 002ffff800010200 0000000000000000 dead000000000122 ffff88810004ca00 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88823fc0d200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88823fc0d280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff88823fc0d300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88823fc0d380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88823fc0d400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== general protection fault, probably for non-canonical address 0xdffffc005c40d7ac: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: probably user-memory-access in range [0x00000002e206bd60-0x00000002e206bd67] CPU: 25 PID: 13608 Comm: kworker/u192:0 Tainted: G B W O 6.1.21-cloudflare-kasan-2023.3.21 #1 Hardware name: GIGABYTE R162-R2-GEN0/MZ12-HD2-CD, BIOS R14 05/03/2021 Workqueue: mlx5e mlx5e_tx_timeout_work [mlx5_core] RIP: 0010:__alloc_pages+0x141/0x5c0 Call Trace: ? sysvec_apic_timer_interrupt+0xa0/0xc0 ? asm_sysvec_apic_timer_interrupt+0x16/0x20 ? __alloc_pages_slowpath.constprop.0+0x1ec0/0x1ec0 ? _raw_spin_unlock_irqrestore+0x3d/0x80 __kmalloc_large_node+0x80/0x120 ? kvmalloc_node+0x4e/0x170 __kmalloc_node+0xd4/0x150 kvmalloc_node+0x4e/0x170 mlx5e_open_channels+0x631/0x3a10 [mlx5_core] ? console_unlock+0x2fa/0x430 ? _raw_spin_lock_irqsave+0x8d/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x80 ? preempt_count_add+0x7d/0x150 ? __wake_up_klogd.part.0+0x7d/0xc0 ? vprintk_emit+0xfe/0x2c0 ? mlx5e_trigger_napi_sched+0x40/0x40 [mlx5_core] ? dev_attr_show.cold+0x35/0x35 ? devlink_health_do_dump.part.0+0x174/0x340 ? devlink_health_report+0x504/0x810 ? mlx5e_reporter_tx_timeout+0x29d/0x3a0 [mlx5_core] ? mlx5e_tx_timeout_work+0x17c/0x230 [mlx5_core] ? process_one_work+0x680/0x1050 mlx5e_safe_switch_params+0x156/0x220 [mlx5_core] ? mlx5e_switch_priv_channels+0x310/0x310 [mlx5_core] ? mlx5_eq_poll_irq_disabled+0xb6/0x100 [mlx5_core] mlx5e_tx_reporter_timeout_recover+0x123/0x240 [mlx5_core] ? __mutex_unlock_slowpath.constprop.0+0x2b0/0x2b0 devlink_health_reporter_recover+0xa6/0x1f0 devlink_health_report+0x2f7/0x810 ? vsnprintf+0x854/0x15e0 mlx5e_reporter_tx_timeout+0x29d/0x3a0 [mlx5_core] ? mlx5e_reporter_tx_err_cqe+0x1a0/0x1a0 [mlx5_core] ? mlx5e_tx_reporter_timeout_dump+0x50/0x50 [mlx5_core] ? mlx5e_tx_reporter_dump_sq+0x260/0x260 [mlx5_core] ? newidle_balance+0x9b7/0xe30 ? psi_group_change+0x6a7/0xb80 ? mutex_lock+0x96/0xf0 ? __mutex_lock_slowpath+0x10/0x10 mlx5e_tx_timeout_work+0x17c/0x230 [mlx5_core] process_one_work+0x680/0x1050 worker_thread+0x5a0/0xeb0 ? process_one_work+0x1050/0x1050 kthread+0x2a2/0x340 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 ---[ end trace 0000000000000000 ]--- RIP: 0010:__alloc_pages+0x141/0x5c0 Code: e0 39 a3 96 89 e9 b8 22 01 32 01 83 e1 0f 48 89 fa 01 c9 48 c1 ea 03 d3 f8 83 e0 03 89 44 24 6c 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 0f 85 fc 03 00 00 89 e8 4a 8b 14 f5 e0 39 a3 96 4c 89 RSP: 0018:ffff888251f0f438 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 1ffff1104a3e1e8b RCX: 0000000000000000 RDX: 000000005c40d7ac RSI: 0000000000000003 RDI: 00000002e206bd60 RBP: 0000000000052dc0 R08: ffff8882b0044218 R09: ffff8882b0045e8a R10: fffffbfff300fefc R11: ffff888167af4000 R12: 0000000000000003 R13: 0000000000000000 R14: 00000000696c7070 R15: ffff8882373f4380 FS: 0000000000000000(0000) GS:ffff88bf2be80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005641d031eee8 CR3: 0000002e7ca14000 CR4: 0000000000350ee0 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x11000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]---] Reported-by: Frederick Lawler Link: https://lore.kernel.org/netdev/be5b9271-7507-19c5-ded1-fa78f1980e69@cloudflare.com Signed-off-by: Shay Drory Signed-off-by: Saeed Mahameed commit 1f893f57a3bf9fe1f4bcb25b55aea7f7f9712fe7 Author: Shay Drory Date: Tue May 2 13:36:42 2023 +0300 net/mlx5: Devcom, serialize devcom registration From one hand, mlx5 driver is allowing to probe PFs in parallel. From the other hand, devcom, which is a share resource between PFs, is registered without any lock. This might resulted in memory problems. Hence, use the global mlx5_dev_list_lock in order to serialize devcom registration. Fixes: fadd59fc50d0 ("net/mlx5: Introduce inter-device communication mechanism") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit af87194352cad882d787d06fb7efa714acd95427 Author: Shay Drory Date: Tue May 2 13:35:11 2023 +0300 net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device In case devcom allocation is failed, mlx5 is always freeing the priv. However, this priv might have been allocated by a different thread, and freeing it might lead to use-after-free bugs. Fix it by freeing the priv only in case it was allocated by the running thread. Fixes: fadd59fc50d0 ("net/mlx5: Introduce inter-device communication mechanism") Signed-off-by: Shay Drory Signed-off-by: Saeed Mahameed commit 8c253dfc89efde6b5faddf9e7400e5d17884e042 Author: Shay Drory Date: Mon Feb 6 11:52:02 2023 +0200 net/mlx5: E-switch, Devcom, sync devcom events and devcom comp register devcom events are sent to all registered component. Following the cited patch, it is possible for two components, e.g.: two eswitches, to send devcom events, while both components are registered. This means eswitch layer will do double un/pairing, which is double allocation and free of resources, even though only one un/pairing is needed. flow example: cpu0 cpu1 ---- ---- mlx5_devlink_eswitch_mode_set(dev0) esw_offloads_devcom_init() mlx5_devcom_register_component(esw0) mlx5_devlink_eswitch_mode_set(dev1) esw_offloads_devcom_init() mlx5_devcom_register_component(esw1) mlx5_devcom_send_event() mlx5_devcom_send_event() Hence, check whether the eswitches are already un/paired before free/allocation of resources. Fixes: 09b278462f16 ("net: devlink: enable parallel ops on netlink interface") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit dfa1e46d6093831b9d49f0f350227a1d13644a2f Author: Paul Blakey Date: Wed Apr 26 16:04:48 2023 +0300 net/mlx5e: TC, Fix using eswitch mapping in nic mode Cited patch is using the eswitch object mapping pool while in nic mode where it isn't initialized. This results in the trace below [0]. Fix that by using either nic or eswitch object mapping pool depending if eswitch is enabled or not. [0]: [ 826.446057] ================================================================== [ 826.446729] BUG: KASAN: slab-use-after-free in mlx5_add_flow_rules+0x30/0x490 [mlx5_core] [ 826.447515] Read of size 8 at addr ffff888194485830 by task tc/6233 [ 826.448243] CPU: 16 PID: 6233 Comm: tc Tainted: G W 6.3.0-rc6+ #1 [ 826.448890] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 826.449785] Call Trace: [ 826.450052] [ 826.450302] dump_stack_lvl+0x33/0x50 [ 826.450650] print_report+0xc2/0x610 [ 826.450998] ? __virt_addr_valid+0xb1/0x130 [ 826.451385] ? mlx5_add_flow_rules+0x30/0x490 [mlx5_core] [ 826.451935] kasan_report+0xae/0xe0 [ 826.452276] ? mlx5_add_flow_rules+0x30/0x490 [mlx5_core] [ 826.452829] mlx5_add_flow_rules+0x30/0x490 [mlx5_core] [ 826.453368] ? __kmalloc_node+0x5a/0x120 [ 826.453733] esw_add_restore_rule+0x20f/0x270 [mlx5_core] [ 826.454288] ? mlx5_eswitch_add_send_to_vport_meta_rule+0x260/0x260 [mlx5_core] [ 826.455011] ? mutex_unlock+0x80/0xd0 [ 826.455361] ? __mutex_unlock_slowpath.constprop.0+0x210/0x210 [ 826.455862] ? mapping_add+0x2cb/0x440 [mlx5_core] [ 826.456425] mlx5e_tc_action_miss_mapping_get+0x139/0x180 [mlx5_core] [ 826.457058] ? mlx5e_tc_update_skb_nic+0xb0/0xb0 [mlx5_core] [ 826.457636] ? __kasan_kmalloc+0x77/0x90 [ 826.458000] ? __kmalloc+0x57/0x120 [ 826.458336] mlx5_tc_ct_flow_offload+0x325/0xe40 [mlx5_core] [ 826.458916] ? ct_kernel_enter.constprop.0+0x48/0xa0 [ 826.459360] ? mlx5_tc_ct_parse_action+0xf0/0xf0 [mlx5_core] [ 826.459933] ? mlx5e_mod_hdr_attach+0x491/0x520 [mlx5_core] [ 826.460507] ? mlx5e_mod_hdr_get+0x12/0x20 [mlx5_core] [ 826.461046] ? mlx5e_tc_attach_mod_hdr+0x154/0x170 [mlx5_core] [ 826.461635] mlx5e_configure_flower+0x969/0x2110 [mlx5_core] [ 826.462217] ? _raw_spin_lock_bh+0x85/0xe0 [ 826.462597] ? __mlx5e_add_fdb_flow+0x750/0x750 [mlx5_core] [ 826.463163] ? kasan_save_stack+0x2e/0x40 [ 826.463534] ? down_read+0x115/0x1b0 [ 826.463878] ? down_write_killable+0x110/0x110 [ 826.464288] ? tc_setup_action.part.0+0x9f/0x3b0 [ 826.464701] ? mlx5e_is_uplink_rep+0x4c/0x90 [mlx5_core] [ 826.465253] ? mlx5e_tc_reoffload_flows_work+0x130/0x130 [mlx5_core] [ 826.465878] tc_setup_cb_add+0x112/0x250 [ 826.466247] fl_hw_replace_filter+0x230/0x310 [cls_flower] [ 826.466724] ? fl_hw_destroy_filter+0x1a0/0x1a0 [cls_flower] [ 826.467212] fl_change+0x14e1/0x2030 [cls_flower] [ 826.467636] ? sock_def_readable+0x89/0x120 [ 826.468019] ? fl_tmplt_create+0x2d0/0x2d0 [cls_flower] [ 826.468509] ? kasan_unpoison+0x23/0x50 [ 826.468873] ? get_random_u16+0x180/0x180 [ 826.469244] ? __radix_tree_lookup+0x2b/0x130 [ 826.469640] ? fl_get+0x7b/0x140 [cls_flower] [ 826.470042] ? fl_mask_put+0x200/0x200 [cls_flower] [ 826.470478] ? __mutex_unlock_slowpath.constprop.0+0x210/0x210 [ 826.470973] ? fl_tmplt_create+0x2d0/0x2d0 [cls_flower] [ 826.471427] tc_new_tfilter+0x644/0x1050 [ 826.471795] ? tc_get_tfilter+0x860/0x860 [ 826.472170] ? __thaw_task+0x130/0x130 [ 826.472525] ? arch_stack_walk+0x98/0xf0 [ 826.472892] ? cap_capable+0x9f/0xd0 [ 826.473235] ? security_capable+0x47/0x60 [ 826.473608] rtnetlink_rcv_msg+0x1d5/0x550 [ 826.473985] ? rtnl_calcit.isra.0+0x1f0/0x1f0 [ 826.474383] ? __stack_depot_save+0x35/0x4c0 [ 826.474779] ? kasan_save_stack+0x2e/0x40 [ 826.475149] ? kasan_save_stack+0x1e/0x40 [ 826.475518] ? __kasan_record_aux_stack+0x9f/0xb0 [ 826.475939] ? task_work_add+0x77/0x1c0 [ 826.476305] netlink_rcv_skb+0xe0/0x210 [ 826.476661] ? rtnl_calcit.isra.0+0x1f0/0x1f0 [ 826.477057] ? netlink_ack+0x7c0/0x7c0 [ 826.477412] ? rhashtable_jhash2+0xef/0x150 [ 826.477796] ? _copy_from_iter+0x105/0x770 [ 826.484386] netlink_unicast+0x346/0x490 [ 826.484755] ? netlink_attachskb+0x400/0x400 [ 826.485145] ? kernel_text_address+0xc2/0xd0 [ 826.485535] netlink_sendmsg+0x3b0/0x6c0 [ 826.485902] ? kernel_text_address+0xc2/0xd0 [ 826.486296] ? netlink_unicast+0x490/0x490 [ 826.486671] ? iovec_from_user.part.0+0x7a/0x1a0 [ 826.487083] ? netlink_unicast+0x490/0x490 [ 826.487461] sock_sendmsg+0x73/0xc0 [ 826.487803] ____sys_sendmsg+0x364/0x380 [ 826.488186] ? import_iovec+0x7/0x10 [ 826.488531] ? kernel_sendmsg+0x30/0x30 [ 826.488893] ? __copy_msghdr+0x180/0x180 [ 826.489258] ? kasan_save_stack+0x2e/0x40 [ 826.489629] ? kasan_save_stack+0x1e/0x40 [ 826.490002] ? __kasan_record_aux_stack+0x9f/0xb0 [ 826.490424] ? __call_rcu_common.constprop.0+0x46/0x580 [ 826.490876] ___sys_sendmsg+0xdf/0x140 [ 826.491231] ? copy_msghdr_from_user+0x110/0x110 [ 826.491649] ? fget_raw+0x120/0x120 [ 826.491988] ? ___sys_recvmsg+0xd9/0x130 [ 826.492355] ? folio_batch_add_and_move+0x80/0xa0 [ 826.492776] ? _raw_spin_lock+0x7a/0xd0 [ 826.493137] ? _raw_spin_lock+0x7a/0xd0 [ 826.493500] ? _raw_read_lock_irq+0x30/0x30 [ 826.493880] ? kasan_set_track+0x21/0x30 [ 826.494249] ? kasan_save_free_info+0x2a/0x40 [ 826.494650] ? do_sys_openat2+0xff/0x270 [ 826.495016] ? __fget_light+0x1b5/0x200 [ 826.495377] ? __virt_addr_valid+0xb1/0x130 [ 826.495763] __sys_sendmsg+0xb2/0x130 [ 826.496118] ? __sys_sendmsg_sock+0x20/0x20 [ 826.496501] ? __x64_sys_rseq+0x2e0/0x2e0 [ 826.496874] ? do_user_addr_fault+0x276/0x820 [ 826.497273] ? fpregs_assert_state_consistent+0x52/0x60 [ 826.497727] ? exit_to_user_mode_prepare+0x30/0x120 [ 826.498158] do_syscall_64+0x3d/0x90 [ 826.498502] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 826.498949] RIP: 0033:0x7f9b67f4f887 [ 826.499294] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 826.500742] RSP: 002b:00007fff5d1a5498 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 826.501395] RAX: ffffffffffffffda RBX: 0000000064413ce6 RCX: 00007f9b67f4f887 [ 826.501975] RDX: 0000000000000000 RSI: 00007fff5d1a5500 RDI: 0000000000000003 [ 826.502556] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 826.503135] R10: 00007f9b67e08708 R11: 0000000000000246 R12: 0000000000000001 [ 826.503714] R13: 0000000000000001 R14: 00007fff5d1a9800 R15: 0000000000485400 [ 826.504304] [ 826.504753] Allocated by task 3764: [ 826.505090] kasan_save_stack+0x1e/0x40 [ 826.505453] kasan_set_track+0x21/0x30 [ 826.505810] __kasan_kmalloc+0x77/0x90 [ 826.506164] __mlx5_create_flow_table+0x16d/0xbb0 [mlx5_core] [ 826.506742] esw_offloads_enable+0x60d/0xfb0 [mlx5_core] [ 826.507292] mlx5_eswitch_enable_locked+0x4d3/0x680 [mlx5_core] [ 826.507885] mlx5_devlink_eswitch_mode_set+0x2a3/0x580 [mlx5_core] [ 826.508513] devlink_nl_cmd_eswitch_set_doit+0xdf/0x1f0 [ 826.508969] genl_family_rcv_msg_doit.isra.0+0x146/0x1c0 [ 826.509427] genl_rcv_msg+0x28d/0x3e0 [ 826.509772] netlink_rcv_skb+0xe0/0x210 [ 826.510133] genl_rcv+0x24/0x40 [ 826.510448] netlink_unicast+0x346/0x490 [ 826.510810] netlink_sendmsg+0x3b0/0x6c0 [ 826.511179] sock_sendmsg+0x73/0xc0 [ 826.511519] __sys_sendto+0x18d/0x220 [ 826.511867] __x64_sys_sendto+0x72/0x80 [ 826.512232] do_syscall_64+0x3d/0x90 [ 826.512576] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 826.513220] Freed by task 5674: [ 826.513535] kasan_save_stack+0x1e/0x40 [ 826.513893] kasan_set_track+0x21/0x30 [ 826.514245] kasan_save_free_info+0x2a/0x40 [ 826.514629] ____kasan_slab_free+0x11a/0x1b0 [ 826.515021] __kmem_cache_free+0x14d/0x280 [ 826.515399] tree_put_node+0x109/0x1c0 [mlx5_core] [ 826.515907] mlx5_destroy_flow_table+0x119/0x630 [mlx5_core] [ 826.516481] esw_offloads_steering_cleanup+0xe7/0x150 [mlx5_core] [ 826.517084] esw_offloads_disable+0xe0/0x160 [mlx5_core] [ 826.517632] mlx5_eswitch_disable_locked+0x26c/0x290 [mlx5_core] [ 826.518225] mlx5_devlink_eswitch_mode_set+0x128/0x580 [mlx5_core] [ 826.518834] devlink_nl_cmd_eswitch_set_doit+0xdf/0x1f0 [ 826.519286] genl_family_rcv_msg_doit.isra.0+0x146/0x1c0 [ 826.519748] genl_rcv_msg+0x28d/0x3e0 [ 826.520101] netlink_rcv_skb+0xe0/0x210 [ 826.520458] genl_rcv+0x24/0x40 [ 826.520771] netlink_unicast+0x346/0x490 [ 826.521137] netlink_sendmsg+0x3b0/0x6c0 [ 826.521505] sock_sendmsg+0x73/0xc0 [ 826.521842] __sys_sendto+0x18d/0x220 [ 826.522191] __x64_sys_sendto+0x72/0x80 [ 826.522554] do_syscall_64+0x3d/0x90 [ 826.522894] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 826.523540] Last potentially related work creation: [ 826.523969] kasan_save_stack+0x1e/0x40 [ 826.524331] __kasan_record_aux_stack+0x9f/0xb0 [ 826.524739] insert_work+0x30/0x130 [ 826.525078] __queue_work+0x34b/0x690 [ 826.525426] queue_work_on+0x48/0x50 [ 826.525766] __rhashtable_remove_fast_one+0x4af/0x4d0 [mlx5_core] [ 826.526365] del_sw_flow_group+0x1b5/0x270 [mlx5_core] [ 826.526898] tree_put_node+0x109/0x1c0 [mlx5_core] [ 826.527407] esw_offloads_steering_cleanup+0xd3/0x150 [mlx5_core] [ 826.528009] esw_offloads_disable+0xe0/0x160 [mlx5_core] [ 826.528616] mlx5_eswitch_disable_locked+0x26c/0x290 [mlx5_core] [ 826.529218] mlx5_devlink_eswitch_mode_set+0x128/0x580 [mlx5_core] [ 826.529823] devlink_nl_cmd_eswitch_set_doit+0xdf/0x1f0 [ 826.530276] genl_family_rcv_msg_doit.isra.0+0x146/0x1c0 [ 826.530733] genl_rcv_msg+0x28d/0x3e0 [ 826.531079] netlink_rcv_skb+0xe0/0x210 [ 826.531439] genl_rcv+0x24/0x40 [ 826.531755] netlink_unicast+0x346/0x490 [ 826.532123] netlink_sendmsg+0x3b0/0x6c0 [ 826.532487] sock_sendmsg+0x73/0xc0 [ 826.532825] __sys_sendto+0x18d/0x220 [ 826.533175] __x64_sys_sendto+0x72/0x80 [ 826.533533] do_syscall_64+0x3d/0x90 [ 826.533877] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 826.534521] The buggy address belongs to the object at ffff888194485800 which belongs to the cache kmalloc-512 of size 512 [ 826.535506] The buggy address is located 48 bytes inside of freed 512-byte region [ffff888194485800, ffff888194485a00) [ 826.536666] The buggy address belongs to the physical page: [ 826.537138] page:00000000d75841dd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x194480 [ 826.537915] head:00000000d75841dd order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 826.538595] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 826.539089] raw: 0200000000010200 ffff888100042c80 ffffea0004523800 dead000000000002 [ 826.539755] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 [ 826.540417] page dumped because: kasan: bad access detected [ 826.541095] Memory state around the buggy address: [ 826.541519] ffff888194485700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 826.542149] ffff888194485780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 826.542773] >ffff888194485800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 826.543400] ^ [ 826.543822] ffff888194485880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 826.544452] ffff888194485900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 826.545079] ================================================================== Fixes: 6702782845a5 ("net/mlx5e: TC, Set CT miss to the specific ct action instance") Signed-off-by: Paul Blakey Reviewed-by: Vlad Buslov Signed-off-by: Saeed Mahameed commit 7aa50380191635e5897a773f272829cc961a2be5 Author: Rahul Rameshbabu Date: Tue Feb 21 16:18:48 2023 -0800 net/mlx5e: Fix SQ wake logic in ptp napi_poll context Check in the mlx5e_ptp_poll_ts_cq context if the ptp tx sq should be woken up. Before change, the ptp tx sq may never wake up if the ptp tx ts skb fifo is full when mlx5e_poll_tx_cq checks if the queue should be woken up. Fixes: 1880bc4e4a96 ("net/mlx5e: Add TX port timestamp support") Signed-off-by: Rahul Rameshbabu Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 691c041bf20899fc13c793f92ba61ab660fa3a30 Author: Vlad Buslov Date: Fri Mar 31 14:20:51 2023 +0200 net/mlx5e: Fix deadlock in tc route query code Cited commit causes ABBA deadlock[0] when peer flows are created while holding the devcom rw semaphore. Due to peer flows offload implementation the lock is taken much higher up the call chain and there is no obvious way to easily fix the deadlock. Instead, since tc route query code needs the peer eswitch structure only to perform a lookup in xarray and doesn't perform any sleeping operations with it, refactor the code for lockless execution in following ways: - RCUify the devcom 'data' pointer. When resetting the pointer synchronously wait for RCU grace period before returning. This is fine since devcom is currently only used for synchronization of pairing/unpairing of eswitches which is rare and already expensive as-is. - Wrap all usages of 'paired' boolean in {READ|WRITE}_ONCE(). The flag has already been used in some unlocked contexts without proper annotations (e.g. users of mlx5_devcom_is_paired() function), but it wasn't an issue since all relevant code paths checked it again after obtaining the devcom semaphore. Now it is also used by mlx5_devcom_get_peer_data_rcu() as "best effort" check to return NULL when devcom is being unpaired. Note that while RCU read lock doesn't prevent the unpaired flag from being changed concurrently it still guarantees that reader can continue to use 'data'. - Refactor mlx5e_tc_query_route_vport() function to use new mlx5_devcom_get_peer_data_rcu() API which fixes the deadlock. [0]: [ 164.599612] ====================================================== [ 164.600142] WARNING: possible circular locking dependency detected [ 164.600667] 6.3.0-rc3+ #1 Not tainted [ 164.601021] ------------------------------------------------------ [ 164.601557] handler1/3456 is trying to acquire lock: [ 164.601998] ffff88811f1714b0 (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}, at: mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.603078] but task is already holding lock: [ 164.603617] ffff88810137fc98 (&comp->sem){++++}-{3:3}, at: mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core] [ 164.604459] which lock already depends on the new lock. [ 164.605190] the existing dependency chain (in reverse order) is: [ 164.605848] -> #1 (&comp->sem){++++}-{3:3}: [ 164.606380] down_read+0x39/0x50 [ 164.606772] mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core] [ 164.607336] mlx5e_tc_query_route_vport+0x86/0xc0 [mlx5_core] [ 164.607914] mlx5e_tc_tun_route_lookup+0x1a4/0x1d0 [mlx5_core] [ 164.608495] mlx5e_attach_decap_route+0xc6/0x1e0 [mlx5_core] [ 164.609063] mlx5e_tc_add_fdb_flow+0x1ea/0x360 [mlx5_core] [ 164.609627] __mlx5e_add_fdb_flow+0x2d2/0x430 [mlx5_core] [ 164.610175] mlx5e_configure_flower+0x952/0x1a20 [mlx5_core] [ 164.610741] tc_setup_cb_add+0xd4/0x200 [ 164.611146] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower] [ 164.611661] fl_change+0xc95/0x18a0 [cls_flower] [ 164.612116] tc_new_tfilter+0x3fc/0xd20 [ 164.612516] rtnetlink_rcv_msg+0x418/0x5b0 [ 164.612936] netlink_rcv_skb+0x54/0x100 [ 164.613339] netlink_unicast+0x190/0x250 [ 164.613746] netlink_sendmsg+0x245/0x4a0 [ 164.614150] sock_sendmsg+0x38/0x60 [ 164.614522] ____sys_sendmsg+0x1d0/0x1e0 [ 164.614934] ___sys_sendmsg+0x80/0xc0 [ 164.615320] __sys_sendmsg+0x51/0x90 [ 164.615701] do_syscall_64+0x3d/0x90 [ 164.616083] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 164.616568] -> #0 (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}: [ 164.617210] __lock_acquire+0x159e/0x26e0 [ 164.617638] lock_acquire+0xc2/0x2a0 [ 164.618018] __mutex_lock+0x92/0xcd0 [ 164.618401] mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.618943] post_process_attr+0x153/0x2d0 [mlx5_core] [ 164.619471] mlx5e_tc_add_fdb_flow+0x164/0x360 [mlx5_core] [ 164.620021] __mlx5e_add_fdb_flow+0x2d2/0x430 [mlx5_core] [ 164.620564] mlx5e_configure_flower+0xe33/0x1a20 [mlx5_core] [ 164.621125] tc_setup_cb_add+0xd4/0x200 [ 164.621531] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower] [ 164.622047] fl_change+0xc95/0x18a0 [cls_flower] [ 164.622500] tc_new_tfilter+0x3fc/0xd20 [ 164.622906] rtnetlink_rcv_msg+0x418/0x5b0 [ 164.623324] netlink_rcv_skb+0x54/0x100 [ 164.623727] netlink_unicast+0x190/0x250 [ 164.624138] netlink_sendmsg+0x245/0x4a0 [ 164.624544] sock_sendmsg+0x38/0x60 [ 164.624919] ____sys_sendmsg+0x1d0/0x1e0 [ 164.625340] ___sys_sendmsg+0x80/0xc0 [ 164.625731] __sys_sendmsg+0x51/0x90 [ 164.626117] do_syscall_64+0x3d/0x90 [ 164.626502] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 164.626995] other info that might help us debug this: [ 164.627725] Possible unsafe locking scenario: [ 164.628268] CPU0 CPU1 [ 164.628683] ---- ---- [ 164.629098] lock(&comp->sem); [ 164.629421] lock(&esw->offloads.encap_tbl_lock); [ 164.630066] lock(&comp->sem); [ 164.630555] lock(&esw->offloads.encap_tbl_lock); [ 164.630993] *** DEADLOCK *** [ 164.631575] 3 locks held by handler1/3456: [ 164.631962] #0: ffff888124b75130 (&block->cb_lock){++++}-{3:3}, at: tc_setup_cb_add+0x5b/0x200 [ 164.632703] #1: ffff888116e512b8 (&esw->mode_lock){++++}-{3:3}, at: mlx5_esw_hold+0x39/0x50 [mlx5_core] [ 164.633552] #2: ffff88810137fc98 (&comp->sem){++++}-{3:3}, at: mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core] [ 164.634435] stack backtrace: [ 164.634883] CPU: 17 PID: 3456 Comm: handler1 Not tainted 6.3.0-rc3+ #1 [ 164.635431] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 164.636340] Call Trace: [ 164.636616] [ 164.636863] dump_stack_lvl+0x47/0x70 [ 164.637217] check_noncircular+0xfe/0x110 [ 164.637601] __lock_acquire+0x159e/0x26e0 [ 164.637977] ? mlx5_cmd_set_fte+0x5b0/0x830 [mlx5_core] [ 164.638472] lock_acquire+0xc2/0x2a0 [ 164.638828] ? mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.639339] ? lock_is_held_type+0x98/0x110 [ 164.639728] __mutex_lock+0x92/0xcd0 [ 164.640074] ? mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.640576] ? __lock_acquire+0x382/0x26e0 [ 164.640958] ? mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.641468] ? mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.641965] mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.642454] ? lock_release+0xbf/0x240 [ 164.642819] post_process_attr+0x153/0x2d0 [mlx5_core] [ 164.643318] mlx5e_tc_add_fdb_flow+0x164/0x360 [mlx5_core] [ 164.643835] __mlx5e_add_fdb_flow+0x2d2/0x430 [mlx5_core] [ 164.644340] mlx5e_configure_flower+0xe33/0x1a20 [mlx5_core] [ 164.644862] ? lock_acquire+0xc2/0x2a0 [ 164.645219] tc_setup_cb_add+0xd4/0x200 [ 164.645588] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower] [ 164.646067] fl_change+0xc95/0x18a0 [cls_flower] [ 164.646488] tc_new_tfilter+0x3fc/0xd20 [ 164.646861] ? tc_del_tfilter+0x810/0x810 [ 164.647236] rtnetlink_rcv_msg+0x418/0x5b0 [ 164.647621] ? rtnl_setlink+0x160/0x160 [ 164.647982] netlink_rcv_skb+0x54/0x100 [ 164.648348] netlink_unicast+0x190/0x250 [ 164.648722] netlink_sendmsg+0x245/0x4a0 [ 164.649090] sock_sendmsg+0x38/0x60 [ 164.649434] ____sys_sendmsg+0x1d0/0x1e0 [ 164.649804] ? copy_msghdr_from_user+0x6d/0xa0 [ 164.650213] ___sys_sendmsg+0x80/0xc0 [ 164.650563] ? lock_acquire+0xc2/0x2a0 [ 164.650926] ? lock_acquire+0xc2/0x2a0 [ 164.651286] ? __fget_files+0x5/0x190 [ 164.651644] ? find_held_lock+0x2b/0x80 [ 164.652006] ? __fget_files+0xb9/0x190 [ 164.652365] ? lock_release+0xbf/0x240 [ 164.652723] ? __fget_files+0xd3/0x190 [ 164.653079] __sys_sendmsg+0x51/0x90 [ 164.653435] do_syscall_64+0x3d/0x90 [ 164.653784] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 164.654229] RIP: 0033:0x7f378054f8bd [ 164.654577] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 6a c3 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 be c3 f4 ff 48 [ 164.656041] RSP: 002b:00007f377fa114b0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e [ 164.656701] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f378054f8bd [ 164.657297] RDX: 0000000000000000 RSI: 00007f377fa11540 RDI: 0000000000000014 [ 164.657885] RBP: 00007f377fa12278 R08: 0000000000000000 R09: 000000000000015c [ 164.658472] R10: 00007f377fa123d0 R11: 0000000000000293 R12: 0000560962d99bd0 [ 164.665317] R13: 0000000000000000 R14: 0000560962d99bd0 R15: 00007f377fa11540 Fixes: f9d196bd632b ("net/mlx5e: Use correct eswitch for stack devices with lag") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Reviewed-by: Shay Drory Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit a65735148e0328f80c0f72f9f8d2f609bfcf4aff Author: Roi Dayan Date: Mon May 1 14:37:56 2023 +0300 net/mlx5: Fix error message when failing to allocate device memory Fix spacing for the error and also the correct error code pointer. Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core") Signed-off-by: Roi Dayan Signed-off-by: Saeed Mahameed commit be071cdb167fc3e25fe81922166b3d499d23e8ac Author: Vlad Buslov Date: Mon Apr 3 22:26:00 2023 +0200 net/mlx5e: Use correct encap attribute during invalidation With introduction of post action infrastructure most of the users of encap attribute had been modified in order to obtain the correct attribute by calling mlx5e_tc_get_encap_attr() helper instead of assuming encap action is always on default attribute. However, the cited commit didn't modify mlx5e_invalidate_encap() which prevents it from destroying correct modify header action which leads to a warning [0]. Fix the issue by using correct attribute. [0]: Feb 21 09:47:35 c-237-177-40-045 kernel: WARNING: CPU: 17 PID: 654 at drivers/net/ethernet/mellanox/mlx5/core/en_tc.c:684 mlx5e_tc_attach_mod_hdr+0x1cc/0x230 [mlx5_core] Feb 21 09:47:35 c-237-177-40-045 kernel: RIP: 0010:mlx5e_tc_attach_mod_hdr+0x1cc/0x230 [mlx5_core] Feb 21 09:47:35 c-237-177-40-045 kernel: Call Trace: Feb 21 09:47:35 c-237-177-40-045 kernel: Feb 21 09:47:35 c-237-177-40-045 kernel: mlx5e_tc_fib_event_work+0x8e3/0x1f60 [mlx5_core] Feb 21 09:47:35 c-237-177-40-045 kernel: ? mlx5e_take_all_encap_flows+0xe0/0xe0 [mlx5_core] Feb 21 09:47:35 c-237-177-40-045 kernel: ? lock_downgrade+0x6d0/0x6d0 Feb 21 09:47:35 c-237-177-40-045 kernel: ? lockdep_hardirqs_on_prepare+0x273/0x3f0 Feb 21 09:47:35 c-237-177-40-045 kernel: ? lockdep_hardirqs_on_prepare+0x273/0x3f0 Feb 21 09:47:35 c-237-177-40-045 kernel: process_one_work+0x7c2/0x1310 Feb 21 09:47:35 c-237-177-40-045 kernel: ? lockdep_hardirqs_on_prepare+0x3f0/0x3f0 Feb 21 09:47:35 c-237-177-40-045 kernel: ? pwq_dec_nr_in_flight+0x230/0x230 Feb 21 09:47:35 c-237-177-40-045 kernel: ? rwlock_bug.part.0+0x90/0x90 Feb 21 09:47:35 c-237-177-40-045 kernel: worker_thread+0x59d/0xec0 Feb 21 09:47:35 c-237-177-40-045 kernel: ? __kthread_parkme+0xd9/0x1d0 Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit c7dd225bc224726c22db08e680bf787f60ebdee3 Author: Yevgeny Kliteynik Date: Sun Apr 2 17:14:10 2023 +0300 net/mlx5: DR, Check force-loopback RC QP capability independently from RoCE SW Steering uses RC QP for writing STEs to ICM. This writingis done in LB (loopback), and FL (force-loopback) QP is preferred for performance. FL is available when RoCE is enabled or disabled based on RoCE caps. This patch adds reading of FL capability from HCA caps in addition to the existing reading from RoCE caps, thus fixing the case where we didn't have loopback enabled when RoCE was disabled. Fixes: 7304d603a57a ("net/mlx5: DR, Add support for force-loopback QP") Signed-off-by: Itamar Gozlan Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 1e5daf5565b61a96e570865091589afc9156e3d3 Author: Erez Shitrit Date: Thu Mar 9 16:43:15 2023 +0200 net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs When calculating crc for hash index we use the function crc32 that calculates for little-endian (LE) arch. Then we convert it to network endianness using htonl(), but it's wrong to do the conversion in BE archs since the crc32 value is already LE. The solution is to switch the bytes from the crc result for all types of arc. Fixes: 40416d8ede65 ("net/mlx5: DR, Replace CRC32 implementation to use kernel lib") Signed-off-by: Erez Shitrit Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 2be5bd42a5bba1a05daedc86cf0e248210009669 Author: Shay Drory Date: Mon Mar 20 13:07:53 2023 +0200 net/mlx5: Handle pairing of E-switch via uplink un/load APIs In case user switch a device from switchdev mode to legacy mode, mlx5 first unpair the E-switch and afterwards unload the uplink vport. From the other hand, in case user remove or reload a device, mlx5 first unload the uplink vport and afterwards unpair the E-switch. The latter is causing a bug[1], hence, handle pairing of E-switch as part of uplink un/load APIs. [1] In case VF_LAG is used, every tc fdb flow is duplicated to the peer esw. However, the original esw keeps a pointer to this duplicated flow, not the peer esw. e.g.: if user create tc fdb flow over esw0, the flow is duplicated over esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated flow. During module unload while a peer tc fdb flow is still offloaded, in case the first device to be removed is the peer device (esw1 in the example above), the peer net-dev is destroyed, and so the mlx5e_priv is memset to 0. Afterwards, the peer device is trying to unpair himself from the original device (esw0 in the example above). Unpair API invoke the original device to clear peer flow from its eswitch (esw0), but the peer flow, which is stored over the original eswitch (esw0), is trying to use the peer mlx5e_priv, which is memset to 0 and result in bellow kernel-oops. [ 157.964081 ] BUG: unable to handle page fault for address: 000000000002ce60 [ 157.964662 ] #PF: supervisor read access in kernel mode [ 157.965123 ] #PF: error_code(0x0000) - not-present page [ 157.965582 ] PGD 0 P4D 0 [ 157.965866 ] Oops: 0000 [#1] SMP [ 157.967670 ] RIP: 0010:mlx5e_tc_del_fdb_flow+0x48/0x460 [mlx5_core] [ 157.976164 ] Call Trace: [ 157.976437 ] [ 157.976690 ] __mlx5e_tc_del_fdb_peer_flow+0xe6/0x100 [mlx5_core] [ 157.977230 ] mlx5e_tc_clean_fdb_peer_flows+0x67/0x90 [mlx5_core] [ 157.977767 ] mlx5_esw_offloads_unpair+0x2d/0x1e0 [mlx5_core] [ 157.984653 ] mlx5_esw_offloads_devcom_event+0xbf/0x130 [mlx5_core] [ 157.985212 ] mlx5_devcom_send_event+0xa3/0xb0 [mlx5_core] [ 157.985714 ] esw_offloads_disable+0x5a/0x110 [mlx5_core] [ 157.986209 ] mlx5_eswitch_disable_locked+0x152/0x170 [mlx5_core] [ 157.986757 ] mlx5_eswitch_disable+0x51/0x80 [mlx5_core] [ 157.987248 ] mlx5_unload+0x2a/0xb0 [mlx5_core] [ 157.987678 ] mlx5_uninit_one+0x5f/0xd0 [mlx5_core] [ 157.988127 ] remove_one+0x64/0xe0 [mlx5_core] [ 157.988549 ] pci_device_remove+0x31/0xa0 [ 157.988933 ] device_release_driver_internal+0x18f/0x1f0 [ 157.989402 ] driver_detach+0x3f/0x80 [ 157.989754 ] bus_remove_driver+0x70/0xf0 [ 157.990129 ] pci_unregister_driver+0x34/0x90 [ 157.990537 ] mlx5_cleanup+0xc/0x1c [mlx5_core] [ 157.990972 ] __x64_sys_delete_module+0x15a/0x250 [ 157.991398 ] ? exit_to_user_mode_prepare+0xea/0x110 [ 157.991840 ] do_syscall_64+0x3d/0x90 [ 157.992198 ] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes: 04de7dda7394 ("net/mlx5e: Infrastructure for duplicated offloading of TC flows") Fixes: 1418ddd96afd ("net/mlx5e: Duplicate offloaded TC eswitch rules under uplink LAG") Signed-off-by: Shay Drory Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 2a0a935fb64ee8af253b9c6133bb6702fb152ac2 Author: Shay Drory Date: Tue May 2 11:03:53 2023 +0300 net/mlx5: Collect command failures data only for known commands DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't use it. This lead to array-index-out-of-bounds error. Fix it by checking whether the command is known before collecting the failure data. Fixes: 34f46ae0d4b3 ("net/mlx5: Add command failures data to debugfs") Signed-off-by: Shay Drory Signed-off-by: Saeed Mahameed commit 18c40a1cc1d990c51381ef48cd93fdb31d5cd903 Author: Chuck Lever Date: Fri May 19 13:08:24 2023 -0400 net/handshake: Fix sock->file allocation sock->file = sock_alloc_file(sock, O_NONBLOCK, NULL); ^^^^ ^^^^ sock_alloc_file() calls release_sock() on error but the left hand side of the assignment dereferences "sock". This isn't the bug and I didn't report this earlier because there is an assert that it doesn't fail. net/handshake/handshake-test.c:221 handshake_req_submit_test4() error: dereferencing freed memory 'sock' net/handshake/handshake-test.c:233 handshake_req_submit_test4() warn: 'req' was already freed. net/handshake/handshake-test.c:254 handshake_req_submit_test5() error: dereferencing freed memory 'sock' net/handshake/handshake-test.c:290 handshake_req_submit_test6() error: dereferencing freed memory 'sock' net/handshake/handshake-test.c:321 handshake_req_cancel_test1() error: dereferencing freed memory 'sock' net/handshake/handshake-test.c:355 handshake_req_cancel_test2() error: dereferencing freed memory 'sock' net/handshake/handshake-test.c:367 handshake_req_cancel_test2() warn: 'req' was already freed. net/handshake/handshake-test.c:395 handshake_req_cancel_test3() error: dereferencing freed memory 'sock' net/handshake/handshake-test.c:407 handshake_req_cancel_test3() warn: 'req' was already freed. net/handshake/handshake-test.c:451 handshake_req_destroy_test1() error: dereferencing freed memory 'sock' net/handshake/handshake-test.c:463 handshake_req_destroy_test1() warn: 'req' was already freed. Reported-by: Dan Carpenter Fixes: 88232ec1ec5e ("net/handshake: Add Kunit tests for the handshake consumer API") Signed-off-by: Chuck Lever Link: https://lore.kernel.org/r/168451609436.45209.15407022385441542980.stgit@oracle-102.nfsv4bat.org Signed-off-by: Jakub Kicinski commit b21c7ba6d9a5532add3827a3b49f49cbc0cb9779 Author: Chuck Lever Date: Fri May 19 13:12:50 2023 -0400 net/handshake: Squelch allocation warning during Kunit test The "handshake_req_alloc excessive privsize" kunit test is intended to check what happens when the maximum privsize is exceeded. The WARN_ON_ONCE_GFP at mm/page_alloc.c:4744 can be disabled safely for this test. Reported-by: Linux Kernel Functional Testing Fixes: 88232ec1ec5e ("net/handshake: Add Kunit tests for the handshake consumer API") Signed-off-by: Chuck Lever Link: https://lore.kernel.org/r/168451636052.47152.9600443326570457947.stgit@oracle-102.nfsv4bat.org Signed-off-by: Jakub Kicinski commit 640bf95b2c7c2981fb471acdafbd3e0458f8390d Author: Christophe JAILLET Date: Sat May 20 11:48:55 2023 +0200 3c589_cs: Fix an error handling path in tc589_probe() Should tc589_config() fail, some resources need to be released as already done in the remove function. Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") Signed-off-by: Christophe JAILLET Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/d8593ae867b24c79063646e36f9b18b0790107cb.1684575975.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 5b17a4971d3b2a073f4078dd65331efbe35baa2d Author: Christophe JAILLET Date: Sat May 20 10:30:17 2023 +0200 forcedeth: Fix an error handling path in nv_probe() If an error occures after calling nv_mgmt_acquire_sema(), it should be undone with a corresponding nv_mgmt_release_sema() call. Add it in the error handling path of the probe as already done in the remove function. Fixes: cac1c52c3621 ("forcedeth: mgmt unit interface") Signed-off-by: Christophe JAILLET Acked-by: Zhu Yanjun Link: https://lore.kernel.org/r/355e9a7d351b32ad897251b6f81b5886fcdc6766.1684571393.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 2bd110339288c18823dcace602b63b0d8627e520 Author: John Sperbeck Date: Sun May 21 19:29:53 2023 +0000 cgroup: always put cset in cgroup_css_set_put_fork A successful call to cgroup_css_set_fork() will always have taken a ref on kargs->cset (regardless of CLONE_INTO_CGROUP), so always do a corresponding put in cgroup_css_set_put_fork(). Without this, a cset and its contained css structures will be leaked for some fork failures. The following script reproduces the leak for a fork failure due to exceeding pids.max in the pids controller. A similar thing can happen if we jump to the bad_fork_cancel_cgroup label in copy_process(). [ -z "$1" ] && echo "Usage $0 pids-root" && exit 1 PID_ROOT=$1 CGROUP=$PID_ROOT/foo [ -e $CGROUP ] && rmdir -f $CGROUP mkdir $CGROUP echo 5 > $CGROUP/pids.max echo $$ > $CGROUP/cgroup.procs fork_bomb() { set -e for i in $(seq 10); do /bin/sleep 3600 & done } (fork_bomb) & wait echo $$ > $PID_ROOT/cgroup.procs kill $(cat $CGROUP/cgroup.procs) rmdir $CGROUP Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups") Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: John Sperbeck Signed-off-by: Tejun Heo commit ae8373a5add4ea39f032563cf12a02946d1e3546 Merge: 1177dcc963766 ce0b15d11ad83 Author: Linus Torvalds Date: Mon May 22 16:31:28 2023 -0700 Merge tag 'x86_urgent_for_6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Dave Hansen: "This works around and issue where the INVLPG instruction may miss invalidating kernel TLB entries in recent hybrid CPUs. I do expect an eventual microcode fix for this. When the microcode version numbers are known, we can circle back around and add them the model table to disable this workaround" * tag 'x86_urgent_for_6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Avoid incomplete Global INVLPG flushes commit 1177dcc9637661e05c18aa019a49821bcd6b3dc1 Merge: 421ca22e31387 d36f6efbe0cb4 Author: Linus Torvalds Date: Mon May 22 15:35:53 2023 -0700 Merge tag 'modules-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull module fix from Luis Chamberlain: "Only one fix has trickled through. Harshit Mogalapalli found a use-after-free bug through static analysis with smatch" * tag 'modules-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module: Fix use-after-free bug in read_file_mod_stats() commit d54820b22e404b06b2b65877ff802cc7b31688bc Author: Gleb Chesnokov Date: Wed May 17 11:22:35 2023 +0300 scsi: qla2xxx: Fix NULL pointer dereference in target mode When target mode is enabled, the pci_irq_get_affinity() function may return a NULL value in qla_mapq_init_qp_cpu_map() due to the qla24xx_enable_msix() code that handles IRQ settings for target mode. This leads to a crash due to a NULL pointer dereference. This patch fixes the issue by adding a check for the NULL value returned by pci_irq_get_affinity() and introducing a 'cpu_mapped' boolean flag to the qla_qpair structure, ensuring that the qpair's CPU affinity is updated when it has not been mapped to a CPU. Fixes: 1d201c81d4cc ("scsi: qla2xxx: Select qpair depending on which CPU post_cmd() gets called") Signed-off-by: Gleb Chesnokov Link: https://lore.kernel.org/r/56b416f2-4e0f-b6cf-d6d5-b7c372e3c6a2@scst.dev Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit d36f6efbe0cb422fe1e4475717d75f3737088832 Author: Harshit Mogalapalli Date: Thu Apr 27 22:59:33 2023 -0700 module: Fix use-after-free bug in read_file_mod_stats() Smatch warns: kernel/module/stats.c:394 read_file_mod_stats() warn: passing freed memory 'buf' We are passing 'buf' to simple_read_from_buffer() after freeing it. Fix this by changing the order of 'simple_read_from_buffer' and 'kfree'. Fixes: df3e764d8e5c ("module: add debug stats to help identify memory pressure") Signed-off-by: Harshit Mogalapalli Signed-off-by: Luis Chamberlain commit 2a737d3b8c792400118d6cf94958f559de9c5e59 Author: Maurizio Lombardi Date: Mon May 8 18:22:19 2023 +0200 scsi: target: iscsi: Prevent login threads from racing between each other The tpg->np_login_sem is a semaphore that is used to serialize the login process when multiple login threads run concurrently against the same target portal group. The iscsi_target_locate_portal() function finds the tpg, calls iscsit_access_np() against the np_login_sem semaphore and saves the tpg pointer in conn->tpg; If iscsi_target_locate_portal() fails, the caller will check for the conn->tpg pointer and, if it's not NULL, then it will assume that iscsi_target_locate_portal() called iscsit_access_np() on the semaphore. Make sure that conn->tpg gets initialized only if iscsit_access_np() was successful, otherwise iscsit_deaccess_np() may end up being called against a semaphore we never took, allowing more than one thread to access the same tpg. Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20230508162219.1731964-4-mlombard@redhat.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit 98a8c2bf938a5973716f280da618077a3d255976 Author: Maurizio Lombardi Date: Mon May 8 18:22:18 2023 +0200 scsi: target: iscsi: Remove unused transport_timer Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20230508162219.1731964-3-mlombard@redhat.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit 13247018d68f21e7132924b9853f7e2c423588b6 Author: Maurizio Lombardi Date: Mon May 8 18:22:17 2023 +0200 scsi: target: iscsi: Fix hang in the iSCSI login code If the initiator suddenly stops sending data during a login while keeping the TCP connection open, the login_work won't be scheduled and will never release the login semaphore; concurrent login operations will therefore get stuck and fail. The bug is due to the inability of the login timeout code to properly handle this particular case. Fix the problem by replacing the old per-NP login timer with a new per-connection timer. The timer is started when an initiator connects to the target; if it expires, it sends a SIGINT signal to the thread pointed at by the conn->login_kworker pointer. conn->login_kworker is set by calling the iscsit_set_login_timer_kworker() helper, initially it will point to the np thread; When the login operation's control is in the process of being passed from the NP-thread to login_work, the conn->login_worker pointer is set to NULL. Finally, login_kworker will be changed to point to the worker thread executing the login_work job. If conn->login_kworker is NULL when the timer expires, it means that the login operation hasn't been completed yet but login_work isn't running, in this case the timer will mark the login process as failed and will schedule login_work so the latter will be forced to free the resources it holds. Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20230508162219.1731964-2-mlombard@redhat.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit 421ca22e313871d4104617bab077b275b30950ae Merge: 44c026a73be80 43439d858bbae Author: Linus Torvalds Date: Mon May 22 12:01:13 2023 -0700 Merge tag 'nfs-for-6.4-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: "Stable Fix: - Don't change task->tk_status after the call to rpc_exit_task Other Bugfixes: - Convert kmap_atomic() to kmap_local_folio() - Fix a potential double free with READ_PLUS" * tag 'nfs-for-6.4-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4.2: Fix a potential double free with READ_PLUS SUNRPC: Don't change task->tk_status after the call to rpc_exit_task NFS: Convert kmap_atomic() to kmap_local_folio() commit ab1de7ead871ebe6d12a774c3c25de0388cde082 Author: Qi Zheng Date: Wed May 17 07:45:45 2023 +0000 cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks() The commit 4f7e7236435c ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") fixed the deadlock between cgroup_threadgroup_rwsem and cpus_read_lock() by introducing cgroup_attach_{lock,unlock}() and removing cpus_read_{lock,unlock}() from cpuset_attach(). But cgroup_transfer_tasks() was missed and not handled, which will cause th following warning: WARNING: CPU: 0 PID: 589 at kernel/cpu.c:526 lockdep_assert_cpus_held+0x32/0x40 CPU: 0 PID: 589 Comm: kworker/1:4 Not tainted 6.4.0-rc2-next-20230517 #50 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: events cpuset_hotplug_workfn RIP: 0010:lockdep_assert_cpus_held+0x32/0x40 <...> Call Trace: cpuset_attach+0x40/0x240 cgroup_migrate_execute+0x452/0x5e0 ? _raw_spin_unlock_irq+0x28/0x40 cgroup_transfer_tasks+0x1f3/0x360 ? find_held_lock+0x32/0x90 ? cpuset_hotplug_workfn+0xc81/0xed0 cpuset_hotplug_workfn+0xcb1/0xed0 ? process_one_work+0x248/0x5b0 process_one_work+0x2b9/0x5b0 worker_thread+0x56/0x3b0 ? process_one_work+0x5b0/0x5b0 kthread+0xf1/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 So just use the cgroup_attach_{lock,unlock}() helper to fix it. Reported-by: Zhao Gongyi Signed-off-by: Qi Zheng Acked-by: Muchun Song Fixes: 05c7b7a92cc8 ("cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug") Cc: stable@vger.kernel.org # v5.17+ Signed-off-by: Tejun Heo commit b34ffb0c6d23583830f9327864b9c1f486003305 Author: Anton Protopopov Date: Mon May 22 15:45:58 2023 +0000 bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps The LRU and LRU_PERCPU maps allocate a new element on update before locking the target hash table bucket. Right after that the maps try to lock the bucket. If this fails, then maps return -EBUSY to the caller without releasing the allocated element. This makes the element untracked: it doesn't belong to either of free lists, and it doesn't belong to the hash table, so can't be re-used; this eventually leads to the permanent -ENOMEM on LRU map updates, which is unexpected. Fix this by returning the element to the local free list if bucket locking fails. Fixes: 20b6cc34ea74 ("bpf: Avoid hashtab deadlock with map_locked") Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20230522154558.2166815-1-aspsk@isovalent.com Signed-off-by: Martin KaFai Lau commit d703797380c540bbeac03f104ebcfc364eaf47cc Author: Helge Deller Date: Wed May 17 15:54:40 2023 +0200 parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory() Flush caches after changing gatt entries and calculate entry according to SBA requirements. Signed-off-by: Helge Deller commit 59fa12646d9f56c842b4d5b6418ed77af625c588 Author: Helge Deller Date: Wed May 17 15:52:30 2023 +0200 parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu() Add comment in arch_sync_dma_for_device() and handle the direction flag in arch_sync_dma_for_cpu(). When receiving data from the device (DMA_FROM_DEVICE) unconditionally purge the data cache in arch_sync_dma_for_cpu(). Signed-off-by: Helge Deller commit 2212fc2acf3f6ee690ea36506fb882a19d1bfcab Author: Jon Pan-Doh Date: Wed Apr 26 13:32:56 2023 -0700 iommu/amd: Fix domain flush size when syncing iotlb When running on an AMD vIOMMU, we observed multiple invalidations (of decreasing power of 2 aligned sizes) when unmapping a single page. Domain flush takes gather bounds (end-start) as size param. However, gather->end is defined as the last inclusive address (start + size - 1). This leads to an off by 1 error. With this patch, verified that 1 invalidation occurs when unmapping a single page. Fixes: a270be1b3fdf ("iommu/amd: Use only natural aligned flushes in a VM") Cc: stable@vger.kernel.org # >= 5.15 Signed-off-by: Jon Pan-Doh Tested-by: Sudheer Dantuluri Suggested-by: Gary Zibrat Reviewed-by: Vasant Hegde Acked-by: Nadav Amit Link: https://lore.kernel.org/r/20230426203256.237116-1-pandoh@google.com Signed-off-by: Joerg Roedel commit 29f54745f24547a84b18582e054df9bea1a7bf3e Author: Jason Gunthorpe Date: Tue Apr 25 16:04:15 2023 -0300 iommu/amd: Add missing domain type checks Drivers are supposed to list the domain types they support in their domain_alloc() ops so when we add new domain types, like BLOCKING or SVA, they don't start breaking. This ended up providing an empty UNMANAGED domain when the core code asked for a BLOCKING domain, which happens to be the fallback for drivers that don't support it, but this is completely wrong for SVA. Check for the DMA types AMD supports and reject every other kind. Fixes: 136467962e49 ("iommu: Add IOMMU SVA domain support") Signed-off-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/0-v1-2ac37b893728+da-amd_check_types_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 8ec4e2befef10c7679cd59251956a428e783c0b5 Author: Jerry Snitselaar Date: Thu Apr 20 12:20:13 2023 -0700 iommu/amd: Fix up merge conflict resolution Merge commit e17c6debd4b2 ("Merge branches 'arm/mediatek', 'arm/msm', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'x86/vt-d' and 'x86/amd' into next") added amd_iommu_init_devices, amd_iommu_uninit_devices, and amd_iommu_init_notifier back to drivers/iommu/amd/amd_iommu.h. The only references to them are here, so clean them up. Fixes: e17c6debd4b2 ("Merge branches 'arm/mediatek', 'arm/msm', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'x86/vt-d' and 'x86/amd' into next") Cc: Joerg Roedel Cc: Suravee Suthikulpanit Cc: Will Deacon Cc: Robin Murphy Signed-off-by: Jerry Snitselaar Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20230420192013.733331-1-jsnitsel@redhat.com Signed-off-by: Joerg Roedel commit af47b0a24058e56e983881993752f88288ca6511 Author: Joao Martins Date: Wed Apr 19 21:11:54 2023 +0100 iommu/amd: Handle GALog overflows GALog exists to propagate interrupts into all vCPUs in the system when interrupts are marked as non running (e.g. when vCPUs aren't running). A GALog overflow happens when there's in no space in the log to record the GATag of the interrupt. So when the GALOverflow condition happens, the GALog queue is processed and the GALog is restarted, as the IOMMU manual indicates in section "2.7.4 Guest Virtual APIC Log Restart Procedure": | * Wait until MMIO Offset 2020h[GALogRun]=0b so that all request | entries are completed as circumstances allow. GALogRun must be 0b to | modify the guest virtual APIC log registers safely. | * Write MMIO Offset 0018h[GALogEn]=0b. | * As necessary, change the following values (e.g., to relocate or | resize the guest virtual APIC event log): | - the Guest Virtual APIC Log Base Address Register | [MMIO Offset 00E0h], | - the Guest Virtual APIC Log Head Pointer Register | [MMIO Offset 2040h][GALogHead], and | - the Guest Virtual APIC Log Tail Pointer Register | [MMIO Offset 2048h][GALogTail]. | * Write MMIO Offset 2020h[GALOverflow] = 1b to clear the bit (W1C). | * Write MMIO Offset 0018h[GALogEn] = 1b, and either set | MMIO Offset 0018h[GAIntEn] to enable the GA log interrupt or clear | the bit to disable it. Failing to handle the GALog overflow means that none of the VFs (in any guest) will work with IOMMU AVIC forcing the user to power cycle the host. When handling the event it resumes the GALog without resizing much like how it is done in the event handler overflow. The [MMIO Offset 2020h][GALOverflow] bit might be set in status register without the [MMIO Offset 2020h][GAInt] bit, so when deciding to poll for GA events (to clear space in the galog), also check the overflow bit. [suravee: Check for GAOverflow without GAInt, toggle CONTROL_GAINT_EN] Co-developed-by: Suravee Suthikulpanit Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joao Martins Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20230419201154.83880-3-joao.m.martins@oracle.com Signed-off-by: Joerg Roedel commit ed8a2f4ddef2eaaf864ab1efbbca9788187036ab Author: Joao Martins Date: Wed Apr 19 21:11:53 2023 +0100 iommu/amd: Don't block updates to GATag if guest mode is on On KVM GSI routing table updates, specially those where they have vIOMMUs with interrupt remapping enabled (to boot >255vcpus setups without relying on KVM_FEATURE_MSI_EXT_DEST_ID), a VMM may update the backing VF MSIs with a new VCPU affinity. On AMD with AVIC enabled, the new vcpu affinity info is updated via: avic_pi_update_irte() irq_set_vcpu_affinity() amd_ir_set_vcpu_affinity() amd_iommu_{de}activate_guest_mode() Where the IRTE[GATag] is updated with the new vcpu affinity. The GATag contains VM ID and VCPU ID, and is used by IOMMU hardware to signal KVM (via GALog) when interrupt cannot be delivered due to vCPU is in blocking state. The issue is that amd_iommu_activate_guest_mode() will essentially only change IRTE fields on transitions from non-guest-mode to guest-mode and otherwise returns *with no changes to IRTE* on already configured guest-mode interrupts. To the guest this means that the VF interrupts remain affined to the first vCPU they were first configured, and guest will be unable to issue VF interrupts and receive messages like this from spurious interrupts (e.g. from waking the wrong vCPU in GALog): [ 167.759472] __common_interrupt: 3.34 No irq handler for vector [ 230.680927] mlx5_core 0000:00:02.0: mlx5_cmd_eq_recover:247:(pid 3122): Recovered 1 EQEs on cmd_eq [ 230.681799] mlx5_core 0000:00:02.0: wait_func_handle_exec_timeout:1113:(pid 3122): cmd[0]: CREATE_CQ(0x400) recovered after timeout [ 230.683266] __common_interrupt: 3.34 No irq handler for vector Given the fact that amd_ir_set_vcpu_affinity() uses amd_iommu_activate_guest_mode() underneath it essentially means that VCPU affinity changes of IRTEs are nops. Fix it by dropping the check for guest-mode at amd_iommu_activate_guest_mode(). Same thing is applicable to amd_iommu_deactivate_guest_mode() although, even if the IRTE doesn't change underlying DestID on the host, the VFIO IRQ handler will still be able to poke at the right guest-vCPU. Fixes: b9c6ff94e43a ("iommu/amd: Re-factor guest virtual APIC (de-)activation code") Signed-off-by: Joao Martins Reviewed-by: Suravee Suthikulpanit Link: https://lore.kernel.org/r/20230419201154.83880-2-joao.m.martins@oracle.com Signed-off-by: Joerg Roedel commit ec014683c564fb74fc68e8f5e84691d3b3839d24 Author: Chao Wang Date: Mon Apr 17 03:04:21 2023 +0000 iommu/rockchip: Fix unwind goto issue Smatch complains that drivers/iommu/rockchip-iommu.c:1306 rk_iommu_probe() warn: missing unwind goto? The rk_iommu_probe function, after obtaining the irq value through platform_get_irq, directly returns an error if the returned value is negative, without releasing any resources. Fix this by adding a new error handling label "err_pm_disable" and use a goto statement to redirect to the error handling process. In order to preserve the original semantics, set err to the value of irq. Fixes: 1aa55ca9b14a ("iommu/rockchip: Move irq request past pm_runtime_enable") Signed-off-by: Chao Wang Reviewed-by: Dongliang Mu Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20230417030421.2777-1-D202280639@hust.edu.cn Signed-off-by: Joerg Roedel commit e332003bb216a9f91e08004b9e2de0745f321290 Author: Randy Dunlap Date: Thu Mar 30 09:58:17 2023 -0700 iommu: Make IPMMU_VMSA dependencies more strict On riscv64, linux-next-20233030 (and for several days earlier), there is a kconfig warning: WARNING: unmet direct dependencies detected for IOMMU_IO_PGTABLE_LPAE Depends on [n]: IOMMU_SUPPORT [=y] && (ARM || ARM64 || COMPILE_TEST [=n]) && !GENERIC_ATOMIC64 [=n] Selected by [y]: - IPMMU_VMSA [=y] && IOMMU_SUPPORT [=y] && (ARCH_RENESAS [=y] || COMPILE_TEST [=n]) && !GENERIC_ATOMIC64 [=n] and build errors: riscv64-linux-ld: drivers/iommu/io-pgtable-arm.o: in function `.L140': io-pgtable-arm.c:(.init.text+0x1e8): undefined reference to `alloc_io_pgtable_ops' riscv64-linux-ld: drivers/iommu/io-pgtable-arm.o: in function `.L168': io-pgtable-arm.c:(.init.text+0xab0): undefined reference to `free_io_pgtable_ops' riscv64-linux-ld: drivers/iommu/ipmmu-vmsa.o: in function `.L140': ipmmu-vmsa.c:(.text+0xbc4): undefined reference to `free_io_pgtable_ops' riscv64-linux-ld: drivers/iommu/ipmmu-vmsa.o: in function `.L0 ': ipmmu-vmsa.c:(.text+0x145e): undefined reference to `alloc_io_pgtable_ops' Add ARM || ARM64 || COMPILE_TEST dependencies to IPMMU_VMSA to prevent these issues, i.e., so that ARCH_RENESAS on RISC-V is not allowed. This makes the ARCH dependencies become: depends on (ARCH_RENESAS && (ARM || ARM64)) || COMPILE_TEST but that can be a bit hard to read. Fixes: 8292493c22c8 ("riscv: Kconfig.socs: Add ARCH_RENESAS kconfig option") Signed-off-by: Randy Dunlap Suggested-by: Geert Uytterhoeven Cc: Joerg Roedel Cc: Will Deacon Cc: Robin Murphy Cc: iommu@lists.linux.dev Cc: Conor Dooley Cc: Lad Prabhakar Reviewed-by: Robin Murphy Link: https://lore.kernel.org/r/20230330165817.21920-1-rdunlap@infradead.org Signed-off-by: Joerg Roedel commit 240ca9553fcd8da6851dc6b449996c21344b9b66 Merge: 3a2e3fa795052 25148f57a2a6d Author: Mark Brown Date: Mon May 22 15:48:41 2023 +0100 ASoC: Intel: Fixes Merge series from Amadeusz Sławiński : Series of fixes for issues found during development and testing, primarly for avs driver. commit 45dfbd992923f4df174db4e23b96fca7e30d73e2 Author: Imre Deak Date: Wed May 10 13:31:18 2023 +0300 drm/i915: Fix PIPEDMC disabling for a bigjoiner configuration For a bigjoiner configuration display->crtc_disable() will be called first for the slave CRTCs and then for the master CRTC. However slave CRTCs will be actually disabled only after the master CRTC is disabled (from the encoder disable hooks called with the master CRTC state). Hence the slave PIPEDMCs can be disabled only after the master CRTC is disabled, make this so. intel_encoders_post_pll_disable() must be called only for the master CRTC, as for the other two encoder disable hooks. While at it fix this up as well. This didn't cause a problem, since intel_encoders_post_pll_disable() will call the corresponding hook only for an encoder/connector connected to the given CRTC, however slave CRTCs will have no associated encoder/connector. Fixes: 3af2ff0840be ("drm/i915: Enable a PIPEDMC whenever its corresponding pipe is enabled") Cc: Rodrigo Vivi Cc: Ville Syrjälä Reviewed-by: Ville Syrjälä Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230510103131.1618266-2-imre.deak@intel.com (cherry picked from commit 7eeef32719f6af935a1554813e6bc206446339cd) Signed-off-by: Joonas Lahtinen commit eb799279fb1f9c63c520fe8c1c41cb9154252db6 Author: Tetsuo Handa Date: Thu May 11 22:47:32 2023 +0900 debugobjects: Don't wake up kswapd from fill_pool() syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | __GFP_KSWAPD_RECLAIM) and therefore tries to wake up kswapd, which acquires kswapd_wait::lock. Since fill_pool() might be called with arbitrary locks held, fill_pool() should not assume that acquiring kswapd_wait::lock is safe. Use __GFP_HIGH instead and remove __GFP_NORETRY as it is pointless for !__GFP_DIRECT_RECLAIM allocation. Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects") Reported-by: syzbot Signed-off-by: Tetsuo Handa Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/6577e1fa-b6ee-f2be-2414-a2b51b1c5e30@I-love.SAKURA.ne.jp Closes: https://syzkaller.appspot.com/bug?extid=fe0c72f0ccbb93786380 commit 81302b1c7c997e8a56c1c2fc63a296ebeb0cd2d0 Author: Takashi Iwai Date: Thu May 18 13:35:20 2023 +0200 ALSA: hda: Fix unhandled register update during auto-suspend period It's reported that the recording started right after the driver probe doesn't work properly, and it turned out that this is related with the codec auto-suspend. Namely, after the probe phase, the usage count goes zero, and the auto-suspend is programmed, but the codec is kept still active until the auto-suspend expiration. When an application (e.g. alsactl) updates the mixer values at this moment, the values are cached but not actually written. Then, starting arecord thereafter also results in the silence because of the missing unmute. The root cause is the handling of "lazy update" mode; when a mixer value is updated *after* the suspend, it should update only the cache and exits. At the resume, the cached value is written to the device, in turn. The problem is that the current code misinterprets the state of auto-suspend as if it were already suspended. Although we can add the check of the actual device state after pm_runtime_get_if_in_use() for catching the missing state, this won't suffice; the second call of regmap_update_bits_check() will skip writing the register because the cache has been already updated by the first call. So we'd need fixes in two different places. OTOH, a simpler fix is to replace pm_runtime_get_if_in_use() with pm_runtime_get_if_active() (with ign_usage_count=true). This change implies that the driver takes the pm refcount if the device is still in ACTIVE state and continues the processing. A small caveat is that this will leave the auto-suspend timer. But, since the timer callback itself checks the device state and aborts gracefully when it's active, this won't be any substantial problem. Long story short: we address the missing register-write problem just by replacing the pm_runtime_*() call in snd_hda_keep_power_up(). Fixes: fc4f000bf8c0 ("ALSA: hda - Fix unexpected resume through regmap code path") Reported-by: Amadeusz Sławiński Closes: https://lore.kernel.org/r/a7478636-af11-92ab-731c-9b13c582a70d@linux.intel.com Suggested-by: Cezary Rojewski Cc: Link: https://lore.kernel.org/r/20230518113520.15213-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b845b574f86dcb6a70dfa698aa87a237b0878d2a Author: Finn Thain Date: Sat May 6 19:38:12 2023 +1000 m68k: Move signal frame following exception on 68020/030 On 68030/020, an instruction such as, moveml %a2-%a3/%a5,%sp@- may cause a stack page fault during instruction execution (i.e. not at an instruction boundary) and produce a format 0xB exception frame. In this situation, the value of USP will be unreliable. If a signal is to be delivered following the exception, this USP value is used to calculate the location for a signal frame. This can result in a corrupted user stack. The corruption was detected in dash (actually in glibc) where it showed up as an intermittent "stack smashing detected" message and crash following signal delivery for SIGCHLD. It was hard to reproduce that failure because delivery of the signal raced with the page fault and because the kernel places an unpredictable gap of up to 7 bytes between the USP and the signal frame. A format 0xB exception frame can be produced by a bus error or an address error. The 68030 Users Manual says that address errors occur immediately upon detection during instruction prefetch. The instruction pipeline allows prefetch to overlap with other instructions, which means an address error can arise during the execution of a different instruction. So it seems likely that this patch may help in the address error case also. Reported-and-tested-by: Stan Johnson Link: https://lore.kernel.org/all/CAMuHMdW3yD22_ApemzW_6me3adq6A458u1_F0v-1EYwK_62jPA@mail.gmail.com/ Cc: Michael Schmitz Cc: Andreas Schwab Cc: stable@vger.kernel.org Co-developed-by: Michael Schmitz Signed-off-by: Michael Schmitz Signed-off-by: Finn Thain Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/9e66262a754fcba50208aa424188896cc52a1dd1.1683365892.git.fthain@linux-m68k.org Signed-off-by: Geert Uytterhoeven commit 89c0c62e947a01e7a36b54582fd9c9e346170255 Author: Vineeth Vijayan Date: Thu May 4 20:53:20 2023 +0200 s390/cio: unregister device when the only path is gone Currently, if the device is offline and all the channel paths are either configured or varied offline, the associated subchannel gets unregistered. Don't unregister the subchannel, instead unregister offline device. Signed-off-by: Vineeth Vijayan Reviewed-by: Peter Oberparleiter Signed-off-by: Alexander Gordeev commit 6afe2ae8dc48e643cb9f52e86494b96942440bc6 Author: Charles Keepax Date: Thu May 18 10:39:26 2023 +0100 spi: spi-cadence: Interleave write of TX and read of RX FIFO When working in slave mode it seems the timing is exceedingly tight. The TX FIFO can never empty, because the master is driving the clock so zeros would be sent for those bytes where the FIFO is empty. Return to interleaving the writing of the TX FIFO and the reading of the RX FIFO to try to ensure the data is available when required. Fixes: a84c11e16dc2 ("spi: spi-cadence: Avoid read of RX FIFO before its ready") Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20230518093927.711358-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit c21f11d182c2180d8b90eaff84f574cfa845b250 Author: Matthew Auld Date: Fri May 19 10:07:33 2023 +0100 drm: fix drmm_mutex_init() In mutex_init() lockdep identifies a lock by defining a special static key for each lock class. However if we wrap the macro in a function, like in drmm_mutex_init(), we end up generating: int drmm_mutex_init(struct drm_device *dev, struct mutex *lock) { static struct lock_class_key __key; __mutex_init((lock), "lock", &__key); .... } The static __key here is what lockdep uses to identify the lock class, however since this is just a normal function the key here will be created once, where all callers then use the same key. In effect the mutex->depmap.key will be the same pointer for different drmm_mutex_init() callers. This then results in impossible lockdep splats since lockdep thinks completely unrelated locks are the same lock class. To fix this turn drmm_mutex_init() into a macro such that it generates a different "static struct lock_class_key __key" for each invocation, which looks to be inline with what mutex_init() wants. v2: - Revamp the commit message with clearer explanation of the issue. - Rather export __drmm_mutex_release() than static inline. Reported-by: Thomas Hellström Reported-by: Sarah Walker Fixes: e13f13e039dc ("drm: Add DRM-managed mutex_init()") Cc: Stanislaw Gruszka Cc: Boris Brezillon Cc: Thomas Zimmermann Cc: Jocelyn Falempe Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Signed-off-by: Matthew Auld Reviewed-by: Boris Brezillon Reviewed-by: Stanislaw Gruszka Reviewed-by: Lucas De Marchi Acked-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230519090733.489019-1-matthew.auld@intel.com commit 3a2e3fa795052b42da013931bc2e451bcecf4f0c Author: David Epping Date: Fri May 19 13:05:53 2023 +0200 ASoC: dt-bindings: tlv320aic32x4: Fix supply names The term "-supply" is a suffix to regulator names. Signed-off-by: David Epping Link: https://lore.kernel.org/r/20230519110545.GA18663@nucnuc.mle Signed-off-by: Mark Brown commit 25148f57a2a6d157779bae494852e172952ba980 Author: Amadeusz Sławiński Date: Fri May 19 22:17:11 2023 +0200 ASoC: Intel: avs: Add missing checks on FE startup Constraint functions have return values, they should be checked for potential errors. Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230519201711.4073845-8-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 320f4d868b83a804e3a4bd61a5b7d0f1db66380e Author: Amadeusz Sławiński Date: Fri May 19 22:17:10 2023 +0200 ASoC: Intel: avs: Fix avs_path_module::instance_id size All IPCs using instance_id use 8 bit value. Original commit used 16 bit value because FW reports possible max value in 16 bit field, but in practice FW limits the value to 8 bits. Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230519201711.4073845-7-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 836855100b87b4dd7a82546131779dc255c18b67 Author: Cezary Rojewski Date: Fri May 19 22:17:09 2023 +0200 ASoC: Intel: avs: Account for UID of ACPI device Configurations with multiple codecs attached to the platform are supported but only if each from the set is different. Add new field representing the 'Unique ID' so that codecs that share Vendor and Part IDs can be differentiated and thus enabling support for such configurations. Signed-off-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230519201711.4073845-6-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 1cf036deebcdec46d6348842bd2f8931202fd4cd Author: Cezary Rojewski Date: Fri May 19 22:17:08 2023 +0200 ASoC: Intel: avs: Fix declaration of enum avs_channel_config Constant 'C4_CHANNEL' does not exist on the firmware side. Value 0xC is reserved for 'C7_1' instead. Fixes: 580a5912d1fe ("ASoC: Intel: avs: Declare module configuration types") Signed-off-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230519201711.4073845-5-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 95109657471311601b98e71f03d0244f48dc61bb Author: Cezary Rojewski Date: Fri May 19 22:17:07 2023 +0200 ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg Constant 'C4_CHANNEL' does not exist on the firmware side. Value 0xC is reserved for 'C7_1' instead. Fixes: 04afbbbb1cba ("ASoC: Intel: Skylake: Update the topology interface structure") Signed-off-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230519201711.4073845-4-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit d849996f7458042af803b7d15a181922834c5249 Author: Amadeusz Sławiński Date: Fri May 19 22:17:06 2023 +0200 ASoC: Intel: avs: Access path components under lock Path and its components should be accessed under lock to prevent problems with one thread modifying them while other tries to read. Fixes: c8c960c10971 ("ASoC: Intel: avs: APL-based platforms support") Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230519201711.4073845-3-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit ff04437f6dcd138b50483afc7b313f016020ce8f Author: Amadeusz Sławiński Date: Fri May 19 22:17:05 2023 +0200 ASoC: Intel: avs: Fix module lookup When changing value of kcontrol, FW module to which data should be send needs to be found. Currently it is done in improper way, fix it. Change function name to indicate that it looks only for volume module. This allows to change volume during runtime, instead of only changing init value. Fixes: be2b81b519d7 ("ASoC: Intel: avs: Parse control tuples") Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230519201711.4073845-2-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 6ca328e985cd995dfd1d5de44046e6074f853fbb Author: Xin Long Date: Thu May 18 16:03:00 2023 -0400 sctp: fix an issue that plpmtu can never go to complete state When doing plpmtu probe, the probe size is growing every time when it receives the ACK during the Search state until the probe fails. When the failure occurs, pl.probe_high is set and it goes to the Complete state. However, if the link pmtu is huge, like 65535 in loopback_dev, the probe eventually keeps using SCTP_MAX_PLPMTU as the probe size and never fails. Because of that, pl.probe_high can not be set, and the plpmtu probe can never go to the Complete state. Fix it by setting pl.probe_high to SCTP_MAX_PLPMTU when the probe size grows to SCTP_MAX_PLPMTU in sctp_transport_pl_recv(). Also, not allow the probe size greater than SCTP_MAX_PLPMTU in the Complete state. Fixes: b87641aff9e7 ("sctp: do state transition when a probe succeeds on HB ACK recv path") Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 7843380d07bbeffd3ce6504e73cf61f840ae76ca Author: Adam Stylinski Date: Sun May 21 10:52:23 2023 -0400 ALSA: hda/ca0132: add quirk for EVGA X299 DARK This quirk is necessary for surround and other DSP effects to work with the onboard ca0132 based audio chipset for the EVGA X299 dark mainboard. Signed-off-by: Adam Stylinski Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=67071 Link: https://lore.kernel.org/r/ZGopOe19T1QOwizS@eggsbenedict.adamsnet Signed-off-by: Takashi Iwai commit 4115af49d2c24e840461fb83027315e2d2de6db4 Merge: 44c026a73be80 cddb536a73ef2 Author: Thomas Gleixner Date: Mon May 22 08:11:01 2023 +0200 Merge tag 'irqchip-fixes-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zyngier: - MIPS GIC fixes for issues that could result in either loss of state in the interrupt controller, or a deadlock - Workaround for Mediatek Chromebooks that only save/restore partial state when turning the GIC redistributors off, resulting if fireworks if Linux uses interrupt priorities for pseudo-NMIs - Fix the MBIGEN error handling on init - Mark meson-gpio OF data structures as __maybe_unused, avoiding compilation warnings on non-OF setups Link: https://lore.kernel.org/lkml/20230521101812.2520740-1-maz@kernel.org commit 70c2e03e9aaf17496c63f6e42333c012f5ae5307 Author: Mika Westerberg Date: Wed Mar 29 13:23:04 2023 +0300 thunderbolt: dma_test: Use correct value for absent rings when creating paths Both tb_xdomain_enable_paths() and tb_xdomain_disable_paths() expect -1, not 0, if the corresponding ring is not needed. For this reason change the driver to use correct value for the rings that are not needed. Fixes: 180b0689425c ("thunderbolt: Allow multiple DMA tunnels over a single XDomain connection") Cc: stable@vger.kernel.org Reported-by: Pengfei Xu Tested-by: Pengfei Xu Signed-off-by: Mika Westerberg commit 44c026a73be8038f03dbdeef028b642880cf1511 Author: Linus Torvalds Date: Sun May 21 14:05:48 2023 -0700 Linux 6.4-rc3 commit fa4fe8ce4256bee870eae1c4a5b33ad463590230 Merge: a35747c3107eb 73a23d7710331 Author: Linus Torvalds Date: Sun May 21 14:03:22 2023 -0700 Merge tag 'uml-for-linus-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML fix from Richard Weinberger: - Fix modular build for UML watchdog * tag 'uml-for-linus-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: harddog: fix modular build commit a35747c3107ebb8ef2749d4dabaf71c205e0d0fe Merge: c47d122c5ba5f b9846a698c9af Author: Linus Torvalds Date: Sun May 21 13:58:37 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Plug a race in the stage-2 mapping code where the IPA and the PA would end up being out of sync - Make better use of the bitmap API (bitmap_zero, bitmap_zalloc...) - FP/SVE/SME documentation update, in the hope that this field becomes clearer... - Add workaround for Apple SEIS brokenness to a new SoC - Random comment fixes x86: - add MSR_IA32_TSX_CTRL into msrs_to_save - fixes for XCR0 handling in SGX enclaves Generic: - Fix vcpu_array[0] races - Fix race between starting a VM and 'reboot -f'" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: VMX: add MSR_IA32_TSX_CTRL into msrs_to_save KVM: x86: Don't adjust guest's CPUID.0x12.1 (allowed SGX enclave XFRM) KVM: VMX: Don't rely _only_ on CPUID to enforce XCR0 restrictions for ECREATE KVM: Fix vcpu_array[0] races KVM: VMX: Fix header file dependency of asm/vmx.h KVM: Don't enable hardware after a restart/shutdown is initiated KVM: Use syscore_ops instead of reboot_notifier to hook restart/shutdown KVM: arm64: vgic: Add Apple M2 PRO/MAX cpus to the list of broken SEIS implementations KVM: arm64: Clarify host SME state management KVM: arm64: Restructure check for SVE support in FP trap handler KVM: arm64: Document check for TIF_FOREIGN_FPSTATE KVM: arm64: Fix repeated words in comments KVM: arm64: Constify start/end/phys fields of the pgtable walker data KVM: arm64: Infer PA offset from VA in hyp map walker KVM: arm64: Infer the PA offset from IPA in stage-2 map walker KVM: arm64: Use the bitmap API to allocate bitmaps KVM: arm64: Slightly optimize flush_context() commit c47d122c5ba5f3b3371cfe051d770b5bbd591f6b Merge: 4927cb98f0eea 4e111f0cf0ee9 Author: Linus Torvalds Date: Sun May 21 13:24:59 2023 -0700 Merge tag 'perf-tools-fixes-for-v6.4-1-2023-05-20' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fail graciously if BUILD_BPF_SKEL=1 is specified and clang isn't available - Add empty 'struct rq' to 'perf lock contention' to satisfy libbpf 'runqueue' type verification. This feature is built only with BUILD_BPF_SKEL=1 - Make vmlinux.h use bpf.h and perf_event.h in source directory, not system ones that may be old and not have things like 'union perf_sample_weight' - Add system include paths to BPF builds to pick things missing in the headers included by clang -target bpf - Update various header copies with the kernel sources - Change divide by zero and not supported events behavior to show 'nan'/'not counted' in 'perf stat' output. This happens when using things like 'perf stat -M TopdownL2 true', involving JSON metrics - Update no event/metric expectations affected by using JSON metrics in 'perf stat -ddd' perf test - Avoid segv with 'perf stat --topdown' for metrics without a group - Do not assume which events may have a PMU name, allowing the logic to keep an AUX event group together. Makes this usecase work again: $ perf record --no-bpf-event -c 10 -e '{intel_pt//,tlb_flush.stlb_any/aux-sample-size=8192/pp}:u' -- sleep 0.1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.078 MB perf.data ] $ perf script -F-dso,+addr | grep -C5 tlb_flush.stlb_any | head -11 sleep 20444 [003] 7939.510243: 1 branches:uH: 7f5350cc82a2 dl_main+0x9a2 => 7f5350cb38f0 _dl_add_to_namespace_list+0x0 sleep 20444 [003] 7939.510243: 1 branches:uH: 7f5350cb3908 _dl_add_to_namespace_list+0x18 => 7f5350cbb080 rtld_mutex_dummy+0x0 sleep 20444 [003] 7939.510243: 1 branches:uH: 7f5350cc8350 dl_main+0xa50 => 0 [unknown] sleep 20444 [003] 7939.510244: 1 branches:uH: 7f5350cc83ca dl_main+0xaca => 7f5350caeb60 _dl_process_pt_gnu_property+0x0 sleep 20444 [003] 7939.510245: 1 branches:uH: 7f5350caeb60 _dl_process_pt_gnu_property+0x0 => 0 [unknown] sleep 20444 7939.510245: 10 tlb_flush.stlb_any/aux-sample-size=8192/pp: 0 7f5350caeb60 _dl_process_pt_gnu_property+0x0 sleep 20444 [003] 7939.510254: 1 branches:uH: 7f5350cc87fe dl_main+0xefe => 7f5350ccd240 strcmp+0x0 sleep 20444 [003] 7939.510254: 1 branches:uH: 7f5350cc8862 dl_main+0xf62 => 0 [unknown] - Add a check for the above use case in 'perf test test_intel_pt' - Fix build with refcount checking on arm64, it was still accessing fields that need to be wrapped so that the refcounted struct gets checked - Fix contextid validation in ARM's CS-ETM, so that older kernels without that field can still be supported - Skip unsupported aggregation for stat events found in perf.data files in 'perf script' - Add stat test for record and script to check the previous problem - Remove needless debuginfod queries from 'perf test java symbol', this was just making the test take a long time to complete - Address python SafeConfigParser() deprecation warning in 'perf test attr' - Fix __NR_execve undeclared on i386 'perf bench syscall' build error * tag 'perf-tools-fixes-for-v6.4-1-2023-05-20' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (33 commits) perf bench syscall: Fix __NR_execve undeclared build error perf test attr: Fix python SafeConfigParser() deprecation warning perf test attr: Update no event/metric expectations tools headers disabled-features: Sync with the kernel sources tools headers UAPI: Sync arch prctl headers with the kernel sources tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench' tools headers x86 cpufeatures: Sync with the kernel sources tools headers UAPI: Sync s390 syscall table file that wires up the memfd_secret syscall tools headers UAPI: Sync linux/prctl.h with the kernel sources perf metrics: Avoid segv with --topdown for metrics without a group perf lock contention: Add empty 'struct rq' to satisfy libbpf 'runqueue' type verification perf cs-etm: Fix contextid validation perf arm64: Fix build with refcount checking perf test: Add stat test for record and script perf script: Skip aggregation for stat events perf build: Add system include paths to BPF builds perf bpf skels: Make vmlinux.h use bpf.h and perf_event.h in source directory perf parse-events: Do not break up AUX event group perf test test_intel_pt.sh: Test sample mode with event with PMU name perf evsel: Modify group pmu name for software events ... commit 4927cb98f0eeaa5dbeac882e8372f4b16dc62624 Merge: 90af47edea473 1f7aacc5eb9ed Author: Linus Torvalds Date: Sun May 21 11:53:52 2023 -0700 Merge tag 'powerpc-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix broken soft dirty tracking when using the Radix MMU (>= P9) - Fix ISA mapping when "ranges" property is not present, for PASemi Nemo boards - Fix a possible WARN_ON_ONCE hitting in BPF extable handling - Fix incorrect DMA address handling when using 2MB TCEs - Fix a bug in IOMMU table handling for SR-IOV devices - Fix the recent rework of IOMMU handling which left arch code calling clean up routines that are handled by the IOMMU core - A few assorted build fixes Thanks to Christian Zigotzky, Dan Horák, Gaurav Batra, Hari Bathini, Jason Gunthorpe, Nathan Chancellor, Naveen N. Rao, Nicholas Piggin, Pali Rohár, Randy Dunlap, and Rob Herring. * tag 'powerpc-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device powerpc/iommu: DMA address offset is incorrectly calculated with 2MB TCEs powerpc/iommu: Remove iommu_del_device() powerpc/crypto: Fix aes-gcm-p10 build when VSX=n powerpc/bpf: populate extable entries only during the last pass powerpc/boot: Disable power10 features after BOOTAFLAGS assignment powerpc/64s/radix: Fix soft dirty tracking powerpc/fsl_uli1575: fix kconfig warnings and build errors powerpc/isa-bridge: Fix ISA mapping when "ranges" is not present commit 90af47edea473e5776989f4b669401552c7ca558 Merge: 70e137e3840e1 a784452872261 Author: Linus Torvalds Date: Sun May 21 11:46:23 2023 -0700 Merge tag 'ata-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fix from Damien Le Moal: - Fix DT binding for the ahci-ceva driver to fully describe all iommus, from Michal * tag 'ata-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: dt-bindings: ata: ahci-ceva: Cover all 4 iommus entries commit 70e137e3840e1bc2deab32492316653c956a5c6b Merge: e2065b8c1b012 d9a45969abeb6 Author: Linus Torvalds Date: Sun May 21 11:13:23 2023 -0700 Merge tag 'fbdev-for-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "A few small unspectacular fbdev fixes: - Fix for USB endpoint check in udlfb (found by syzbot fuzzer) - Small fix in error code path in omapfb - compiler warning fixes in fbmem & i810 - code removal and whitespace cleanups in stifb and atyfb" * tag 'fbdev-for-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: stifb: Whitespace cleanups fbdev: udlfb: Use usb_control_msg_send() fbdev: udlfb: Fix endpoint check fbdev: atyfb: Remove unused clock determination fbdev: i810: include i810_main.h in i810_dvt.c fbdev: fbmem: mark get_fb_unmapped_area() static fbdev: omapfb: panel-tpo-td043mtea1: fix error code in probe() commit e2065b8c1b0120d47b327364a1a09090bdc11f31 Merge: 0c9dcf128ef99 e7b8b8ed9960b Author: Linus Torvalds Date: Sun May 21 10:55:31 2023 -0700 Merge tag '6.4-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: - two fixes for incorrect SMB3 message validation (one for client which uses 8 byte padding, and one for empty bcc) - two fixes for out of bounds bugs: one for username offset checks (in session setup) and the other for create context name length checks in open requests * tag '6.4-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: smb2: Allow messages padded to 8byte boundary ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix wrong UserName check in session_user ksmbd: fix global-out-of-bounds in smb2_find_context_vals commit 0c9dcf128ef99c257dcde5dbb8683605009906bf Merge: 0dd2a6fb1e34d 59a556aebc43d Author: Linus Torvalds Date: Sun May 21 10:20:58 2023 -0700 Merge tag '6.4-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Two smb3 client fixes, both related to deferred close, and also for stable: - send close for deferred handles before not after lease break response to avoid possible sharing violations - check all opens on an inode (looking for deferred handles) when lease break is returned not just the handle the lease break came in on" * tag '6.4-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: SMB3: drop reference to cfile before sending oplock break SMB3: Close all deferred handles of inode in case of handle lease break commit b9846a698c9aff4eb2214a06ac83638ad098f33f Author: Mingwei Zhang Date: Tue May 9 03:23:48 2023 +0000 KVM: VMX: add MSR_IA32_TSX_CTRL into msrs_to_save Add MSR_IA32_TSX_CTRL into msrs_to_save[] to explicitly tell userspace to save/restore the register value during migration. Missing this may cause userspace that relies on KVM ioctl(KVM_GET_MSR_INDEX_LIST) fail to port the value to the target VM. In addition, there is no need to add MSR_IA32_TSX_CTRL when ARCH_CAP_TSX_CTRL_MSR is not supported in kvm_get_arch_capabilities(). So add the checking in kvm_probe_msr_to_save(). Fixes: c11f83e0626b ("KVM: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality") Reported-by: Jim Mattson Signed-off-by: Mingwei Zhang Reviewed-by: Xiaoyao Li Reviewed-by: Jim Mattson Message-Id: <20230509032348.1153070-1-mizhang@google.com> Signed-off-by: Paolo Bonzini commit 275a87244ec8320e5d319132caa787329b04bb7e Author: Sean Christopherson Date: Wed May 3 09:08:37 2023 -0700 KVM: x86: Don't adjust guest's CPUID.0x12.1 (allowed SGX enclave XFRM) Drop KVM's manipulation of guest's CPUID.0x12.1 ECX and EDX, i.e. the allowed XFRM of SGX enclaves, now that KVM explicitly checks the guest's allowed XCR0 when emulating ECREATE. Note, this could theoretically break a setup where userspace advertises a "bad" XFRM and relies on KVM to provide a sane CPUID model, but QEMU is the only known user of KVM SGX, and QEMU explicitly sets the SGX CPUID XFRM subleaf based on the guest's XCR0. Reviewed-by: Kai Huang Tested-by: Kai Huang Signed-off-by: Sean Christopherson Message-Id: <20230503160838.3412617-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit ad45413d22e6a224f8530b6fcc9ac01c8ced7fd6 Author: Sean Christopherson Date: Wed May 3 09:08:36 2023 -0700 KVM: VMX: Don't rely _only_ on CPUID to enforce XCR0 restrictions for ECREATE Explicitly check the vCPU's supported XCR0 when determining whether or not the XFRM for ECREATE is valid. Checking CPUID works because KVM updates guest CPUID.0x12.1 to restrict the leaf to a subset of the guest's allowed XCR0, but that is rather subtle and KVM should not modify guest CPUID except for modeling true runtime behavior (allowed XFRM is most definitely not "runtime" behavior). Reviewed-by: Kai Huang Tested-by: Kai Huang Signed-off-by: Sean Christopherson Message-Id: <20230503160838.3412617-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a287f5b0cfc6804c5b12a4be13c7c9fe27869e90 Author: Benedict Wong Date: Wed May 10 01:30:22 2023 +0000 xfrm: Ensure policies always checked on XFRM-I input path This change adds methods in the XFRM-I input path that ensures that policies are checked prior to processing of the subsequent decapsulated packet, after which the relevant policies may no longer be resolvable (due to changing src/dst/proto/etc). Notably, raw ESP/AH packets did not perform policy checks inherently, whereas all other encapsulated packets (UDP, TCP encapsulated) do policy checks after calling xfrm_input handling in the respective encapsulation layer. Fixes: b0355dbbf13c ("Fix XFRM-I support for nested ESP tunnels") Test: Verified with additional Android Kernel Unit tests Test: Verified against Android CTS Signed-off-by: Benedict Wong Signed-off-by: Steffen Klassert commit 1f8b6df6a997a430b0c48b504638154b520781ad Author: Benedict Wong Date: Wed May 10 01:30:21 2023 +0000 xfrm: Treat already-verified secpath entries as optional This change allows inbound traffic through nested IPsec tunnels to successfully match policies and templates, while retaining the secpath stack trace as necessary for netfilter policies. Specifically, this patch marks secpath entries that have already matched against a relevant policy as having been verified, allowing it to be treated as optional and skipped after a tunnel decapsulation (during which the src/dst/proto/etc may have changed, and the correct policy chain no long be resolvable). This approach is taken as opposed to the iteration in b0355dbbf13c, where the secpath was cleared, since that breaks subsequent validations that rely on the existence of the secpath entries (netfilter policies, or transport-in-tunnel mode, where policies remain resolvable). Fixes: b0355dbbf13c ("Fix XFRM-I support for nested ESP tunnels") Test: Tested against Android Kernel Unit Tests Test: Tested against Android CTS Signed-off-by: Benedict Wong Signed-off-by: Steffen Klassert commit 358e526a1648cdd773ba169da5867874ae2408e3 Author: Michael Ellerman Date: Fri May 19 21:38:06 2023 +1000 powerpc/mm: Reinstate ARCH_FORCE_MAX_ORDER ranges Commit 1e8fed873e74 ("powerpc: drop ranges for definition of ARCH_FORCE_MAX_ORDER") removed the limits on the possible values for ARCH_FORCE_MAX_ORDER. However removing the ranges entirely causes some common work flows to break. For example building a defconfig (which uses 64K pages), changing the page size to 4K, and rebuilding used to work, because ARCH_FORCE_MAX_ORDER would be clamped to 12 by the ranges. With the ranges removed it creates a kernel that builds but crashes at boot: kernel BUG at mm/huge_memory.c:470! Oops: Exception in kernel mode, sig: 5 [#1] ... NIP hugepage_init+0x9c/0x278 LR do_one_initcall+0x80/0x320 Call Trace: do_one_initcall+0x80/0x320 kernel_init_freeable+0x304/0x3ac kernel_init+0x30/0x1a0 ret_from_kernel_user_thread+0x14/0x1c The reasoning for removing the ranges was that some of the values were too large. So take that into account and limit the maximums to 10 which is the default max, except for the 4K case which uses 12. Fixes: 1e8fed873e74 ("powerpc: drop ranges for definition of ARCH_FORCE_MAX_ORDER") Signed-off-by: Michael Ellerman Link: https://msgid.link/20230519113806.370635-1-mpe@ellerman.id.au commit d9a45969abeb641c5fb8cf3591f63f827f9932b5 Author: Helge Deller Date: Sat May 20 22:43:35 2023 +0200 fbdev: stifb: Whitespace cleanups Missed whitespace cleanups in stifb. Fixes: 8000425739dc ("fbdev: stifb: Remove trailing whitespaces") Signed-off-by: Helge Deller commit 537adba4083ed858db4b5129ea78a820a6fb2edc Author: Helge Deller Date: Fri May 19 23:11:51 2023 +0200 fbdev: udlfb: Use usb_control_msg_send() Use the newly introduced usb_control_msg_send() instead of usb_control_msg() when selecting the channel. Reviewed-by: Alan Stern Signed-off-by: Helge Deller commit 0dd2a6fb1e34d6dcb96806bc6b111388ad324722 Merge: 2dd0d98d62103 8fb9ea65c9d13 Author: Linus Torvalds Date: Sat May 20 10:33:57 2023 -0700 Merge tag 'tty-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial fixes from Greg KH: "Here are some small tty and serial driver fixes for 6.4-rc3 to resolve some reported problems, and add some new device ids. These include: - termios documentation updates - vc_screen use-after-free fix - memory leak fix in arc_uart driver - new 8250 driver ids - other small serial driver fixes All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF serial: qcom-geni: fix enabling deactivated interrupt serial: 8250_bcm7271: fix leak in `brcmuart_probe` serial: 8250_bcm7271: balance clk_enable calls serial: arc_uart: fix of_iomap leak in `arc_serial_probe` serial: 8250: Document termios parameter of serial8250_em485_config() serial: Add support for Advantech PCI-1611U card serial: 8250_exar: Add support for USR298x PCI Modems commit 2dd0d98d62103c993f74193a7abe97eaef4bc120 Merge: 98be58a6e9310 ddaf098ea779b Author: Linus Torvalds Date: Sat May 20 10:16:38 2023 -0700 Merge tag 'usb-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some USB fixes for 6.4-rc3, as well as a driver core fix that resolves a memory leak that shows up in USB devices easier than other subsystems. Included in here are: - driver core memory leak as reported and tested by syzbot and developers - dwc3 driver fixes for reported problems - xhci driver fixes for reported problems - USB gadget driver reverts to resolve regressions - usbtmc driver fix for syzbot reported problem - thunderbolt driver fixes for reported issues - other small USB fixes All of these, except for the driver core fix, have been in linux-next with no reported problems. The driver core fix was tested and verified to solve the issue by syzbot and the original reporter" * tag 'usb-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: driver core: class: properly reference count class_dev_iter() xhci: Fix incorrect tracking of free space on transfer rings xhci-pci: Only run d3cold avoidance quirk for s2idle usb-storage: fix deadlock when a scsi command timeouts more than once usb: dwc3: fix a test for error in dwc3_core_init() usb: typec: tps6598x: Fix fault at module removal usb: gadget: u_ether: Fix host MAC address case usb: typec: altmodes/displayport: fix pin_assignment_show Revert "usb: gadget: udc: core: Invoke usb_gadget_connect only when started" Revert "usb: gadget: udc: core: Prevent redundant calls to pullup" usb: gadget: drop superfluous ':' in doc string usb: dwc3: debugfs: Resume dwc3 before accessing registers USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value usb: dwc3: fix gadget mode suspend interrupt handler issue usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume() USB: usbtmc: Fix direction for 0-length ioctl control messages thunderbolt: Clear registers properly when auto clear isn't in use commit d1d8875c8c13517f6fd1ff8d4d3e1ac366a17e07 Author: Carlos Llamas Date: Fri May 19 19:59:49 2023 +0000 binder: fix UAF of alloc->vma in race with munmap() [ cmllamas: clean forward port from commit 015ac18be7de ("binder: fix UAF of alloc->vma in race with munmap()") in 5.10 stable. It is needed in mainline after the revert of commit a43cfc87caaf ("android: binder: stop saving a pointer to the VMA") as pointed out by Liam. The commit log and tags have been tweaked to reflect this. ] In commit 720c24192404 ("ANDROID: binder: change down_write to down_read") binder assumed the mmap read lock is sufficient to protect alloc->vma inside binder_update_page_range(). This used to be accurate until commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap"), which now downgrades the mmap_lock after detaching the vma from the rbtree in munmap(). Then it proceeds to teardown and free the vma with only the read lock held. This means that accesses to alloc->vma in binder_update_page_range() now will race with vm_area_free() in munmap() and can cause a UAF as shown in the following KASAN trace: ================================================================== BUG: KASAN: use-after-free in vm_insert_page+0x7c/0x1f0 Read of size 8 at addr ffff16204ad00600 by task server/558 CPU: 3 PID: 558 Comm: server Not tainted 5.10.150-00001-gdc8dcf942daa #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2a0 show_stack+0x18/0x2c dump_stack+0xf8/0x164 print_address_description.constprop.0+0x9c/0x538 kasan_report+0x120/0x200 __asan_load8+0xa0/0xc4 vm_insert_page+0x7c/0x1f0 binder_update_page_range+0x278/0x50c binder_alloc_new_buf+0x3f0/0xba0 binder_transaction+0x64c/0x3040 binder_thread_write+0x924/0x2020 binder_ioctl+0x1610/0x2e5c __arm64_sys_ioctl+0xd4/0x120 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 Allocated by task 559: kasan_save_stack+0x38/0x6c __kasan_kmalloc.constprop.0+0xe4/0xf0 kasan_slab_alloc+0x18/0x2c kmem_cache_alloc+0x1b0/0x2d0 vm_area_alloc+0x28/0x94 mmap_region+0x378/0x920 do_mmap+0x3f0/0x600 vm_mmap_pgoff+0x150/0x17c ksys_mmap_pgoff+0x284/0x2dc __arm64_sys_mmap+0x84/0xa4 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 Freed by task 560: kasan_save_stack+0x38/0x6c kasan_set_track+0x28/0x40 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0x100/0x164 kasan_slab_free+0x14/0x20 kmem_cache_free+0xc4/0x34c vm_area_free+0x1c/0x2c remove_vma+0x7c/0x94 __do_munmap+0x358/0x710 __vm_munmap+0xbc/0x130 __arm64_sys_munmap+0x4c/0x64 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 [...] ================================================================== To prevent the race above, revert back to taking the mmap write lock inside binder_update_page_range(). One might expect an increase of mmap lock contention. However, binder already serializes these calls via top level alloc->mutex. Also, there was no performance impact shown when running the binder benchmark tests. Fixes: c0fd2101781e ("Revert "android: binder: stop saving a pointer to the VMA"") Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") Reported-by: Jann Horn Closes: https://lore.kernel.org/all/20230518144052.xkj6vmddccq4v66b@revolver Cc: Cc: Minchan Kim Cc: Yang Shi Cc: Liam Howlett Signed-off-by: Carlos Llamas Acked-by: Todd Kjos Link: https://lore.kernel.org/r/20230519195950.1775656-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit bbaae0c79ebd49f61ad942a8bf9e12bfc7f821bb Author: Jean-Baptiste Maneyrol Date: Tue May 9 15:22:02 2023 +0000 iio: imu: inv_icm42600: fix timestamp reset Timestamp reset is not done in the correct place. It must be done before enabling buffer. The reason is that interrupt timestamping is always happening when the chip is on, even if the corresponding sensor is off. When the sensor restarts, timestamp is wrong if you don't do a reset first. Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping") Signed-off-by: Jean-Baptiste Maneyrol Cc: Link: https://lore.kernel.org/r/20230509152202.245444-1-inv.git-commit@tdk.com Signed-off-by: Jonathan Cameron commit 98be58a6e9310fbfa757d438b0b51f857ce17ee4 Merge: d635f6cc934bc e3afec91aad23 Author: Linus Torvalds Date: Sat May 20 08:48:04 2023 -0700 Merge tag 'block-6.4-2023-05-20' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - More device quirks (Sagi, Hristo, Adrian, Daniel) - Controller delete race (Maurizo) - Multipath cleanup fix (Christoph) - Deny writeable mmap mapping on a readonly block device (Loic) - Kill unused define that got introduced by accident (Christoph) - Error handling fix for s390 dasd (Stefan) - ublk locking fix (Ming) * tag 'block-6.4-2023-05-20' of git://git.kernel.dk/linux: block: remove NFL4_UFLG_MASK block: Deny writable memory mapping if block is read-only s390/dasd: fix command reject error on ESE devices nvme-pci: Add quirk for Teamgroup MP33 SSD ublk: fix AB-BA lockdep warning nvme: do not let the user delete a ctrl before a complete initialization nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk nvme-pci: clamp max_hw_sectors based on DMA optimized limitation nvme-pci: add quirk for missing secondary temperature thresholds nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G commit 626d312028bec44209d0ecd5beaa9b1aa8945f7d Author: Masahiro Honda Date: Thu May 18 20:08:16 2023 +0900 iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag The Sigma-Delta ADCs supported by this driver can use SDO as an interrupt line to indicate the completion of a conversion. However, some devices cannot properly detect the completion of a conversion by an interrupt. This is for the reason mentioned in the following commit. commit e9849777d0e2 ("genirq: Add flag to force mask in disable_irq[_nosync]()") A read operation is performed by an extra interrupt before the completion of a conversion. At this time, the value read from the ADC data register is the same as the previous conversion result. This patch fixes the issue by setting IRQ_DISABLE_UNLAZY flag. Fixes: 0c6ef985a1fd ("iio: adc: ad7791: fix IRQ flags") Fixes: 1a913270e57a ("iio: adc: ad7793: Fix IRQ flag") Fixes: e081102f3077 ("iio: adc: ad7780: Fix IRQ flag") Fixes: 89a86da5cb8e ("iio: adc: ad7192: Add IRQ flag") Fixes: 79ef91493f54 ("iio: adc: ad7124: Set IRQ type to falling") Signed-off-by: Masahiro Honda Link: https://lore.kernel.org/r/20230518110816.248-1-honda@mechatrax.com Cc: Signed-off-by: Jonathan Cameron commit e3afec91aad23c52dfe426c7d7128e4839c3eed8 Author: Christoph Hellwig Date: Sat May 20 11:00:10 2023 +0200 block: remove NFL4_UFLG_MASK The NFL4_UFLG_MASK define slipped in in commit 9208d4149758 ("block: add a ->get_unique_id method") and should never have been added, as NFSD as the only user of it already has it's copy. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230520090010.527046-1-hch@lst.de Signed-off-by: Jens Axboe commit 67caf26d769e0cb17dba182b0acae015c7aa5881 Merge: ae9b15fbe6344 6ce5169e05aa5 Author: Jakub Kicinski Date: Fri May 19 22:48:26 2023 -0700 Merge tag 'for-net-2023-05-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix compiler warnings on btnxpuart - Fix potential double free on hci_conn_unlink - Fix UAF on hci_conn_hash_flush * tag 'for-net-2023-05-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: btnxpuart: Fix compiler warnings Bluetooth: Unlink CISes when LE disconnects in hci_conn_del Bluetooth: Fix UAF in hci_conn_hash_flush again Bluetooth: Refcnt drop must be placed last in hci_conn_unlink Bluetooth: Fix potential double free caused by hci_conn_unlink ==================== Link: https://lore.kernel.org/r/20230519233056.2024340-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit ae9b15fbe63447bc1d3bba3769f409d17ca6fdf6 Author: Taehee Yoo Date: Wed May 17 14:30:10 2023 +0000 net: fix stack overflow when LRO is disabled for virtual interfaces When the virtual interface's feature is updated, it synchronizes the updated feature for its own lower interface. This propagation logic should be worked as the iteration, not recursively. But it works recursively due to the netdev notification unexpectedly. This problem occurs when it disables LRO only for the team and bonding interface type. team0 | +------+------+-----+-----+ | | | | | team1 team2 team3 ... team200 If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE event to its own lower interfaces(team1 ~ team200). It is worked by netdev_sync_lower_features(). So, the NETDEV_FEAT_CHANGE notification logic of each lower interface work iteratively. But generated NETDEV_FEAT_CHANGE event is also sent to the upper interface too. upper interface(team0) generates the NETDEV_FEAT_CHANGE event for its own lower interfaces again. lower and upper interfaces receive this event and generate this event again and again. So, the stack overflow occurs. But it is not the infinite loop issue. Because the netdev_sync_lower_features() updates features before generating the NETDEV_FEAT_CHANGE event. Already synchronized lower interfaces skip notification logic. So, it is just the problem that iteration logic is changed to the recursive unexpectedly due to the notification mechanism. Reproducer: ip link add team0 type team ethtool -K team0 lro on for i in {1..200} do ip link add team$i master team0 type team ethtool -K team$i lro on done ethtool -K team0 lro off In order to fix it, the notifier_ctx member of bonding/team is introduced. Reported-by: syzbot+60748c96cf5c6df8e581@syzkaller.appspotmail.com Fixes: fd867d51f889 ("net/core: generic support for disabling netdev features down stack") Signed-off-by: Taehee Yoo Reviewed-by: Eric Dumazet Reviewed-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230517143010.3596250-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski commit ed9de4ed39875706607fb08118a58344ae6c5f42 Author: Alan Stern Date: Fri May 19 15:32:30 2023 -0400 fbdev: udlfb: Fix endpoint check The syzbot fuzzer detected a problem in the udlfb driver, caused by an endpoint not having the expected type: usb 1-1: Read EDID byte 0 failed: -71 usb 1-1: Unable to get valid EDID from device/display ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.4.0-rc1-syzkaller-00016-ga4422ff22142 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: dlfb_submit_urb+0x92/0x180 drivers/video/fbdev/udlfb.c:1980 dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315 dlfb_ops_set_par+0x2a7/0x8d0 drivers/video/fbdev/udlfb.c:1111 dlfb_usb_probe+0x149a/0x2710 drivers/video/fbdev/udlfb.c:1743 The current approach for this issue failed to catch the problem because it only checks for the existence of a bulk-OUT endpoint; it doesn't check whether this endpoint is the one that the driver will actually use. We can fix the problem by instead checking that the endpoint used by the driver does exist and is bulk-OUT. Reported-and-tested-by: syzbot+0e22d63dcebb802b9bc8@syzkaller.appspotmail.com Signed-off-by: Alan Stern CC: Pavel Skripkin Fixes: aaf7dbe07385 ("video: fbdev: udlfb: properly check endpoint type") Signed-off-by: Helge Deller commit 93f57c7a10890645d1d3b88eea1692b285bf3f38 Author: Niklas Schnelle Date: Tue May 16 13:00:33 2023 +0200 fbdev: atyfb: Remove unused clock determination Just below the removed lines par->clk_wr_offset is hard coded to 3 so there is no use in determining a different clock just to then ignore it anyway. This also removes the only I/O port use remaining in the driver allowing it to be built without CONFIG_HAS_IOPORT. Link: https://lore.kernel.org/all/ZBx5aLo5h546BzBt@intel.com/ Suggested-by: Ville Syrjälä Signed-off-by: Niklas Schnelle Reviewed-by: Ville Syrjälä Signed-off-by: Helge Deller commit f6cd4c96b2c201be1ca3c17daeec52bf20880d69 Author: Arnd Bergmann Date: Tue May 16 22:28:09 2023 +0200 fbdev: i810: include i810_main.h in i810_dvt.c Building with W=1 shows that a header needs to be included to make the prototypes visible: drivers/video/fbdev/i810/i810_dvt.c:194:6: error: no previous prototype for 'round_off_xres' [-Werror=missing-prototypes] drivers/video/fbdev/i810/i810_dvt.c:233:6: error: no previous prototype for 'i810fb_encode_registers' [-Werror=missing-prototypes] drivers/video/fbdev/i810/i810_dvt.c:245:6: error: no previous prototype for 'i810fb_fill_var_timings' [-Werror=missing-prototypes] drivers/video/fbdev/i810/i810_dvt.c:279:5: error: no previous prototype for 'i810_get_watermark' [-Werror=missing-prototypes] Adding the header leads to another warning from a mismatched prototype, so fix this as well: drivers/video/fbdev/i810/i810_dvt.c:280:5: error: conflicting types for 'i810_get_watermark'; have 'u32(struct fb_var_screeninfo *, Signed-off-by: Arnd Bergmann Reviewed-by: Jani Nikula Signed-off-by: Helge Deller commit 19abb4583d5eba06459930932e72c862a83cd9c2 Author: Arnd Bergmann Date: Tue May 16 22:22:48 2023 +0200 fbdev: fbmem: mark get_fb_unmapped_area() static There is a global function with this name on sparc, but no global declaration: drivers/video/fbdev/core/fbmem.c:1469:15: error: no previous prototype for 'get_fb_unmapped_area' Make the generic definition static to avoid this warning. On sparc, this is never seen. Edit by Helge: Update Kconfig text as suggested by Geert Uytterhoeven. Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller commit 69baa3a623fd2e58624f24f2f23d46f87b817c93 Author: Loic Poulain Date: Wed May 10 09:42:23 2023 +0200 block: Deny writable memory mapping if block is read-only User should not be able to write block device if it is read-only at block level (e.g force_ro attribute). This is ensured in the regular fops write operation (blkdev_write_iter) but not when writing via user mapping (mmap), allowing user to actually write a read-only block device via a PROT_WRITE mapping. Example: This can lead to integrity issue of eMMC boot partition (e.g mmcblk0boot0) which is read-only by default. To fix this issue, simply deny shared writable mapping if the block is readonly. Note: Block remains writable if switch to read-only is performed after the initial mapping, but this is expected behavior according to commit a32e236eb93e ("Partially revert "block: fail op_is_write() requests to read-only partitions"")'. Signed-off-by: Loic Poulain Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230510074223.991297-1-loic.poulain@linaro.org Signed-off-by: Jens Axboe commit d635f6cc934bcd467c5d67148ece74632fd96abf Merge: 5565ec4ef4f0d 79ef1c9d14c65 Author: Linus Torvalds Date: Fri May 19 19:11:20 2023 -0700 Merge tag 'drm-fixes-2023-05-20' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular fixes pull, amdgpu and msm make up most of these, nothing too serious, also one i915 and one exynos. I didn't get a misc fixes pull this week (one of the maintainers is off, so have to engage the backup) so I think there are a few outstanding patches that will show up next week, amdgpu: - update gfx11 clock counter logic - Fix a race when disabling gfxoff on gfx10/11 for profiling - Raven/Raven2/PCO clock counter fix - Add missing get_vbios_fb_size for GMC 11 - Fix a spurious irq warning in the device remove case - Fix possible power mode mismatch between driver and PMFW - USB4 fix exynos: - fix build warning i915: - fix missing NULL check in HDCP code msm: - display: - msm8998: fix fetch and qos to align with downstream - msm8998: fix LM pairs to align with downstream - remove unused INTF0 interrupt mask on some chipsets - remove TE2 block from relevant chipsets - relocate non-MDP_TOP offset to different header - fix some indentation - fix register offets/masks for dither blocks - make ping-ping block length 0 - remove duplicated defines - fix log mask for writeback block - unregister the hdmi codec for dp during unbind - fix yaml warnings - gpu: - fix submit error path leak - arm-smmu-qcom fix for regression that broke per-process page tables - fix no-iommu crash" * tag 'drm-fixes-2023-05-20' of git://anongit.freedesktop.org/drm/drm: (29 commits) drm/amd/display: enable dpia validate drm/amd/pm: fix possible power mode mismatch between driver and PMFW drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged drm/amdgpu/gmc11: implement get_vbios_fb_size() drm/amdgpu: Differentiate between Raven2 and Raven/Picasso according to revision id drm/amdgpu/gfx11: Adjust gfxoff before powergating on gfx11 as well drm/amdgpu/gfx10: Disable gfxoff before disabling powergating. drm/amdgpu/gfx11: update gpu_clock_counter logic drm/msm: Be more shouty if per-process pgtables aren't working iommu/arm-smmu-qcom: Fix missing adreno_smmu's drm/i915/hdcp: Check if media_gt exists drm/exynos: fix g2d_open/close helper function definitions drm/msm: Fix submit error-path leaks drm/msm/iommu: Fix null pointer dereference in no-IOMMU case dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi drm/msm/dpu: Remove duplicate register defines from INTF drm/msm/dpu: Set PINGPONG block length to zero for DPU >= 7.0.0 drm/msm/dpu: Use V2 DITHER PINGPONG sub-block in SM8[34]50/SC8280XP drm/msm/dpu: Fix PP_BLK_DIPHER -> DITHER typo drm/msm/dpu: Reindent REV_7xxx interrupt masks with tabs ... commit c99bff34290f1b994073557b754aff86e4c7b22e Author: Stefan Haberland Date: Fri May 19 12:23:40 2023 +0200 s390/dasd: fix command reject error on ESE devices Formatting a thin-provisioned (ESE) device that is part of a PPRC copy relation might fail with the following error: dasd-eckd 0.0.f500: An error occurred in the DASD device driver, reason=09 [...] 24 Byte: 0 MSG 4, no MSGb to SYSOP During format of an ESE disk the Release Allocated Space command is used. A bit in the payload of the command is set that is not allowed to be set for devices in a copy relation. This bit is set to allow the partial release of an extent. Check for the existence of a copy relation before setting the respective bit. Fixes: 91dc4a197569 ("s390/dasd: Add new ioctl to release space") Cc: stable@kernel.org # 5.3+ Signed-off-by: Stefan Haberland Reviewed-by: Jan Hoeppner Link: https://lore.kernel.org/r/20230519102340.3854819-2-sth@linux.ibm.com Signed-off-by: Jens Axboe commit a70fc4ed20a6118837b0aecbbf789074935f473b Author: Robert Richter Date: Fri May 19 23:54:35 2023 +0200 cxl/port: Fix NULL pointer access in devm_cxl_add_port() In devm_cxl_add_port() the port creation may fail and its associated pointer does not contain a valid address. During error message generation this invalid port address is used. Fix that wrong address access. Fixes: f3cd264c4ec1 ("cxl: Unify debug messages when calling devm_cxl_add_port()") Signed-off-by: Robert Richter Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20230519215436.3394532-1-rrichter@amd.com Signed-off-by: Dan Williams commit 5565ec4ef4f0d676fc8518556e239ac6945b5186 Merge: a594874588241 09e797c8641f6 Author: Linus Torvalds Date: Fri May 19 15:54:01 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Six small fixes. Four in drivers and the two core changes should be read together as a correction to a prior iorequest_cnt fix that exposed us to a potential use after free" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed" scsi: storvsc: Don't pass unused PFNs to Hyper-V host scsi: ufs: core: Fix MCQ nr_hw_queues scsi: ufs: core: Rename symbol sizeof_utp_transfer_cmd_desc() scsi: ufs: core: Fix MCQ tag calculation commit 6ce5169e05aa5360a49a574cc1490ceea6b651a6 Author: Neeraj Sanjay Kale Date: Thu May 18 22:13:47 2023 +0530 Bluetooth: btnxpuart: Fix compiler warnings This fixes the follwing compiler warning reported by kernel test robot: drivers/bluetooth/btnxpuart.c:1332:34: warning: unused variable 'nxpuart_of_match_table' [-Wunused-const-variable] Signed-off-by: Neeraj Sanjay Kale Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202305161345.eClvTYQ9-lkp@intel.com/ Signed-off-by: Luiz Augusto von Dentz commit a2904d2825536aa896a149a9174d11b0958e7095 Author: Ruihan Li Date: Wed May 3 21:39:37 2023 +0800 Bluetooth: Unlink CISes when LE disconnects in hci_conn_del Currently, hci_conn_del calls hci_conn_unlink for BR/EDR, (e)SCO, and CIS connections, i.e., everything except LE connections. However, if (e)SCO connections are unlinked when BR/EDR disconnects, CIS connections should also be unlinked when LE disconnects. In terms of disconnection behavior, CIS and (e)SCO connections are not too different. One peculiarity of CIS is that when CIS connections are disconnected, the CIS handle isn't deleted, as per [BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E] 7.1.6 Disconnect command: All SCO, eSCO, and CIS connections on a physical link should be disconnected before the ACL connection on the same physical connection is disconnected. If it does not, they will be implicitly disconnected as part of the ACL disconnection. ... Note: As specified in Section 7.7.5, on the Central, the handle for a CIS remains valid even after disconnection and, therefore, the Host can recreate a disconnected CIS at a later point in time using the same connection handle. Since hci_conn_link invokes both hci_conn_get and hci_conn_hold, hci_conn_unlink should perform both hci_conn_put and hci_conn_drop as well. However, currently it performs only hci_conn_put. This patch makes hci_conn_unlink call hci_conn_drop as well, which simplifies the logic in hci_conn_del a bit and may benefit future users of hci_conn_unlink. But it is noted that this change additionally implies that hci_conn_unlink can queue disc_work on conn itself, with the following call stack: hci_conn_unlink(conn) [conn->parent == NULL] -> hci_conn_unlink(child) [child->parent == conn] -> hci_conn_drop(child->parent) -> queue_delayed_work(&conn->disc_work) Queued disc_work after hci_conn_del can be spurious, so during the process of hci_conn_del, it is necessary to make the call to cancel_delayed_work(&conn->disc_work) after invoking hci_conn_unlink. Signed-off-by: Ruihan Li Co-developed-by: Luiz Augusto von Dentz Signed-off-by: Luiz Augusto von Dentz commit a2ac591cb4d83e1f2d4b4adb3c14b2c79764650a Author: Ruihan Li Date: Wed May 3 21:39:36 2023 +0800 Bluetooth: Fix UAF in hci_conn_hash_flush again Commit 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon") reintroduced a previously fixed bug [1] ("KASAN: slab-use-after-free Read in hci_conn_hash_flush"). This bug was originally fixed by commit 5dc7d23e167e ("Bluetooth: hci_conn: Fix possible UAF"). The hci_conn_unlink function was added to avoid invalidating the link traversal caused by successive hci_conn_del operations releasing extra connections. However, currently hci_conn_unlink itself also releases extra connections, resulted in the reintroduced bug. This patch follows a more robust solution for cleaning up all connections, by repeatedly removing the first connection until there are none left. This approach does not rely on the inner workings of hci_conn_del and ensures proper cleanup of all connections. Meanwhile, we need to make sure that hci_conn_del never fails. Indeed it doesn't, as it now always returns zero. To make this a bit clearer, this patch also changes its return type to void. Reported-by: syzbot+8bb72f86fc823817bc5d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-bluetooth/000000000000aa920505f60d25ad@google.com/ Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon") Signed-off-by: Ruihan Li Co-developed-by: Luiz Augusto von Dentz Signed-off-by: Luiz Augusto von Dentz commit 2910431ab0e500dfc5df12299bb15eef0f30b43e Author: Ruihan Li Date: Wed May 3 21:39:35 2023 +0800 Bluetooth: Refcnt drop must be placed last in hci_conn_unlink If hci_conn_put(conn->parent) reduces conn->parent's reference count to zero, it can immediately deallocate conn->parent. At the same time, conn->link->list has its head in conn->parent, causing use-after-free problems in the latter list_del_rcu(&conn->link->list). This problem can be easily solved by reordering the two operations, i.e., first performing the list removal with list_del_rcu and then decreasing the refcnt with hci_conn_put. Reported-by: Luiz Augusto von Dentz Closes: https://lore.kernel.org/linux-bluetooth/CABBYNZ+1kce8_RJrLNOXd_8=Mdpb=2bx4Nto-hFORk=qiOkoCg@mail.gmail.com/ Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon") Signed-off-by: Ruihan Li Signed-off-by: Luiz Augusto von Dentz commit ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f Author: Ruihan Li Date: Wed May 3 21:39:34 2023 +0800 Bluetooth: Fix potential double free caused by hci_conn_unlink The hci_conn_unlink function is being called by hci_conn_del, which means it should not call hci_conn_del with the input parameter conn again. If it does, conn may have already been released when hci_conn_unlink returns, leading to potential UAF and double-free issues. This patch resolves the problem by modifying hci_conn_unlink to release only conn's child links when necessary, but never release conn itself. Reported-by: syzbot+690b90b14f14f43f4688@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-bluetooth/000000000000484a8205faafe216@google.com/ Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon") Signed-off-by: Ruihan Li Signed-off-by: Luiz Augusto von Dentz Reported-by: syzbot+690b90b14f14f43f4688@syzkaller.appspotmail.com Reported-by: Luiz Augusto von Dentz Reported-by: syzbot+8bb72f86fc823817bc5d@syzkaller.appspotmail.com commit 43439d858bbae244a510de47f9a55f667ca4ed52 Author: Anna Schumaker Date: Tue May 16 11:19:25 2023 -0400 NFSv4.2: Fix a potential double free with READ_PLUS kfree()-ing the scratch page isn't enough, we also need to set the pointer back to NULL to avoid a double-free in the case of a resend. Fixes: fbd2a05f29a9 (NFSv4.2: Rework scratch handling for READ_PLUS) Signed-off-by: Anna Schumaker commit d180891fba995bd54e25b089b1ec98d134873586 Author: Trond Myklebust Date: Wed May 10 12:28:00 2023 -0400 SUNRPC: Don't change task->tk_status after the call to rpc_exit_task Some calls to rpc_exit_task() may deliberately change the value of task->tk_status, for instance because it gets checked by the RPC call's rpc_release() callback. That makes it wrong to reset the value to task->tk_rpc_status. In particular this causes a bug where the rpc_call_done() callback tries to fail over a set of pNFS/flexfiles writes to a different IP address, but the reset of task->tk_status causes nfs_commit_release_pages() to immediately mark the file as having a fatal error. Fixes: 39494194f93b ("SUNRPC: Fix races with rpc_killall_tasks()") Cc: stable@vger.kernel.org # 6.1.x Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 4b71e2416ec4cb3edd6c667243bce357b0c6f7b3 Author: Fabio M. De Francesco Date: Wed May 3 19:24:11 2023 +0200 NFS: Convert kmap_atomic() to kmap_local_folio() kmap_atomic() is deprecated in favor of kmap_local_{folio,page}(). Therefore, replace kmap_atomic() with kmap_local_folio() in nfs_readdir_folio_array_append(). kmap_atomic() disables page-faults and preemption (the latter only for !PREEMPT_RT kernels), However, the code within the mapping/un-mapping in nfs_readdir_folio_array_append() does not depend on the above-mentioned side effects. Therefore, a mere replacement of the old API with the new one is all that is required (i.e., there is no need to explicitly add any calls to pagefault_disable() and/or preempt_disable()). Tested with (x)fstests in a QEMU/KVM x86_32 VM, 6GB RAM, booting a kernel with HIGHMEM64GB enabled. Cc: Ira Weiny Signed-off-by: Fabio M. De Francesco Fixes: ec108d3cc766 ("NFS: Convert readdir page array functions to use a folio") Signed-off-by: Anna Schumaker commit a59487458824184abf568721fe7d1beb1e0d099e Merge: d3f704310cc7e 4cafd0400bcb6 Author: Linus Torvalds Date: Fri May 19 12:02:12 2023 -0700 Merge tag 'ceph-for-6.4-rc3' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A workaround for a just discovered bug in MClientSnap encoding which goes back to 2017 (marked for stable) and a fixup to quieten a static checker" * tag 'ceph-for-6.4-rc3' of https://github.com/ceph/ceph-client: ceph: force updating the msg pointer in non-split case ceph: silence smatch warning in reconnect_caps_cb() commit d3f704310cc7e04e89d178ea080a2e74dae9db67 Merge: c83063298b206 5783ecc90e24a Author: Linus Torvalds Date: Fri May 19 11:44:08 2023 -0700 Merge tag 'pm-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix two issues in the cpupower utility and get rid of a spurious warning message printed to the kernel log by the ACPI cpufreq driver after recent changes. Specifics: - Get rid of a warning message printed by the ACPI cpufreq driver after recent changes in it when anohter CPU performance scaling driver is registered already when it starts (Petr Pavlu) - Make cpupower read TSC on each CPU right before reading MPERF so as to reduce the potential time difference between the TSC and MPERF accesses and improve the C0 percentage calculation (Wyes Karny) - Fix a possible file handle leak and clean up the code in the sysfs_get_enabled() function in cpupower (Hao Zeng)" * tag 'pm-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: ACPI: Prevent a warning when another frequency driver is loaded cpupower: Make TSC read per CPU for Mperf monitor cpupower:Fix resource leaks in sysfs_get_enabled() commit c83063298b206dc806a7f1e8724336e4962daeed Merge: cbd6ac3837cdc 71a485624c4cb Author: Linus Torvalds Date: Fri May 19 11:38:41 2023 -0700 Merge tag 'acpi-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Add an ACPI IRQ override quirk for LG UltraPC 17U70P so as to make the internal keyboard work on that machine (Rubén Gómez)" * tag 'acpi-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P commit cbd6ac3837cdc62f3078b53b92ad6ee59329e4dd Merge: ac92c27935c75 bd415b5c9552d Author: Linus Torvalds Date: Fri May 19 11:25:17 2023 -0700 Merge tag 'docs-6.4-fixes' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "Four straightforward documentation fixes" * tag 'docs-6.4-fixes' of git://git.lwn.net/linux: Documentation/filesystems: ramfs-rootfs-initramfs: use :Author: Documentation/filesystems: sharedsubtree: add section headings docs: quickly-build-trimmed-linux: various small fixes and improvements Documentation: use capitalization for chapters and acronyms commit ac92c27935c759ff8b3cc9f761b086b15145c901 Merge: 4ffd96c9621fc 0f1cbf941d594 Author: Linus Torvalds Date: Fri May 19 11:11:04 2023 -0700 Merge tag 's390-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Add check whether the required facilities are installed before using the s390-specific ChaCha20 implementation - Key blobs for s390 protected key interface IOCTLs commands PKEY_VERIFYKEY2 and PKEY_VERIFYKEY3 may contain clear key material. Zeroize copies of these keys in kernel memory after creating protected keys - Set CONFIG_INIT_STACK_NONE=y in defconfigs to avoid extra overhead of initializing all stack variables by default - Make sure that when a new channel-path is enabled all subchannels are evaluated: with and without any devices connected on it - When SMT thread CPUs are added to CPU topology masks the nr_cpu_ids limit is not checked and could be exceeded. Respect the nr_cpu_ids limit and avoid a warning when CONFIG_DEBUG_PER_CPU_MAPS is set - The pointer to IPL Parameter Information Block is stored in the absolute lowcore as a virtual address. Save it as the physical address for later use by dump tools - Fix a Queued Direct I/O (QDIO) problem on z/VM guests using QIOASSIST with dedicated (pass through) QDIO-based devices such as FCP, real OSA or HiperSockets - s390's struct statfs and struct statfs64 contain padding, which field-by-field copying does not set. Initialize the respective structures with zeros before filling them and copying to userspace - Grow s390 compat_statfs64, statfs and statfs64 structures f_spare array member to cover padding and simplify things - Remove obsolete SCHED_BOOK and SCHED_DRAWER configs - Remove unneeded S390_CCW_IOMMU and S390_AP_IOM configs * tag 's390-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/iommu: get rid of S390_CCW_IOMMU and S390_AP_IOMMU s390/Kconfig: remove obsolete configs SCHED_{BOOK,DRAWER} s390/uapi: cover statfs padding by growing f_spare statfs: enforce statfs[64] structure initialization s390/qdio: fix do_sqbs() inline assembly constraint s390/ipl: fix IPIB virtual vs physical address confusion s390/topology: honour nr_cpu_ids when adding CPUs s390/cio: include subchannels without devices also for evaluation s390/defconfigs: set CONFIG_INIT_STACK_NONE=y s390/pkey: zeroize key blobs s390/crypto: use vector instructions only if available for ChaCha20 commit 4ffd96c9621fcec3b84f3f997e036cc7077ec465 Merge: 46be92e58fa88 c4c597f1b3674 Author: Linus Torvalds Date: Fri May 19 11:05:42 2023 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "A mixture of compiler/static checker resolutions and a couple of MTE fixes: - Avoid erroneously marking untagged pages with PG_mte_tagged - Always reset KASAN tags for destination page in copy_page() - Mark PMU header functions 'static inline' - Fix some sparse warnings due to missing casts" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mte: Do not set PG_mte_tagged if tags were not initialized arm64: Also reset KASAN tag if page is not PG_mte_tagged arm64: perf: Mark all accessor functions inline ARM: perf: Mark all accessor functions inline arm64: vdso: Pass (void *) to virt_to_page() arm64/mm: mark private VM_FAULT_X defines as vm_fault_t commit afb2acb2e3a32e4d56f7fbd819769b98ed1b7520 Author: Michal Luczaj Date: Wed May 10 16:04:09 2023 +0200 KVM: Fix vcpu_array[0] races In kvm_vm_ioctl_create_vcpu(), add vcpu to vcpu_array iff it's safe to access vcpu via kvm_get_vcpu() and kvm_for_each_vcpu(), i.e. when there's no failure path requiring vcpu removal and destruction. Such order is important because vcpu_array accessors may end up referencing vcpu at vcpu_array[0] even before online_vcpus is set to 1. When online_vcpus=0, any call to kvm_get_vcpu() goes through array_index_nospec() and ends with an attempt to xa_load(vcpu_array, 0): int num_vcpus = atomic_read(&kvm->online_vcpus); i = array_index_nospec(i, num_vcpus); return xa_load(&kvm->vcpu_array, i); Similarly, when online_vcpus=0, a kvm_for_each_vcpu() does not iterate over an "empty" range, but actually [0, ULONG_MAX]: xa_for_each_range(&kvm->vcpu_array, idx, vcpup, 0, \ (atomic_read(&kvm->online_vcpus) - 1)) In both cases, such online_vcpus=0 edge case, even if leading to unnecessary calls to XArray API, should not be an issue; requesting unpopulated indexes/ranges is handled by xa_load() and xa_for_each_range(). However, this means that when the first vCPU is created and inserted in vcpu_array *and* before online_vcpus is incremented, code calling kvm_get_vcpu()/kvm_for_each_vcpu() already has access to that first vCPU. This should not pose a problem assuming that once a vcpu is stored in vcpu_array, it will remain there, but that's not the case: kvm_vm_ioctl_create_vcpu() first inserts to vcpu_array, then requests a file descriptor. If create_vcpu_fd() fails, newly inserted vcpu is removed from the vcpu_array, then destroyed: vcpu->vcpu_idx = atomic_read(&kvm->online_vcpus); r = xa_insert(&kvm->vcpu_array, vcpu->vcpu_idx, vcpu, GFP_KERNEL_ACCOUNT); kvm_get_kvm(kvm); r = create_vcpu_fd(vcpu); if (r < 0) { xa_erase(&kvm->vcpu_array, vcpu->vcpu_idx); kvm_put_kvm_no_destroy(kvm); goto unlock_vcpu_destroy; } atomic_inc(&kvm->online_vcpus); This results in a possible race condition when a reference to a vcpu is acquired (via kvm_get_vcpu() or kvm_for_each_vcpu()) moments before said vcpu is destroyed. Signed-off-by: Michal Luczaj Message-Id: <20230510140410.1093987-2-mhal@rbox.co> Cc: stable@vger.kernel.org Fixes: c5b077549136 ("KVM: Convert the kvm->vcpus array to a xarray", 2021-12-08) Signed-off-by: Paolo Bonzini commit 3367eeab975145e65136c2d091fe6e0c6cb29636 Author: Jacob Xu Date: Thu Feb 24 17:29:59 2022 -0800 KVM: VMX: Fix header file dependency of asm/vmx.h Include a definition of WARN_ON_ONCE() before using it. Fixes: bb1fcc70d98f ("KVM: nVMX: Allow L1 to use 5-level page walks for nested EPT") Cc: Sean Christopherson Signed-off-by: Jacob Xu [reworded commit message; changed to ] Signed-off-by: Jim Mattson Reviewed-by: Sean Christopherson Message-Id: <20220225012959.1554168-1-jmattson@google.com> Signed-off-by: Paolo Bonzini commit e0ceec221f62deb5d6c32c0327030028d3db5f27 Author: Sean Christopherson Date: Fri May 12 16:31:27 2023 -0700 KVM: Don't enable hardware after a restart/shutdown is initiated Reject hardware enabling, i.e. VM creation, if a restart/shutdown has been initiated to avoid re-enabling hardware between kvm_reboot() and machine_{halt,power_off,restart}(). The restart case is especially problematic (for x86) as enabling VMX (or clearing GIF in KVM_RUN on SVM) blocks INIT, which results in the restart/reboot hanging as BIOS is unable to wake and rendezvous with APs. Note, this bug, and the original issue that motivated the addition of kvm_reboot(), is effectively limited to a forced reboot, e.g. `reboot -f`. In a "normal" reboot, userspace will gracefully teardown userspace before triggering the kernel reboot (modulo bugs, errors, etc), i.e. any process that might do ioctl(KVM_CREATE_VM) is long gone. Fixes: 8e1c18157d87 ("KVM: VMX: Disable VMX when system shutdown") Signed-off-by: Sean Christopherson Acked-by: Marc Zyngier Message-Id: <20230512233127.804012-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 6735150b69978a9f73e3d1bab719e81a5dfafa83 Author: Sean Christopherson Date: Fri May 12 16:31:26 2023 -0700 KVM: Use syscore_ops instead of reboot_notifier to hook restart/shutdown Use syscore_ops.shutdown to disable hardware virtualization during a reboot instead of using the dedicated reboot_notifier so that KVM disables virtualization _after_ system_state has been updated. This will allow fixing a race in KVM's handling of a forced reboot where KVM can end up enabling hardware virtualization between kernel_restart_prepare() and machine_restart(). Rename KVM's hook to match the syscore op to avoid any possible confusion from wiring up a "reboot" helper to a "shutdown" hook (neither "shutdown nor "reboot" is completely accurate as the hook handles both). Opportunistically rewrite kvm_shutdown()'s comment to make it less VMX specific, and to explain why kvm_rebooting exists. Cc: Marc Zyngier Cc: Oliver Upton Cc: James Morse Cc: Suzuki K Poulose Cc: Zenghui Yu Cc: kvmarm@lists.linux.dev Cc: Huacai Chen Cc: Aleksandar Markovic Cc: Anup Patel Cc: Atish Patra Cc: kvm-riscv@lists.infradead.org Signed-off-by: Sean Christopherson Acked-by: Marc Zyngier Message-Id: <20230512233127.804012-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 46be92e58fa8868fc10854de94f270e1d58ec434 Merge: f4a8871f9f347 dc4f2ccaedddb Author: Linus Torvalds Date: Fri May 19 10:55:55 2023 -0700 Merge tag 'sound-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes that have been gathered since rc1: - Lots of small ASoC SOF Intel fixes - A couple of UAF and NULL-dereference fixes - Quirks and updates for HD-audio, USB-audio and ASoC AMD - A few minor build / sparse warning fixes - MAINTAINERS and DT updates" * tag 'sound-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (38 commits) ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table ALSA: oss: avoid missing-prototype warnings ALSA: cs46xx: mark snd_cs46xx_download_image as static ALSA: hda: Fix Oops by 9.1 surround channel names ASoC: SOF: topology: Fix tuples array allocation ASoC: SOF: Separate the tokens for input and output pin index MAINTAINERS: Remove self from Cirrus Codec drivers ASoC: cs35l56: Prevent unbalanced pm_runtime in dsp_work() on SoundWire ASoC: SOF: topology: Fix logic for copying tuples ASoC: SOF: pm: save io region state in case of errors in resume ASoC: MAINTAINERS: drop Krzysztof Kozlowski from Samsung audio ASoC: mediatek: mt8186: Fix use-after-free in driver remove path ASoC: SOF: ipc3-topology: Make sure that only one cmd is sent in dai_config ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling ASoC: SOF: pcm: fix pm_runtime imbalance in error handling ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions ASoC: SOF: Intel: hda-mlink: add helper to program SoundWire PCMSyCM registers ASoC: SOF: Intel: hda-mlink: initialize instance_offset member ASoC: SOF: Intel: hda-mlink: use 'ml_addr' parameter consistently ASoC: SOF: Intel: hda-mlink: fix base_ptr computation ... commit 0613d8ca9ab382caabe9ed2dceb429e9781e443f Author: Will Deacon Date: Thu May 18 11:25:28 2023 +0100 bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields A narrow load from a 64-bit context field results in a 64-bit load followed potentially by a 64-bit right-shift and then a bitwise AND operation to extract the relevant data. In the case of a 32-bit access, an immediate mask of 0xffffffff is used to construct a 64-bit BPP_AND operation which then sign-extends the mask value and effectively acts as a glorified no-op. For example: 0: 61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0) results in the following code generation for a 64-bit field: ldr x7, [x7] // 64-bit load mov x10, #0xffffffffffffffff and x7, x7, x10 Fix the mask generation so that narrow loads always perform a 32-bit AND operation: ldr x7, [x7] // 64-bit load mov w10, #0xffffffff and w7, w7, w10 Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: John Fastabend Cc: Krzesimir Nowak Cc: Andrey Ignatov Acked-by: Yonghong Song Fixes: 31fd85816dbe ("bpf: permits narrower load from bpf program context fields") Signed-off-by: Will Deacon Link: https://lore.kernel.org/r/20230518102528.1341-1-will@kernel.org Signed-off-by: Alexei Starovoitov commit dd5fb04857d7346c9ea4901ec3ebe5b90b0e8868 Author: Kalesh AP Date: Thu May 18 01:11:01 2023 -0700 RDMA/bnxt_re: Do not enable congestion control on VFs Congestion control needs to be enabled only on the PFs. FW fails the command if issued on VFs. Avoid sending the command on VFs. Fixes: f13bcef04ba0 ("RDMA/bnxt_re: Enable congestion control by default") Link: https://lore.kernel.org/r/1684397461-23082-4-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Kalesh AP Reviewed-by: Selvin Thyparampil Xavier Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 0fa0d520e2a878cb4c94c4dc84395905d3f14f54 Author: Kalesh AP Date: Thu May 18 01:11:00 2023 -0700 RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx bnxt_re_process_raw_qp_pkt_rx() always return 0 and ignores the return value of bnxt_re_post_send_shadow_qp(). Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Link: https://lore.kernel.org/r/1684397461-23082-3-git-send-email-selvin.xavier@broadcom.com Reviewed-by: Hongguang Gao Reviewed-by: Ajit Khaparde Signed-off-by: Kalesh AP Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 349e3c0cf239cc01d58a1e6c749e171de014cd6a Author: Kalesh AP Date: Thu May 18 01:10:59 2023 -0700 RDMA/bnxt_re: Fix a possible memory leak Inside bnxt_qplib_create_cq(), when the check for NULL DPI fails, driver returns directly without freeing the memory allocated inside bnxt_qplib_alloc_init_hwq() routine. Fixed this by moving the check for NULL DPI before invoking bnxt_qplib_alloc_init_hwq(). Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Link: https://lore.kernel.org/r/1684397461-23082-2-git-send-email-selvin.xavier@broadcom.com Reviewed-by: Kashyap Desai Signed-off-by: Kalesh AP Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 4e111f0cf0ee973ce7e7e012b4ceb07867d2dae5 Author: Tiezhu Yang Date: Fri May 19 15:17:37 2023 +0800 perf bench syscall: Fix __NR_execve undeclared build error The __NR_execve definition for i386 was deleted by mistake in the commit ece7f7c0507c ("perf bench syscall: Add fork syscall benchmark"), add it to fix the build error on i386. Fixes: ece7f7c0507cc147 ("perf bench syscall: Add fork syscall benchmark") Reported-by: Linux Kernel Functional Testing Signed-off-by: Tiezhu Yang Tested-by: Naresh Kamboju Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Tiezhu Yang Cc: loongson-kernel@lists.loongnix.cn Closes: https://lore.kernel.org/all/CA+G9fYvgBR1iB0CorM8OC4AM_w_tFzyQKHc+rF6qPzJL=TbfDQ@mail.gmail.com/ Link: https://lore.kernel.org/r/1684480657-2375-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit 5783ecc90e24a870a563b1acbfd13cad3786e519 Merge: 73c7f8246539d eab866bfff51d Author: Rafael J. Wysocki Date: Fri May 19 16:33:50 2023 +0200 Merge branch 'pm-tools' Merge cpupower utility fixes for 6.4-rc3: - Read TSC on each CPU right before reading MPERF so as to reduce the potential time difference between the TSC and MPERF accesses and improve the C0 percentage calculation (Wyes Karny). - Fix a possible file handle leak and clean up the code in sysfs_get_enabled() (Hao Zeng). * pm-tools: cpupower: Make TSC read per CPU for Mperf monitor cpupower:Fix resource leaks in sysfs_get_enabled() commit eab866bfff51d21318425ef5ce9d5b49791a6799 Merge: f1fcbaa18b28d c2adb1877b76f Author: Rafael J. Wysocki Date: Fri May 19 16:23:07 2023 +0200 Merge tag 'linux-cpupower-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull cpupower utility fixes for 6.4-rc3 from Shuah Khan: "This cpupower fixes update for Linux 67.4-rc3 consists of: - a resource leak fix - fix drift in C0 percentage calculation due to System-wide TSC read. To lower this drift read TSC per CPU and also just after mperf read. This technique improves C0 percentage calculation in Mperf monitor" * tag 'linux-cpupower-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: Make TSC read per CPU for Mperf monitor cpupower:Fix resource leaks in sysfs_get_enabled() commit 46f5dd7439e35ae63cdf04d7967152936c8a511e Author: Dan Carpenter Date: Mon May 15 13:32:47 2023 +0300 fbdev: omapfb: panel-tpo-td043mtea1: fix error code in probe() This was using the wrong variable, "r", instead of "ddata->vcc_reg", so it returned success instead of a negative error code. Fixes: 0d3dbeb8142a ("video: fbdev: omapfb: panel-tpo-td043mtea1: Make use of the helper function dev_err_probe()") Signed-off-by: Dan Carpenter Signed-off-by: Helge Deller commit aa8bf93101a185b49f83c9137453571a08be6e76 Author: Vladislav Efanov Date: Wed May 17 15:52:47 2023 +0300 drm/sched: Remove redundant check The rq pointer points inside the drm_gpu_scheduler structure. Thus it can't be NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c61cdbdbffc1 ("drm/scheduler: Fix hang when sched_entity released") Signed-off-by: Vladislav Efanov Link: https://lore.kernel.org/r/20230517125247.434103-1-VEfanov@ispras.ru Reviewed-by: Luben Tuikov Signed-off-by: Luben Tuikov commit 75438f24a4d4adcaea6f04ad3a94b7a145e63327 Author: Ian Rogers Date: Wed May 17 15:57:06 2023 -0700 perf test attr: Fix python SafeConfigParser() deprecation warning Address the warning: ``` tests/attr.py:155: DeprecationWarning: The SafeConfigParser class has been renamed to ConfigParser in Python 3.2. This alias will be removed in Python 3.12. Use ConfigParser directly instead. parser = configparser.SafeConfigParser() ``` by removing the word 'Safe'. Reviewed-by: James Clark Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Richter Link: https://lore.kernel.org/r/20230517225707.2682235-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 951efb9976ce453342a86b29d7bfe9fa483c7c4d Author: Ian Rogers Date: Wed May 17 15:57:05 2023 -0700 perf test attr: Update no event/metric expectations Previously hard coded events/metrics were used, update for the use of the TopdownL1 json metric group. Reported-by: Arnaldo Carvalho de Melo Fixes: 94b1a603fca78388 ("perf stat: Add TopdownL1 metric as a default if present") Reviewed-by: James Clark Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Tested-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Richter Link: https://lore.kernel.org/r/20230517225707.2682235-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4d43acb145c363626d76f49febb4240c488cd1cf Author: Dan Carpenter Date: Mon May 15 13:32:10 2023 +0300 dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() There are two place if the at_xdmac_interleaved_queue_desc() fails which could lead to a NULL dereference where "first" is NULL and we call list_add_tail(&first->desc_node, ...). In the first caller, the return is not checked so add a check for that. In the next caller, the return is checked but if it fails on the first iteration through the loop then it will lead to a NULL pointer dereference. Fixes: 4e5385784e69 ("dmaengine: at_xdmac: handle numf > 1") Fixes: 62b5cb757f1d ("dmaengine: at_xdmac: fix memory leak in interleaved mode") Signed-off-by: Dan Carpenter Reviewed-by: Tudor Ambarus Link: https://lore.kernel.org/r/21282b66-9860-410a-83df-39c17fcf2f1b@kili.mountain Signed-off-by: Vinod Koul commit ddaf098ea779b3c1302c7843f6ff01e89b1fd380 Author: Greg Kroah-Hartman Date: Tue May 16 21:20:14 2023 +0200 driver core: class: properly reference count class_dev_iter() When class_dev_iter is initialized, the reference count for the subsys private structure is incremented, but never decremented, causing a memory leak over time. To resolve this, save off a pointer to the internal structure into the class_dev_iter structure and then when the iterator is finished, drop the reference count. Reported-and-tested-by: syzbot+e7afd76ad060fa0d2605@syzkaller.appspotmail.com Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys") Reported-by: Mirsad Goran Todorovac Cc: Alan Stern Acked-by: Rafael J. Wysocki Tested-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/r/2023051610-stove-condense-9a77@gregkh Signed-off-by: Greg Kroah-Hartman commit 09cce60bddd6461a93a5bf434265a47827d1bc6f Author: Will Deacon Date: Thu May 18 10:58:44 2023 +0100 KVM: arm64: Prevent unconditional donation of unmapped regions from the host Since host stage-2 mappings are created lazily, we cannot rely solely on the pte in order to recover the target physical address when checking a host-initiated memory transition as this permits donation of unmapped regions corresponding to MMIO or "no-map" memory. Instead of inspecting the pte, move the addr_is_allowed_memory() check into the host callback function where it is passed the physical address directly from the walker. Cc: Quentin Perret Fixes: e82edcc75c4e ("KVM: arm64: Implement do_share() helper for sharing memory") Signed-off-by: Will Deacon Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230518095844.1178-1-will@kernel.org commit 62548732260976ca88fcb17ef98ab661e7ce7504 Author: Jean-Philippe Brucker Date: Thu May 18 11:09:18 2023 +0100 KVM: arm64: vgic: Fix a comment It is host userspace, not the guest, that issues KVM_DEV_ARM_VGIC_GRP_CTRL Signed-off-by: Jean-Philippe Brucker Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230518100914.2837292-5-jean-philippe@linaro.org commit c38b8400aef99d63be2b1ff131bb993465dcafe1 Author: Jean-Philippe Brucker Date: Thu May 18 11:09:17 2023 +0100 KVM: arm64: vgic: Fix locking comment It is now config_lock that must be held, not kvm lock. Replace the comment with a lockdep annotation. Fixes: f00327731131 ("KVM: arm64: Use config_lock to protect vgic state") Signed-off-by: Jean-Philippe Brucker Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230518100914.2837292-4-jean-philippe@linaro.org commit 9cf2f840c439b6b23bd99f584f2917ca425ae406 Author: Jean-Philippe Brucker Date: Thu May 18 11:09:16 2023 +0100 KVM: arm64: vgic: Wrap vgic_its_create() with config_lock vgic_its_create() changes the vgic state without holding the config_lock, which triggers a lockdep warning in vgic_v4_init(): [ 358.667941] WARNING: CPU: 3 PID: 178 at arch/arm64/kvm/vgic/vgic-v4.c:245 vgic_v4_init+0x15c/0x7a8 ... [ 358.707410] vgic_v4_init+0x15c/0x7a8 [ 358.708550] vgic_its_create+0x37c/0x4a4 [ 358.709640] kvm_vm_ioctl+0x1518/0x2d80 [ 358.710688] __arm64_sys_ioctl+0x7ac/0x1ba8 [ 358.711960] invoke_syscall.constprop.0+0x70/0x1e0 [ 358.713245] do_el0_svc+0xe4/0x2d4 [ 358.714289] el0_svc+0x44/0x8c [ 358.715329] el0t_64_sync_handler+0xf4/0x120 [ 358.716615] el0t_64_sync+0x190/0x194 Wrap the whole of vgic_its_create() with config_lock since, in addition to calling vgic_v4_init(), it also modifies the global kvm->arch.vgic state. Fixes: f00327731131 ("KVM: arm64: Use config_lock to protect vgic state") Signed-off-by: Jean-Philippe Brucker Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230518100914.2837292-3-jean-philippe@linaro.org commit 59112e9c390be595224e427827475a6cd3726021 Author: Jean-Philippe Brucker Date: Thu May 18 11:09:15 2023 +0100 KVM: arm64: vgic: Fix a circular locking issue Lockdep reports a circular lock dependency between the srcu and the config_lock: [ 262.179917] -> #1 (&kvm->srcu){.+.+}-{0:0}: [ 262.182010] __synchronize_srcu+0xb0/0x224 [ 262.183422] synchronize_srcu_expedited+0x24/0x34 [ 262.184554] kvm_io_bus_register_dev+0x324/0x50c [ 262.185650] vgic_register_redist_iodev+0x254/0x398 [ 262.186740] vgic_v3_set_redist_base+0x3b0/0x724 [ 262.188087] kvm_vgic_addr+0x364/0x600 [ 262.189189] vgic_set_common_attr+0x90/0x544 [ 262.190278] vgic_v3_set_attr+0x74/0x9c [ 262.191432] kvm_device_ioctl+0x2a0/0x4e4 [ 262.192515] __arm64_sys_ioctl+0x7ac/0x1ba8 [ 262.193612] invoke_syscall.constprop.0+0x70/0x1e0 [ 262.195006] do_el0_svc+0xe4/0x2d4 [ 262.195929] el0_svc+0x44/0x8c [ 262.196917] el0t_64_sync_handler+0xf4/0x120 [ 262.198238] el0t_64_sync+0x190/0x194 [ 262.199224] [ 262.199224] -> #0 (&kvm->arch.config_lock){+.+.}-{3:3}: [ 262.201094] __lock_acquire+0x2b70/0x626c [ 262.202245] lock_acquire+0x454/0x778 [ 262.203132] __mutex_lock+0x190/0x8b4 [ 262.204023] mutex_lock_nested+0x24/0x30 [ 262.205100] vgic_mmio_write_v3_misc+0x5c/0x2a0 [ 262.206178] dispatch_mmio_write+0xd8/0x258 [ 262.207498] __kvm_io_bus_write+0x1e0/0x350 [ 262.208582] kvm_io_bus_write+0xe0/0x1cc [ 262.209653] io_mem_abort+0x2ac/0x6d8 [ 262.210569] kvm_handle_guest_abort+0x9b8/0x1f88 [ 262.211937] handle_exit+0xc4/0x39c [ 262.212971] kvm_arch_vcpu_ioctl_run+0x90c/0x1c04 [ 262.214154] kvm_vcpu_ioctl+0x450/0x12f8 [ 262.215233] __arm64_sys_ioctl+0x7ac/0x1ba8 [ 262.216402] invoke_syscall.constprop.0+0x70/0x1e0 [ 262.217774] do_el0_svc+0xe4/0x2d4 [ 262.218758] el0_svc+0x44/0x8c [ 262.219941] el0t_64_sync_handler+0xf4/0x120 [ 262.221110] el0t_64_sync+0x190/0x194 Note that the current report, which can be triggered by the vgic_irq kselftest, is a triple chain that includes slots_lock, but after inverting the slots_lock/config_lock dependency, the actual problem reported above remains. In several places, the vgic code calls kvm_io_bus_register_dev(), which synchronizes the srcu, while holding config_lock (#1). And the MMIO handler takes the config_lock while holding the srcu read lock (#0). Break dependency #1, by registering the distributor and redistributors without holding config_lock. The ITS also uses kvm_io_bus_register_dev() but already relies on slots_lock to serialize calls. The distributor iodev is created on the first KVM_RUN call. Multiple threads will race for vgic initialization, and only the first one will see !vgic_ready() under the lock. To serialize those threads, rely on slots_lock rather than config_lock. Redistributors are created earlier, through KVM_DEV_ARM_VGIC_GRP_ADDR ioctls and vCPU creation. Similarly, serialize the iodev creation with slots_lock, and the rest with config_lock. Fixes: f00327731131 ("KVM: arm64: Use config_lock to protect vgic state") Signed-off-by: Jean-Philippe Brucker Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230518100914.2837292-2-jean-philippe@linaro.org commit 9025944fddfed5966c8f102f1fe921ab3aee2c12 Author: Shenwei Wang Date: Thu May 18 10:02:02 2023 -0500 net: fec: add dma_wmb to ensure correct descriptor values Two dma_wmb() are added in the XDP TX path to ensure proper ordering of descriptor and buffer updates: 1. A dma_wmb() is added after updating the last BD to make sure the updates to rest of the descriptor are visible before transferring ownership to FEC. 2. A dma_wmb() is also added after updating the bdp to ensure these updates are visible before updating txq->bd.cur. 3. Start the xmit of the frame immediately right after configuring the tx descriptor. Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support") Signed-off-by: Shenwei Wang Reviewed-by: Wei Fang Signed-off-by: David S. Miller commit 3be5f6cd4a52b72ae31b77171da0912829c02096 Author: Vladimir Oltean Date: Thu May 18 18:41:46 2023 +0300 MAINTAINERS: add myself as maintainer for enetc I would like to be copied on new patches submitted on this driver. I am relatively familiar with the code, having practically maintained it for a while. Signed-off-by: Vladimir Oltean Acked-by: Claudiu Manoil Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit de678ca38861f2eb58814048076dcf95ed1b5bf9 Author: Sunil Goutham Date: Thu May 18 12:10:42 2023 +0530 octeontx2-pf: Fix TSOv6 offload HW adds segment size to the payload length in the IPv6 header. Fix payload length to just TCP header length instead of 'TCP header size + IPv6 header size'. Fixes: 86d7476078b8 ("octeontx2-pf: TCP segmentation offload support") Signed-off-by: Sunil Goutham Signed-off-by: Ratheesh Kannoth Signed-off-by: David S. Miller commit cfcb942863f6fce9266e1957a021e6c7295dee42 Author: Alejandro Lucero Date: Thu May 18 06:48:22 2023 +0100 sfc: fix devlink info error handling Avoid early devlink info return if errors arise with MCDI commands executed for getting the required info from the device. The rationale is some commands can fail but later ones could still give useful data. Moreover, some nvram partitions could not be present which needs to be handled as a non error. The specific errors are reported through system messages and if any error appears, it will be reported generically through extack. Fixes 14743ddd2495 ("sfc: add devlink info support for ef100") Signed-off-by: Alejandro Lucero Acked-by: Martin Habets Signed-off-by: David S. Miller commit 35112271672ae98f45df7875244a4e33aa215e31 Author: Wen Gu Date: Thu May 18 13:14:55 2023 +0800 net/smc: Reset connection when trying to use SMCRv2 fails. We found a crash when using SMCRv2 with 2 Mellanox ConnectX-4. It can be reproduced by: - smc_run nginx - smc_run wrk -t 32 -c 500 -d 30 http://: BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8000000108713067 P4D 8000000108713067 PUD 151127067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 4 PID: 2441 Comm: kworker/4:249 Kdump: loaded Tainted: G W E 6.4.0-rc1+ #42 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_clc_send_confirm_accept+0x284/0x580 [smc] RSP: 0018:ffffb8294b2d7c78 EFLAGS: 00010a06 RAX: ffff8f1873238880 RBX: ffffb8294b2d7dc8 RCX: 0000000000000000 RDX: 00000000000000b4 RSI: 0000000000000001 RDI: 0000000000b40c00 RBP: ffffb8294b2d7db8 R08: ffff8f1815c5860c R09: 0000000000000000 R10: 0000000000000400 R11: 0000000000000000 R12: ffff8f1846f56180 R13: ffff8f1815c5860c R14: 0000000000000001 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8f1aefd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 00000001027a0001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? mlx5_ib_map_mr_sg+0xa1/0xd0 [mlx5_ib] ? smcr_buf_map_link+0x24b/0x290 [smc] ? __smc_buf_create+0x4ee/0x9b0 [smc] smc_clc_send_accept+0x4c/0xb0 [smc] smc_listen_work+0x346/0x650 [smc] ? __schedule+0x279/0x820 process_one_work+0x1e5/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 During the CLC handshake, server sequentially tries available SMCRv2 and SMCRv1 devices in smc_listen_work(). If an SMCRv2 device is found. SMCv2 based link group and link will be assigned to the connection. Then assumed that some buffer assignment errors happen later in the CLC handshake, such as RMB registration failure, server will give up SMCRv2 and try SMCRv1 device instead. But the resources assigned to the connection won't be reset. When server tries SMCRv1 device, the connection creation process will be executed again. Since conn->lnk has been assigned when trying SMCRv2, it will not be set to the correct SMCRv1 link in smcr_lgr_conn_assign_link(). So in such situation, conn->lgr points to correct SMCRv1 link group but conn->lnk points to the SMCRv2 link mistakenly. Then in smc_clc_send_confirm_accept(), conn->rmb_desc->mr[link->link_idx] will be accessed. Since the link->link_idx is not correct, the related MR may not have been initialized, so crash happens. | Try SMCRv2 device first | |-> conn->lgr: assign existed SMCRv2 link group; | |-> conn->link: assign existed SMCRv2 link (link_idx may be 1 in SMC_LGR_SYMMETRIC); | |-> sndbuf & RMB creation fails, quit; | | Try SMCRv1 device then | |-> conn->lgr: create SMCRv1 link group and assign; | |-> conn->link: keep SMCRv2 link mistakenly; | |-> sndbuf & RMB creation succeed, only RMB->mr[link_idx = 0] | initialized. | | Then smc_clc_send_confirm_accept() accesses | conn->rmb_desc->mr[conn->link->link_idx, which is 1], then crash. v This patch tries to fix this by cleaning conn->lnk before assigning link. In addition, it is better to reset the connection and clean the resources assigned if trying SMCRv2 failed in buffer creation or registration. Fixes: e49300a6bf62 ("net/smc: add listen processing for SMC-Rv2") Link: https://lore.kernel.org/r/20220523055056.2078994-1-liuyacan@corp.netease.com/ Signed-off-by: Wen Gu Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit d226b1df361988f885c298737d6019c863a25f26 Author: Po-Hsu Lin Date: Thu May 18 12:37:59 2023 +0800 selftests: fib_tests: mute cleanup error message In the end of the test, there will be an error message induced by the `ip netns del ns1` command in cleanup() Tests passed: 201 Tests failed: 0 Cannot remove namespace file "/run/netns/ns1": No such file or directory This can even be reproduced with just `./fib_tests.sh -h` as we're calling cleanup() on exit. Redirect the error message to /dev/null to mute it. V2: Update commit message and fixes tag. V3: resubmit due to missing netdev ML in V2 Fixes: b60417a9f2b8 ("selftest: fib_tests: Always cleanup before exit") Signed-off-by: Po-Hsu Lin Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit afbed3f74830163f9559579dee382cac3cff82da Author: Jakub Kicinski Date: Tue May 16 18:59:35 2023 -0700 net/mlx5e: do as little as possible in napi poll when budget is 0 NAPI gets called with budget of 0 from netpoll, which has interrupts disabled. We should try to free some space on Tx rings and nothing else. Specifically do not try to handle XDP TX or try to refill Rx buffers - we can't use the page pool from IRQ context. Don't check if IRQs moved, either, that makes no sense in netpoll. Netpoll calls _all_ the rings from whatever CPU it happens to be invoked on. In general do as little as possible, the work quickly adds up when there's tens of rings to poll. The immediate stack trace I was seeing is: __do_softirq+0xd1/0x2c0 __local_bh_enable_ip+0xc7/0x120 page_pool_put_defragged_page+0x267/0x320 mlx5e_free_xdpsq_desc+0x99/0xd0 mlx5e_poll_xdpsq_cq+0x138/0x3b0 mlx5e_napi_poll+0xc3/0x8b0 netpoll_poll_dev+0xce/0x150 AFAIU page pool takes a BH lock, releases it and since BH is now enabled tries to run softirqs. Reviewed-by: Tariq Toukan Fixes: 60bbf7eeef10 ("mlx5: use page_pool for xdp_return_frame call") Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2897041ea094f1eaf49d6b9f765c11a91c0d5dbf Merge: 7e01c7f7046ef 74836ec828fe1 Author: David S. Miller Date: Fri May 19 08:37:37 2023 +0100 Merge branch 'tls-fixes' Jakub Kicinski says: ==================== tls: rx: strp: fix inline crypto offload The local strparser version I added to TLS does not preserve decryption status, which breaks inline crypto (NIC offload). ==================== Signed-off-by: David S. Miller commit 74836ec828fe17b63f2006fdbf53311d691396bf Author: Jakub Kicinski Date: Tue May 16 18:50:42 2023 -0700 tls: rx: strp: don't use GFP_KERNEL in softirq context When receive buffer is small, or the TCP rx queue looks too complicated to bother using it directly - we allocate a new skb and copy data into it. We already use sk->sk_allocation... but nothing actually sets it to GFP_ATOMIC on the ->sk_data_ready() path. Users of HW offload are far more likely to experience problems due to scheduling while atomic. "Copy mode" is very rarely triggered with SW crypto. Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Tested-by: Shai Amiram Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit eca9bfafee3a0487e59c59201ae14c7594ba940a Author: Jakub Kicinski Date: Tue May 16 18:50:41 2023 -0700 tls: rx: strp: preserve decryption status of skbs when needed When receive buffer is small we try to copy out the data from TCP into a skb maintained by TLS to prevent connection from stalling. Unfortunately if a single record is made up of a mix of decrypted and non-decrypted skbs combining them into a single skb leads to loss of decryption status, resulting in decryption errors or data corruption. Similarly when trying to use TCP receive queue directly we need to make sure that all the skbs within the record have the same status. If we don't the mixed status will be detected correctly but we'll CoW the anchor, again collapsing it into a single paged skb without decrypted status preserved. So the "fixup" code will not know which parts of skb to re-encrypt. Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Tested-by: Shai Amiram Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit c1c607b1e5d5477d82ca6a86a05a4f10907b33ee Author: Jakub Kicinski Date: Tue May 16 18:50:40 2023 -0700 tls: rx: strp: factor out copying skb data We'll need to copy input skbs individually in the next patch. Factor that code out (without assuming we're copying a full record). Tested-by: Shai Amiram Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 8b0c0dc9fbbd01e58a573a41c38885f9e4c17696 Author: Jakub Kicinski Date: Tue May 16 18:50:39 2023 -0700 tls: rx: strp: fix determining record length in copy mode We call tls_rx_msg_size(skb) before doing skb->len += chunk. So the tls_rx_msg_size() code will see old skb->len, most likely leading to an over-read. Worst case we will over read an entire record, next iteration will try to trim the skb but may end up turning frag len negative or discarding the subsequent record (since we already told TCP we've read it during previous read but now we'll trim it out of the skb). Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Tested-by: Shai Amiram Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 14c4be92ebb3e36e392aa9dd8f314038a9f96f3c Author: Jakub Kicinski Date: Tue May 16 18:50:38 2023 -0700 tls: rx: strp: force mixed decrypted records into copy mode If a record is partially decrypted we'll have to CoW it, anyway, so go into copy mode and allocate a writable skb right away. This will make subsequent fix simpler because we won't have to teach tls_strp_msg_make_copy() how to copy skbs while preserving decrypt status. Tested-by: Shai Amiram Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 210620ae44a83f25220450bbfcc22e6fe986b25f Author: Jakub Kicinski Date: Tue May 16 18:50:37 2023 -0700 tls: rx: strp: set the skb->len of detached / CoW'ed skbs alloc_skb_with_frags() fills in page frag sizes but does not set skb->len and skb->data_len. Set those correctly otherwise device offload will most likely generate an empty skb and hit the BUG() at the end of __skb_nsg(). Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Tested-by: Shai Amiram Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit b3a03b540e3cf62a255213d084d76d71c02793d5 Author: Jakub Kicinski Date: Tue May 16 18:50:36 2023 -0700 tls: rx: device: fix checking decryption status skb->len covers the entire skb, including the frag_list. In fact we're guaranteed that rxm->full_len <= skb->len, so since the change under Fixes we were not checking decrypt status of any skb but the first. Note that the skb_pagelen() added here may feel a bit costly, but it's removed by subsequent fixes, anyway. Reported-by: Tariq Toukan Fixes: 86b259f6f888 ("tls: rx: device: bound the frag walk") Tested-by: Shai Amiram Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 7e01c7f7046efc2c7c192c3619db43292b98e997 Author: Tudor Ambarus Date: Wed May 17 13:38:08 2023 +0000 net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than the calculated "min" value, but greater than zero, the logic sets tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in cdc_ncm_fill_tx_frame() where all the data is handled. For small values of dwNtbOutMaxSize the memory allocated during alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to how size is aligned at alloc time: size = SKB_DATA_ALIGN(size); size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); Thus we hit the same bug that we tried to squash with commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero") Low values of dwNtbOutMaxSize do not cause an issue presently because at alloc_skb() time more memory (512b) is allocated than required for the SKB headers alone (320b), leaving some space (512b - 320b = 192b) for CDC data (172b). However, if more elements (for example 3 x u64 = [24b]) were added to one of the SKB header structs, say 'struct skb_shared_info', increasing its original size (320b [320b aligned]) to something larger (344b [384b aligned]), then suddenly the CDC data (172b) no longer fits in the spare SKB data area (512b - 384b = 128b). Consequently the SKB bounds checking semantics fails and panics: skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev: ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic net/core/skbuff.c:113 [inline] RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118 [snip] Call Trace: skb_put+0x151/0x210 net/core/skbuff.c:2047 skb_put_zero include/linux/skbuff.h:2422 [inline] cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline] cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308 cdc_ncm_tx_fixup+0xa3/0x100 Deal with too low values of dwNtbOutMaxSize, clamp it in the range [USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure enough data space is allocated to handle CDC data by making sure dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE. Fixes: 289507d3364f ("net: cdc_ncm: use sysfs for rx/tx aggregation tuning") Cc: stable@vger.kernel.org Reported-by: syzbot+9f575a1f15fc0c01ed69@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=b982f1059506db48409d Link: https://lore.kernel.org/all/20211202143437.1411410-1-lee.jones@linaro.org/ Signed-off-by: Tudor Ambarus Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230517133808.1873695-2-tudor.ambarus@linaro.org Signed-off-by: Jakub Kicinski commit 1878b736e88e0d30f67d7fb577816395727ef040 Merge: ac5902f84bb54 0649728123cf6 Author: Jens Axboe Date: Thu May 18 19:46:42 2023 -0600 Merge tag 'nvme-6.4-2023-05-18' of git://git.infradead.org/nvme into block-6.4 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.4 - More device quirks (Sagi, Hristo, Adrian, Daniel) - Controller delete race (Maurizo) - Multipath cleanup fix (Christoph)" * tag 'nvme-6.4-2023-05-18' of git://git.infradead.org/nvme: nvme-pci: Add quirk for Teamgroup MP33 SSD nvme: do not let the user delete a ctrl before a complete initialization nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk nvme-pci: clamp max_hw_sectors based on DMA optimized limitation nvme-pci: add quirk for missing secondary temperature thresholds nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G commit 79ef1c9d14c65a5c3f7eec47389d8c2a33be8e8d Merge: 83ab69c9f759e 6d600229df1ed Author: Dave Airlie Date: Fri May 19 11:26:21 2023 +1000 Merge tag 'amd-drm-fixes-6.4-2023-05-18' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.4-2023-05-18: amdgpu: - update gfx11 clock counter logic - Fix a race when disabling gfxoff on gfx10/11 for profiling - Raven/Raven2/PCO clock counter fix - Add missing get_vbios_fb_size for GMC 11 - Fix a spurious irq warning in the device remove case - Fix possible power mode mismatch between driver and PMFW - USB4 fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230518174811.3841-1-alexander.deucher@amd.com commit 83ab69c9f759e365cba243568cd76f8d49dcd5b5 Merge: 8c5be8a885a59 5c054db54c43a Author: Dave Airlie Date: Fri May 19 11:22:22 2023 +1000 Merge tag 'drm-msm-fixes-2023-05-17' of https://gitlab.freedesktop.org/drm/msm into drm-fixes msm-fixes for v6.4-rc3 Display Fixes: + Catalog fixes: - fix the programmable fetch lines and qos settings of msm8998 to match what is present downstream - fix the LM pairs for msm8998 to match what is present downstream. The current settings are not right as LMs with incompatible connected blocks are paired - remove unused INTF0 interrupt mask from SM6115/QCM2290 as there is no INTF0 present on those chipsets. There is only one DSI on index 1 - remove TE2 block from relevant chipsets because this is mainly used for ping-pong split feature which is not supported upstream and also for the chipsets where we are removing them in this change, that block is not present as the tear check has been moved to the intf block - relocate non-MDP_TOP INTF_INTR offsets from dpu_hwio.h to dpu_hw_interrupts.c to match where they belong - fix the indentation for REV_7xxx interrupt masks - fix the offset and version for dither blocks of SM8[34]50/SC8280XP chipsets as it was incorrect - make the ping-pong blk length 0 for appropriate chipsets as those chipsets only have a dither ping-pong dither block but no other functionality in the base ping-pong - remove some duplicate register defines from INTF + Fix the log mask for the writeback block so that it can be enabled correctly via debugfs + unregister the hdmi codec for dp during unbind otherwise it leaks audio codec devices + Yaml change to fix warnings related to 'qcom,master-dsi' and 'qcom,sync-dual-dsi' GPU Fixes: + fix submit error path leak + arm-smmu-qcom fix for regression that broke per-process page tables + fix no-iommu crash Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGvHEcJfp=k6qatmb_SvAeyvy3CBpaPfwLqtNthuEzA_7w@mail.gmail.com commit 8c5be8a885a59bfe5c74ff03fe3d59717b99deae Merge: 90facc4d46301 5896f2d363d5c Author: Dave Airlie Date: Fri May 19 11:19:15 2023 +1000 Merge tag 'drm-intel-fixes-2023-05-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes Add missing null check for HDCP code. Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZGUgi7kXq+MiLcCA@jlahtine-mobl.ger.corp.intel.com commit 0649728123cf6a5518e154b4e1735fc85ea4f55c Author: Daniel Smith Date: Wed May 17 14:32:32 2023 -0700 nvme-pci: Add quirk for Teamgroup MP33 SSD Add a quirk for Teamgroup MP33 that reports duplicate ids for disk. Signed-off-by: Daniel Smith [kch: patch formatting] Signed-off-by: Chaitanya Kulkarni Tested-by: Daniel Smith Signed-off-by: Keith Busch commit 90facc4d46301c4fb188899627e3e79b597f83bc Merge: f1fcbaa18b28d 2ef0785b30bd6 Author: Dave Airlie Date: Fri May 19 10:43:54 2023 +1000 Merge tag 'exynos-drm-fixes-for-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Just one fixup to exynos_drm_g2d module. - Fix below build warning by marking them as 'static inline' drivers/gpu/drm/exynos/exynos_drm_g2d.h:37:5: error: no previous prototype for 'g2d_open' drivers/gpu/drm/exynos/exynos_drm_g2d.h:42:5: error: no previous prototype for 'g2d_close' Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/20230515083943.43933-1-inki.dae@samsung.com commit f4a8871f9f347b185c44525c9bb1755951f94841 Merge: 2d1bcbc6cd703 c7394fa9aa4cc Author: Linus Torvalds Date: Thu May 18 17:06:04 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-05-18-15-52' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Eight hotfixes. Four are cc:stable, the other four are for post-6.4 issues, or aren't considered suitable for backporting" * tag 'mm-hotfixes-stable-2023-05-18-15-52' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: Cleanup Arm Display IP maintainers MAINTAINERS: repair pattern in DIALOG SEMICONDUCTOR DRIVERS nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() mm: fix zswap writeback race condition mm: kfence: fix false positives on big endian zsmalloc: move LRU update from zs_map_object() to zs_malloc() mm: shrinkers: fix race condition on debugfs cleanup maple_tree: make maple state reusable after mas_empty_area() commit e764f12208b99ac7892c4e3f6bf88d71ca71036f Author: Dave Jiang Date: Thu May 18 16:38:20 2023 -0700 cxl: Move cxl_await_media_ready() to before capacity info retrieval Move cxl_await_media_ready() to cxl_pci probe before driver starts issuing IDENTIFY and retrieving memory device information to ensure that the device is ready to provide the information. Allow cxl_pci_probe() to succeed even if media is not ready. Cache the media failure in cxlds and don't ask the device for any media information. The rationale for proceeding in the !media_ready case is to allow for mailbox operations to interrogate and/or remediate the device. After media is repaired then rebinding the cxl_pci driver is expected to restart the capacity scan. Suggested-by: Dan Williams Fixes: b39cb1052a5c ("cxl/mem: Register CXL memX devices") Reviewed-by: Ira Weiny Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/168445310026.3251520.8124296540679268206.stgit@djiang5-mobl3 [djbw: fixup cxl_test] Signed-off-by: Dan Williams commit ce17ad0d54985e2595a3e615fda31df61808a08c Author: Dave Jiang Date: Thu May 18 14:54:34 2023 -0700 cxl: Wait Memory_Info_Valid before access memory related info The Memory_Info_Valid bit (CXL 3.0 8.1.3.8.2) indicates that the CXL Range Size High and Size Low registers are valid. The bit must be set within 1 second of reset deassertion to the device. Check valid bit before we check the Memory_Active bit when waiting for cxl_await_media_ready() to ensure that the memory info is valid for consumption. Also ensures both DVSEC ranges 1 and 2 are ready if DVSEC Capability indicates they are both supported. Fixes: 523e594d9cc0 ("cxl/pci: Implement wait for media active") Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/168444687469.3134781.11033518965387297327.stgit@djiang5-mobl3 Signed-off-by: Dan Williams commit eb0764b822b9b26880b28ccb9100b2983e01bc17 Author: Dan Williams Date: Wed May 17 20:19:43 2023 -0700 cxl/port: Enable the HDM decoder capability for switch ports Derick noticed, when testing hot plug, that hot-add behaves nominally after a removal. However, if the hot-add is done without a prior removal, CXL.mem accesses fail. It turns out that the original implementation of the port driver and region programming wrongly assumed that platform-firmware always enables the host-bridge HDM decoder capability. Add support turning on switch-level HDM decoders in the case where platform-firmware has not. The implementation is careful to only arrange for the enable to be undone if the current instance of the driver was the one that did the enable. This is to interoperate with platform-firmware that may expect CXL.mem to remain active after the driver is shutdown. This comes at the cost of potentially not shutting down the enable on kexec flows, but it is mitigated by the fact that the related HDM decoders still need to be enabled on an individual basis. Cc: Reported-by: Derick Marks Fixes: 54cdbf845cf7 ("cxl/port: Add a driver for 'struct cxl_port' objects") Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/168437998331.403037.15719879757678389217.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit e123036be377ddf628226a7c6d4f9af5efd113d3 Author: Ranjani Sridharan Date: Wed May 17 13:57:31 2023 -0500 ASoC: soc-pcm: test if a BE can be prepared In the BE hw_params configuration, the existing code checks if any of the existing FEs are prepared, running, paused or suspended - and skips the configuration in those cases. This allows multiple calls of hw_params which the ALSA state machine supports. This check is not handled for the prepare stage, which can lead to the same BE being prepared multiple times. This patch adds a check similar to that of the hw_params, with the main difference being that the suspended state is allowed: the ALSA state machine allows a transition from suspended to prepared with hw_params skipped. This problem was detected on Intel IPC4/SoundWire devices, where the BE dailink .prepare stage is used to configure the SoundWire stream with a bank switch. Multiple .prepare calls lead to conflicts with the .trigger operation with IPC4 configurations. This problem was not detected earlier on Intel devices, HDaudio BE dailinks detect that the link is already prepared and skip the configuration, and for IPC3 devices there is no BE trigger. Link: https://github.com/thesofproject/sof/issues/7596 Signed-off-by: Ranjani Sridharan Date: Thu May 18 09:04:45 2023 -0700 Merge tag 'probes-fixes-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - Initialize 'ret' local variables on fprobe_handler() to fix the smatch warning. With this, fprobe function exit handler is not working randomly. - Fix to use preempt_enable/disable_notrace for rethook handler to prevent recursive call of fprobe exit handler (which is based on rethook) - Fix recursive call issue on fprobe_kprobe_handler() - Fix to detect recursive call on fprobe_exit_handler() - Fix to make all arch-dependent rethook code notrace (the arch-independent code is already notrace)" * tag 'probes-fixes-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rethook, fprobe: do not trace rethook related functions fprobe: add recursion detection in fprobe_exit_handler fprobe: make fprobe_kprobe_handler recursion free rethook: use preempt_{disable, enable}_notrace in rethook_trampoline_handler tracing: fprobe: Initialize ret valiable to fix smatch error commit 1f594fe7c90746982569bd4f3489e809104a9176 Merge: b802651bb6c90 6e42fae0a1551 Author: Linus Torvalds Date: Thu May 18 08:52:14 2023 -0700 Merge tag 'net-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from can, xfrm, bluetooth and netfilter. Current release - regressions: - ipv6: fix RCU splat in ipv6_route_seq_show() - wifi: iwlwifi: disable RFI feature Previous releases - regressions: - tcp: fix possible sk_priority leak in tcp_v4_send_reset() - tipc: do not update mtu if msg_max is too small in mtu negotiation - netfilter: fix null deref on element insertion - devlink: change per-devlink netdev notifier to static one - phylink: fix ksettings_set() ethtool call - wifi: mac80211: fortify the spinlock against deadlock by interrupt - wifi: brcmfmac: check for probe() id argument being NULL - eth: ice: - fix undersized tx_flags variable - fix ice VF reset during iavf initialization - eth: hns3: fix sending pfc frames after reset issue Previous releases - always broken: - xfrm: release all offloaded policy memory - nsh: use correct mac_offset to unwind gso skb in nsh_gso_segment() - vsock: avoid to close connected socket after the timeout - dsa: rzn1-a5psw: enable management frames for CPU port - eth: virtio_net: fix error unwinding of XDP initialization - eth: tun: fix memory leak for detached NAPI queue. Misc: - MAINTAINERS: sctp: move Neil to CREDITS" * tag 'net-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (107 commits) MAINTAINERS: skip CCing netdev for Bluetooth patches mdio_bus: unhide mdio_bus_init prototype bridge: always declare tunnel functions atm: hide unused procfs functions net: isa: include net/Space.h Revert "ARM: dts: stm32: add CAN support on stm32f746" netfilter: nft_set_rbtree: fix null deref on element insertion netfilter: nf_tables: fix nft_trans type confusion netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT net: wwan: t7xx: Ensure init is completed before system sleep net: selftests: Fix optstring net: pcs: xpcs: fix C73 AN not getting enabled net: wwan: iosm: fix NULL pointer dereference when removing device vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() mailmap: add entries for Nikolay Aleksandrov igb: fix bit_shift to be in [1..8] range net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset cassini: Fix a memory leak in the error handling path of cas_init_one() tun: Fix memory leak for detached NAPI queue. can: kvaser_pciefd: Disable interrupts in probe error path ... commit b802651bb6c90e53b30205b2a4358433e3be57c8 Merge: 4d6d4c7f541d7 280a8ab81733d Author: Linus Torvalds Date: Thu May 18 08:42:23 2023 -0700 Merge tag 'media/v6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "Several fixes for the dvb core and drivers: - fix UAF and null pointer de-reference in DVB core - fix kernel runtime warning for blocking operation in wait_event*() in dvb core - fix write size bug in DVB conditional access core - fix dvb demux continuity counter debug check logic - randconfig build fixes in pvrusb2 and mn88443x - fix memory leak in ttusb-dec - fix netup_unidvb probe-time error check logic - improve error handling in dw2102 if it can't retrieve DVB MAC address" * tag 'media/v6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() media: dvb-core: Fix use-after-free due to race at dvb_register_device() media: dvb-core: Fix use-after-free due on race condition at dvb_net media: dvb-core: Fix use-after-free on race condition at dvb_frontend media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() media: dvb_ca_en50221: fix a size write bug media: netup_unidvb: fix irq init by register it at the end of probe media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() media: netup_unidvb: fix use-after-free at del_timer() media: dvb_demux: fix a bug for the continuity counter media: pvrusb2: fix DVB_CORE dependency commit ac5902f84bb546c64aea02c439c2579cbf40318f Author: Ming Lei Date: Wed May 17 21:34:08 2023 +0800 ublk: fix AB-BA lockdep warning When handling UBLK_IO_FETCH_REQ, ctx->uring_lock is grabbed first, then ub->mutex is acquired. When handling UBLK_CMD_STOP_DEV or UBLK_CMD_DEL_DEV, ub->mutex is grabbed first, then calling io_uring_cmd_done() for canceling uring command, in which ctx->uring_lock may be required. Real deadlock only happens when all the above commands are issued from same uring context, and in reality different uring contexts are often used for handing control command and IO command. Fix the issue by using io_uring_cmd_complete_in_task() to cancel command in ublk_cancel_dev(ublk_cancel_queue). Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/linux-block/becol2g7sawl4rsjq2dztsbc7mqypfqko6wzsyoyazqydoasml@rcxarzwidrhk Cc: Ziyang Zhang Signed-off-by: Ming Lei Tested-by: Shinichiro Kawasaki Link: https://lore.kernel.org/r/20230517133408.210944-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 6d600229df1ed06f46ba68ac706d9f44ba8c5fb4 Author: Mustapha Ghaddar Date: Fri Apr 28 12:13:21 2023 -0400 drm/amd/display: enable dpia validate Use dpia_validate_usb4_bw() function Fixes: a8b537605e22 ("drm/amd/display: Add function pointer for validate bw usb4") Reviewed-by: Roman Li Reviewed-by: Meenakshikumar Somasundaram Acked-by: Aurabindo Pillai Signed-off-by: Mustapha Ghaddar Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit bf4823267a817f7c155876a125b94336d7113e77 Author: Evan Quan Date: Thu May 11 15:41:27 2023 +0800 drm/amd/pm: fix possible power mode mismatch between driver and PMFW PMFW may boots the ASIC with a different power mode from the system's real one. Notify PMFW explicitly the power mode the system in. This is needed only when ACDC switch via gpio is not supported. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c1a322a7a4a96cd0a3dde32ce37af437a78bf8cd Author: Guchun Chen Date: Tue May 9 16:15:27 2023 +0800 drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged When performing device unbind or halt, we have disabled all irqs at the very begining like amdgpu_pci_remove or amdgpu_device_halt. So amdgpu_irq_put for irqs stored in fence driver should not be called any more, otherwise, below calltrace will arrive. [ 139.114088] WARNING: CPU: 2 PID: 1550 at drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c:616 amdgpu_irq_put+0xf6/0x110 [amdgpu] [ 139.114655] Call Trace: [ 139.114655] [ 139.114657] amdgpu_fence_driver_hw_fini+0x93/0x130 [amdgpu] [ 139.114836] amdgpu_device_fini_hw+0xb6/0x350 [amdgpu] [ 139.114955] amdgpu_driver_unload_kms+0x51/0x70 [amdgpu] [ 139.115075] amdgpu_pci_remove+0x63/0x160 [amdgpu] [ 139.115193] ? __pm_runtime_resume+0x64/0x90 [ 139.115195] pci_device_remove+0x3a/0xb0 [ 139.115197] device_remove+0x43/0x70 [ 139.115198] device_release_driver_internal+0xbd/0x140 Signed-off-by: Guchun Chen Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 68518294d00da6a2433357af75a63abc6030676e Author: Alex Deucher Date: Thu May 11 10:40:03 2023 -0400 drm/amdgpu/gmc11: implement get_vbios_fb_size() Implement get_vbios_fb_size() so we can properly reserve the vbios splash screen to avoid potential artifacts on the screen during the transition from the pre-OS console to the OS console. Acked-by: Sunil Khatri Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 9d2d1827af295fd6971786672c41c4dba3657154 Author: Jesse Zhang Date: Fri May 12 09:29:17 2023 +0800 drm/amdgpu: Differentiate between Raven2 and Raven/Picasso according to revision id Due to the raven2 and raven/picasso maybe have the same GC_HWIP version. So differentiate them by revision id. Signed-off-by: shanshengwang Signed-off-by: Jesse Zhang Acked-by: Evan Quan Signed-off-by: Alex Deucher commit 11fbdda2ab6bf049e2869139c07016022b4e045b Author: Guilherme G. Piccoli Date: Tue May 9 18:49:47 2023 +0200 drm/amdgpu/gfx11: Adjust gfxoff before powergating on gfx11 as well (Bas: speculative change to mirror gfx10/gfx9) Signed-off-by: Guilherme G. Piccoli Signed-off-by: Bas Nieuwenhuizen Cc: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 8173cab3368a13cdc3cad0bd5cf14e9399b0f501 Author: Bas Nieuwenhuizen Date: Tue May 9 18:49:46 2023 +0200 drm/amdgpu/gfx10: Disable gfxoff before disabling powergating. Otherwise we get a full system lock (looks like a FW mess). Copied the order from the GFX9 powergating code. Fixes: 366468ff6c34 ("drm/amdgpu: Allow GfxOff on Vangogh as default") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2545 Signed-off-by: Bas Nieuwenhuizen Tested-by: Guilherme G. Piccoli Cc: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit a511637502b1caa135046d0f8fdabd55a31af8ef Author: Sen Chu Date: Thu May 18 12:06:46 2023 +0800 regulator: mt6359: add read check for PMIC MT6359 Add hardware version read check for PMIC MT6359 Signed-off-by: Sen Chu Date: Thu May 18 09:47:23 2023 +0800 ceph: force updating the msg pointer in non-split case When the MClientSnap reqeust's op is not CEPH_SNAP_OP_SPLIT the request may still contain a list of 'split_realms', and we need to skip it anyway. Or it will be parsed as a corrupt snaptrace. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/61200 Reported-by: Frank Schilder Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 9aaa7eb018661b2da221362d9bacb096bd596f52 Author: Xiubo Li Date: Mon May 8 14:45:01 2023 +0800 ceph: silence smatch warning in reconnect_caps_cb() Smatch static checker warning: fs/ceph/mds_client.c:3968 reconnect_caps_cb() warn: missing error code here? '__get_cap_for_mds()' failed. 'err' = '0' [ idryomov: Dan says that Smatch considers it intentional only if the "ret = 0;" assignment is within 4 or 5 lines of the goto. ] Reported-by: Dan Carpenter Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 6e42fae0a15519393d3cc5500dc8d84b8549a337 Merge: 30a0f49d5428a 36a6418bb1259 Author: Paolo Abeni Date: Thu May 18 11:06:28 2023 +0200 Merge tag 'linux-can-fixes-for-6.4-20230518' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2023-05-18 this is a pull request of 7 patches for net/master. The first 6 patches are by Jimmy Assarsson and fix several bugs in the kvaser_pciefd driver. The latest patch is from me and reverts a change in stm32f746.dtsi that causes build errors due to a missing dependent patch. * tag 'linux-can-fixes-for-6.4-20230518' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: Revert "ARM: dts: stm32: add CAN support on stm32f746" can: kvaser_pciefd: Disable interrupts in probe error path can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt can: kvaser_pciefd: Empty SRB buffer in probe can: kvaser_pciefd: Call request_irq() before enabling interrupts can: kvaser_pciefd: Clear listen-only bit if not explicitly requested can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() ==================== Link: https://lore.kernel.org/r/20230518073241.1110453-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit 8c1688e897a6a74d1463327f313e4b0cd66b031f Merge: 280a8ab81733d f1fcbaa18b28d Author: Mauro Carvalho Chehab Date: Thu May 18 09:29:18 2023 +0100 Merge tag 'v6.4-rc2' into v4l_for_linus Linux 6.4-rc2 * tag 'v6.4-rc2': (162 commits) Linux 6.4-rc2 parisc: Fix encoding of swp_entry due to added SWP_EXCLUSIVE flag ext4: bail out of ext4_xattr_ibody_get() fails for any reason ext4: add bounds checking in get_max_inline_xattr_value_size() ext4: add indication of ro vs r/w mounts in the mount message ext4: fix deadlock when converting an inline directory in nojournal mode ext4: improve error recovery code paths in __ext4_remount() ext4: improve error handling from ext4_dirhash() ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled ext4: check iomap type only if ext4_iomap_begin() does not fail ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum ext4: fix data races when using cached status extents ext4: avoid deadlock in fs reclaim with page writeback ext4: fix invalid free tracking in ext4_xattr_move_to_block() ext4: remove a BUG_ON in ext4_mb_release_group_pa() ext4: allow ext4_get_group_info() to fail cxl: Add missing return to cdat read error path tools/testing/cxl: Use DEFINE_STATIC_SRCU() x86/retbleed: Fix return thunk alignment Documentation/block: drop the request.rst file ... commit 30a0f49d5428a0e06a63c157befb6b3ab21f366b Merge: c259ad11698b8 61ae320a29b05 Author: Jakub Kicinski Date: Wed May 17 21:43:20 2023 -0700 Merge tag 'nf-23-05-17' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== Netfilter fixes for net 1. Silence warning about unused variable when CONFIG_NF_NAT=n, from Tom Rix. 2. nftables: Fix possible out-of-bounds access, from myself. 3. nftables: fix null deref+UAF during element insertion into rbtree, also from myself. * tag 'nf-23-05-17' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_set_rbtree: fix null deref on element insertion netfilter: nf_tables: fix nft_trans type confusion netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT ==================== Link: https://lore.kernel.org/r/20230517123756.7353-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit c259ad11698b8a573183aee8932d1885f4441c3a Merge: bfa00d8f98f7c 212457ccbd60d Author: Jakub Kicinski Date: Wed May 17 21:36:21 2023 -0700 Merge tag 'wireless-2023-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.4 A lot of fixes this time, for both the stack and the drivers. The brcmfmac resume fix has been reported by several people so I would say it's the most important here. The iwlwifi RFI workaround is also something which was reported as a regression recently. * tag 'wireless-2023-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (31 commits) wifi: b43: fix incorrect __packed annotation wifi: rtw88: sdio: Always use two consecutive bytes for word operations mac80211_hwsim: fix memory leak in hwsim_new_radio_nl wifi: iwlwifi: mvm: Add locking to the rate read flow wifi: iwlwifi: Don't use valid_links to iterate sta links wifi: iwlwifi: mvm: don't trust firmware n_channels wifi: iwlwifi: mvm: fix OEM's name in the tas approved list wifi: iwlwifi: fix OEM's name in the ppag approved list wifi: iwlwifi: mvm: fix initialization of a return value wifi: iwlwifi: mvm: fix access to fw_id_to_mac_id wifi: iwlwifi: fw: fix DBGI dump wifi: iwlwifi: mvm: fix number of concurrent link checks wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock wifi: iwlwifi: mvm: don't double-init spinlock wifi: iwlwifi: mvm: always free dup_data wifi: mac80211: recalc chanctx mindef before assigning wifi: mac80211: consider reserved chanctx for mindef wifi: mac80211: simplify chanctx allocation wifi: mac80211: Abort running color change when stopping the AP wifi: mac80211: fix min center freq offset tracing ... ==================== Link: https://lore.kernel.org/r/20230517151914.B0AF6C433EF@smtp.kernel.org Signed-off-by: Jakub Kicinski commit bfa00d8f98f7c5e582b04f874aecb83af8da84c6 Author: Jakub Kicinski Date: Tue May 16 18:42:53 2023 -0700 MAINTAINERS: skip CCing netdev for Bluetooth patches As requested by Marcel skip netdev for Bluetooth patches. Bluetooth has its own mailing list and overloading netdev leads to fewer people reading it. Link: https://lore.kernel.org/netdev/639C8EA4-1F6E-42BE-8F04-E4A753A6EFFC@holtmann.org/ Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230517014253.1233333-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2e9f8ab68f42b059e80db71266c1675c07c664bd Author: Arnd Bergmann Date: Tue May 16 21:45:36 2023 +0200 mdio_bus: unhide mdio_bus_init prototype mdio_bus_init() is either used as a local module_init() entry, or it gets called in phy_device.c. In the former case, there is no declaration, which causes a warning: drivers/net/phy/mdio_bus.c:1371:12: error: no previous prototype for 'mdio_bus_init' [-Werror=missing-prototypes] Remove the #ifdef around the declaration to avoid the warning.. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230516194625.549249-4-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 89dcd87ce534a3a7f267cfd58505803006f51301 Author: Arnd Bergmann Date: Tue May 16 21:45:35 2023 +0200 bridge: always declare tunnel functions When CONFIG_BRIDGE_VLAN_FILTERING is disabled, two functions are still defined but have no prototype or caller. This causes a W=1 warning for the missing prototypes: net/bridge/br_netlink_tunnel.c:29:6: error: no previous prototype for 'vlan_tunid_inrange' [-Werror=missing-prototypes] net/bridge/br_netlink_tunnel.c:199:5: error: no previous prototype for 'br_vlan_tunnel_info' [-Werror=missing-prototypes] The functions are already contitional on CONFIG_BRIDGE_VLAN_FILTERING, and I coulnd't easily figure out the right set of #ifdefs, so just move the declarations out of the #ifdef to avoid the warning, at a small cost in code size over a more elaborate fix. Fixes: 188c67dd1906 ("net: bridge: vlan options: add support for tunnel id dumping") Fixes: 569da0822808 ("net: bridge: vlan options: add support for tunnel mapping set/del") Signed-off-by: Arnd Bergmann Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230516194625.549249-3-arnd@kernel.org Signed-off-by: Jakub Kicinski commit fb1b7be9b16c1f4626969ba4e95a97da2a452b41 Author: Arnd Bergmann Date: Tue May 16 21:45:34 2023 +0200 atm: hide unused procfs functions When CONFIG_PROC_FS is disabled, the function declarations for some procfs functions are hidden, but the definitions are still build, as shown by this compiler warning: net/atm/resources.c:403:7: error: no previous prototype for 'atm_dev_seq_start' [-Werror=missing-prototypes] net/atm/resources.c:409:6: error: no previous prototype for 'atm_dev_seq_stop' [-Werror=missing-prototypes] net/atm/resources.c:414:7: error: no previous prototype for 'atm_dev_seq_next' [-Werror=missing-prototypes] Add another #ifdef to leave these out of the build. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230516194625.549249-2-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 067dee65751bcd14fcaaee769cee84c65ce99360 Author: Arnd Bergmann Date: Tue May 16 21:45:33 2023 +0200 net: isa: include net/Space.h The legacy drivers that still get called from net/Space.c have prototypes in net/Space, but this header is not included in most of the files that define those functions: drivers/net/ethernet/cirrus/cs89x0.c:1649:28: error: no previous prototype for 'cs89x0_probe' [-Werror=missing-prototypes] drivers/net/ethernet/8390/ne.c:947:28: error: no previous prototype for 'ne_probe' [-Werror=missing-prototypes] drivers/net/ethernet/8390/smc-ultra.c:167:28: error: no previous prototype for 'ultra_probe' [-Werror=missing-prototypes] drivers/net/ethernet/amd/lance.c:438:28: error: no previous prototype for 'lance_probe' [-Werror=missing-prototypes] drivers/net/ethernet/3com/3c515.c:422:20: error: no previous prototype for 'tc515_probe' [-Werror=missing-prototypes] Add the inclusion to avoids the warnings. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230516194625.549249-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit a14da6144d16ef27e3022835fa282a3740b8ad7b Author: Konrad Dybcio Date: Wed May 17 19:06:13 2023 +0200 arm64: dts: qcom: sm6375-pdx225: Fix remoteproc firmware paths They were previously missing the SoC name. Fix it. Fixes: a2ad207c412b ("arm64: dts: qcom: sm6375-pdx225: Enable ADSP & CDSP") Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230517-topic-murray-fwname-v1-1-923e87312249@linaro.org commit 925a80af6106a55fa6bcfedc5bd2f02b0b835495 Author: Krzysztof Kozlowski Date: Sun Apr 16 12:11:34 2023 +0200 ARM: dts: qcom: add missing cache properties Add required cache-unified properties to fix warnings like: qcom-ipq4019-ap.dk01.1-c1.dtb: l2-cache: 'cache-unified' is a required property Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230416101134.95686-4-krzysztof.kozlowski@linaro.org commit 9c6e72fb2058dc06da9d278c4bff94430677d48a Author: Krzysztof Kozlowski Date: Sun Apr 16 12:11:33 2023 +0200 arm64: dts: qcom: add missing cache properties Add required cache-level and cache-unified properties to fix warnings like: qdu1000-idp.dtb: l3-cache: 'cache-unified' is a required property qdu1000-idp.dtb: l2-cache: 'cache-level' is a required property Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230416101134.95686-3-krzysztof.kozlowski@linaro.org commit 084657090aacd8a9269931a2879420bf614511fb Author: Krzysztof Kozlowski Date: Sun Apr 16 12:11:32 2023 +0200 arm64: dts: qcom: use decimal for cache level Cache level is by convention a decimal number, not hex. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230416101134.95686-2-krzysztof.kozlowski@linaro.org commit f34fbb71ce9eb0936c0b56fe8b3866d76618c433 Author: Krzysztof Kozlowski Date: Sun Apr 16 12:11:31 2023 +0200 arm64: dts: qcom: fix indentation Correct indentation to use only tabs. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230416101134.95686-1-krzysztof.kozlowski@linaro.org commit 033553c04b02b450261f60d5f1b0e5948cd197bb Author: Krzysztof Kozlowski Date: Mon Apr 10 20:10:05 2023 +0200 ARM: dts: qcom: msm8974: remove superfluous "input-enable" Pin configuration property "input-enable" was used with the intention to disable the output, but this is done by default by Linux drivers. Since patch ("dt-bindings: pinctrl: qcom: tlmm should use output-disable, not input-enable") the property is not accepted anymore. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230410181005.25853-3-krzysztof.kozlowski@linaro.org commit da50416fb1fa7502a52ad38c0e9ff196d9f56ac9 Author: Krzysztof Kozlowski Date: Mon Apr 10 20:10:04 2023 +0200 ARM: dts: qcom: mdm9615: remove superfluous "input-enable" Pin configuration property "input-enable" was used with the intention to disable the output, but this is done by default by Linux drivers. Since patch ("dt-bindings: pinctrl: qcom: tlmm should use output-disable, not input-enable") the property is not accepted anymore. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230410181005.25853-2-krzysztof.kozlowski@linaro.org commit 18f341061262a7a63bc8b5c9ef94a342ac2673a2 Author: Krzysztof Kozlowski Date: Mon Apr 10 20:10:03 2023 +0200 ARM: dts: qcom: apq8026: remove superfluous "input-enable" Pin configuration property "input-enable" was used with the intention to disable the output, but this is done by default by Linux drivers. Since patch ("dt-bindings: pinctrl: qcom: tlmm should use output-disable, not input-enable") the property is not accepted anymore. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230410181005.25853-1-krzysztof.kozlowski@linaro.org commit fae7d907a75eaad4bfb17e7990e357938c5b1351 Author: Krzysztof Kozlowski Date: Sat Apr 8 15:08:09 2023 +0200 arm64: dts: qcom: sm8250-xiaomi-elish-csot: fix panel compatible The bindings expect "novatek,nt36523" fallback in the panel compatible: sm8250-xiaomi-elish-csot.dtb: panel@0: compatible: ['xiaomi,elish-csot-nt36523'] is too short Fixes: 8a786036c7b6 ("arm64: dts: qcom: sm8250-xiaomi-elish-csot: Add Xiaomi Mi Pad 5 Pro CSOT variant") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230408130809.52319-2-krzysztof.kozlowski@linaro.org commit 0c7433dd81b5e771ef222f340fef03501131761b Author: Krzysztof Kozlowski Date: Sat Apr 8 15:08:08 2023 +0200 arm64: dts: qcom: sm8250-xiaomi-elish-boe: fix panel compatible The bindings expect "novatek,nt36523" fallback in the panel compatible: sm8250-xiaomi-elish-boe.dtb: panel@0: compatible: ['xiaomi,elish-boe-nt36523'] is too shor Fixes: 51c4c2bd6f31 ("arm64: dts: qcom: sm8250-xiaomi-elish-boe: Add mdss and dsi panel") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230408130809.52319-1-krzysztof.kozlowski@linaro.org commit 16bd455d0897d1b8b7a9aee2ed51d75b14a34563 Author: Krzysztof Kozlowski Date: Mon Feb 20 10:54:01 2023 +0100 arm64: dts: qcom: sc7280-qcard: drop incorrect dai-cells from WCD938x SDW The WCD938x audio codec Soundwire interface part is not a DAI and does not allow sound-dai-cells: sc7280-herobrine-crd.dtb: codec@0,4: '#sound-dai-cells' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Douglas Anderson Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230220095401.64196-2-krzysztof.kozlowski@linaro.org commit ca8fc6814844d8787e7fec61b2544a871ea8b675 Author: Krzysztof Kozlowski Date: Mon Feb 20 10:54:00 2023 +0100 arm64: dts: qcom: sc7280-idp: drop incorrect dai-cells from WCD938x SDW The WCD938x audio codec Soundwire interface part is not a DAI and does not allow sound-dai-cells: sc7280-idp.dtb: codec@0,4: '#sound-dai-cells' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Douglas Anderson Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230220095401.64196-1-krzysztof.kozlowski@linaro.org commit 3981514180c987a79ea98f0ae06a7cbf58a9ac0f Author: Jim Wylder Date: Wed May 17 10:20:11 2023 -0500 regmap: Account for register length when chunking Currently, when regmap_raw_write() splits the data, it uses the max_raw_write value defined for the bus. For any bus that includes the target register address in the max_raw_write value, the chunked transmission will always exceed the maximum transmission length. To avoid this problem, subtract the length of the register and the padding from the maximum transmission. Signed-off-by: Jim Wylder Date: Wed May 10 13:28:11 2023 +0100 MAINTAINERS: Cleanup Arm Display IP maintainers Some people have moved to different roles and are no longer involved in the upstream development. As there is only one person left, remove the mailing list as well as it serves no purpose. Link: https://lkml.kernel.org/r/20230510122811.1872358-1-liviu.dudau@arm.com Signed-off-by: Liviu Dudau Acked-by: Brian Starkey Cc: Mihail Atanassov Cc: Greg Kroah-Hartman Cc: Joe Perches # "Please use --order" Cc: Mihail Atanassov Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit 158fb07ba6e77a21f46c3e9c5be44ebd8c4dd2cc Author: Lukas Bulwahn Date: Tue May 9 09:48:34 2023 +0200 MAINTAINERS: repair pattern in DIALOG SEMICONDUCTOR DRIVERS Commit 361104b05684c ("dt-bindings: mfd: Convert da9063 to yaml") converts da9063.txt to dlg,da9063.yaml and adds a new file pattern in MAINTAINERS. Unfortunately, the file pattern matches da90*.yaml, but the yaml file is prefixed with dlg,da90. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken file pattern. Repair this file pattern in DIALOG SEMICONDUCTOR DRIVERS. Link: https://lkml.kernel.org/r/20230509074834.21521-1-lukas.bulwahn@gmail.com Fixes: 361104b05684c ("dt-bindings: mfd: Convert da9063 to yaml") Signed-off-by: Lukas Bulwahn Acked-by: Conor Dooley Cc: Lee Jones Signed-off-by: Andrew Morton commit 9b5a04ac3ad9898c4745cba46ea26de74ba56a8e Author: Ryusuke Konishi Date: Wed May 10 00:29:56 2023 +0900 nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer(). Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached. Link: https://lkml.kernel.org/r/20230509152956.8313-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+78d4495558999f55d1da@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/00000000000099e5ac05fb1c3b85@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 04fc7816089c5a32c29a04ec94b998e219dfb946 Author: Domenico Cerasuolo Date: Wed May 3 17:12:00 2023 +0200 mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different page. The race unfolds like this: 1. a page with data A and swap offset X is stored in zswap 2. page A is removed off the LRU by zpool driver for writeback in zswap-shrink work, data for A is mapped by zpool driver 3. user space program faults and invalidates page entry A, offset X is considered free 4. kswapd stores page B at offset X in zswap (zswap could also be full, if so, page B would then be IOed to X, then skip step 5.) 5. entry A is replaced by B in tree->rbroot, this doesn't affect the local reference held by zswap-shrink work 6. zswap-shrink work writes back A at X, and frees zswap entry A 7. swapin of slot X brings A in memory instead of B The fix: Once the swap page cache has been allocated (case ZSWAP_SWAPCACHE_NEW), zswap-shrink work just checks that the local zswap_entry reference is still the same as the one in the tree. If it's not the same it means that it's either been invalidated or replaced, in both cases the writeback is aborted because the local entry contains stale data. Reproducer: I originally found this by running `stress` overnight to validate my work on the zswap writeback mechanism, it manifested after hours on my test machine. The key to make it happen is having zswap writebacks, so whatever setup pumps /sys/kernel/debug/zswap/written_back_pages should do the trick. In order to reproduce this faster on a vm, I setup a system with ~100M of available memory and a 500M swap file, then running `stress --vm 1 --vm-bytes 300000000 --vm-stride 4000` makes it happen in matter of tens of minutes. One can speed things up even more by swinging /sys/module/zswap/parameters/max_pool_percent up and down between, say, 20 and 1; this makes it reproduce in tens of seconds. It's crucial to set `--vm-stride` to something other than 4096 otherwise `stress` won't realize that memory has been corrupted because all pages would have the same data. Link: https://lkml.kernel.org/r/20230503151200.19707-1-cerasuolodomenico@gmail.com Signed-off-by: Domenico Cerasuolo Acked-by: Johannes Weiner Reviewed-by: Chris Li (Google) Cc: Dan Streetman Cc: Johannes Weiner Cc: Minchan Kim Cc: Nitin Gupta Cc: Seth Jennings Cc: Vitaly Wool Cc: Signed-off-by: Andrew Morton commit 7581495ac82d6cb073609284c7f7186a48021d1e Author: Michael Ellerman Date: Fri May 5 13:51:27 2023 +1000 mm: kfence: fix false positives on big endian Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()"), kfence reports failures in random places at boot on big endian machines. The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the address of each byte in its value, so it needs to be byte swapped on big endian machines. The compiler is smart enough to do the le64_to_cpu() at compile time, so there is no runtime overhead. Link: https://lkml.kernel.org/r/20230505035127.195387-1-mpe@ellerman.id.au Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()") Signed-off-by: Michael Ellerman Reviewed-by: Alexander Potapenko Reviewed-by: Marco Elver Cc: Peng Zhang Cc: David Laight Signed-off-by: Andrew Morton commit d461aac924b937bcb4fd0ca1242b3ef6868ecddd Author: Nhat Pham Date: Fri May 5 11:50:54 2023 -0700 zsmalloc: move LRU update from zs_map_object() to zs_malloc() Under memory pressure, we sometimes observe the following crash: [ 5694.832838] ------------[ cut here ]------------ [ 5694.842093] list_del corruption, ffff888014b6a448->next is LIST_POISON1 (dead000000000100) [ 5694.858677] WARNING: CPU: 33 PID: 418824 at lib/list_debug.c:47 __list_del_entry_valid+0x42/0x80 [ 5694.961820] CPU: 33 PID: 418824 Comm: fuse_counters.s Kdump: loaded Tainted: G S 5.19.0-0_fbk3_rc3_hoangnhatpzsdynshrv41_10870_g85a9558a25de #1 [ 5694.990194] Hardware name: Wiwynn Twin Lakes MP/Twin Lakes Passive MP, BIOS YMM16 05/24/2021 [ 5695.007072] RIP: 0010:__list_del_entry_valid+0x42/0x80 [ 5695.017351] Code: 08 48 83 c2 22 48 39 d0 74 24 48 8b 10 48 39 f2 75 2c 48 8b 51 08 b0 01 48 39 f2 75 34 c3 48 c7 c7 55 d7 78 82 e8 4e 45 3b 00 <0f> 0b eb 31 48 c7 c7 27 a8 70 82 e8 3e 45 3b 00 0f 0b eb 21 48 c7 [ 5695.054919] RSP: 0018:ffffc90027aef4f0 EFLAGS: 00010246 [ 5695.065366] RAX: 41fe484987275300 RBX: ffff888008988180 RCX: 0000000000000000 [ 5695.079636] RDX: ffff88886006c280 RSI: ffff888860060480 RDI: ffff888860060480 [ 5695.093904] RBP: 0000000000000002 R08: 0000000000000000 R09: ffffc90027aef370 [ 5695.108175] R10: 0000000000000000 R11: ffffffff82fdf1c0 R12: 0000000010000002 [ 5695.122447] R13: ffff888014b6a448 R14: ffff888014b6a420 R15: 00000000138dc240 [ 5695.136717] FS: 00007f23a7d3f740(0000) GS:ffff888860040000(0000) knlGS:0000000000000000 [ 5695.152899] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5695.164388] CR2: 0000560ceaab6ac0 CR3: 000000001c06c001 CR4: 00000000007706e0 [ 5695.178659] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5695.192927] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5695.207197] PKRU: 55555554 [ 5695.212602] Call Trace: [ 5695.217486] [ 5695.221674] zs_map_object+0x91/0x270 [ 5695.229000] zswap_frontswap_store+0x33d/0x870 [ 5695.237885] ? do_raw_spin_lock+0x5d/0xa0 [ 5695.245899] __frontswap_store+0x51/0xb0 [ 5695.253742] swap_writepage+0x3c/0x60 [ 5695.261063] shrink_page_list+0x738/0x1230 [ 5695.269255] shrink_lruvec+0x5ec/0xcd0 [ 5695.276749] ? shrink_slab+0x187/0x5f0 [ 5695.284240] ? mem_cgroup_iter+0x6e/0x120 [ 5695.292255] shrink_node+0x293/0x7b0 [ 5695.299402] do_try_to_free_pages+0xea/0x550 [ 5695.307940] try_to_free_pages+0x19a/0x490 [ 5695.316126] __folio_alloc+0x19ff/0x3e40 [ 5695.323971] ? __filemap_get_folio+0x8a/0x4e0 [ 5695.332681] ? walk_component+0x2a8/0xb50 [ 5695.340697] ? generic_permission+0xda/0x2a0 [ 5695.349231] ? __filemap_get_folio+0x8a/0x4e0 [ 5695.357940] ? walk_component+0x2a8/0xb50 [ 5695.365955] vma_alloc_folio+0x10e/0x570 [ 5695.373796] ? walk_component+0x52/0xb50 [ 5695.381634] wp_page_copy+0x38c/0xc10 [ 5695.388953] ? filename_lookup+0x378/0xbc0 [ 5695.397140] handle_mm_fault+0x87f/0x1800 [ 5695.405157] do_user_addr_fault+0x1bd/0x570 [ 5695.413520] exc_page_fault+0x5d/0x110 [ 5695.421017] asm_exc_page_fault+0x22/0x30 After some investigation, I have found the following issue: unlike other zswap backends, zsmalloc performs the LRU list update at the object mapping time, rather than when the slot for the object is allocated. This deviation was discussed and agreed upon during the review process of the zsmalloc writeback patch series: https://lore.kernel.org/lkml/Y3flcAXNxxrvy3ZH@cmpxchg.org/ Unfortunately, this introduces a subtle bug that occurs when there is a concurrent store and reclaim, which interleave as follows: zswap_frontswap_store() shrink_worker() zs_malloc() zs_zpool_shrink() spin_lock(&pool->lock) zs_reclaim_page() zspage = find_get_zspage() spin_unlock(&pool->lock) spin_lock(&pool->lock) zspage = list_first_entry(&pool->lru) list_del(&zspage->lru) zspage->lru.next = LIST_POISON1 zspage->lru.prev = LIST_POISON2 spin_unlock(&pool->lock) zs_map_object() spin_lock(&pool->lock) if (!list_empty(&zspage->lru)) list_del(&zspage->lru) CHECK_DATA_CORRUPTION(next == LIST_POISON1) /* BOOM */ With the current upstream code, this issue rarely happens. zswap only triggers writeback when the pool is already full, at which point all further store attempts are short-circuited. This creates an implicit pseudo-serialization between reclaim and store. I am working on a new zswap shrinking mechanism, which makes interleaving reclaim and store more likely, exposing this bug. zbud and z3fold do not have this problem, because they perform the LRU list update in the alloc function, while still holding the pool's lock. This patch fixes the aforementioned bug by moving the LRU update back to zs_malloc(), analogous to zbud and z3fold. Link: https://lkml.kernel.org/r/20230505185054.2417128-1-nphamcs@gmail.com Fixes: 64f768c6b32e ("zsmalloc: add a LRU to zs_pool to keep track of zspages in LRU order") Signed-off-by: Nhat Pham Suggested-by: Johannes Weiner Acked-by: Johannes Weiner Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Dan Streetman Cc: Nitin Gupta Cc: Seth Jennings Cc: Vitaly Wool Cc: Signed-off-by: Andrew Morton commit 26e239b37ebdfd189a2e6f94d3407e70313348bc Author: Joan Bruguera Micó Date: Wed May 3 01:32:32 2023 +0000 mm: shrinkers: fix race condition on debugfs cleanup When something registers and unregisters many shrinkers, such as: for x in $(seq 10000); do unshare -Ui true; done Sometimes the following error is printed to the kernel log: debugfs: Directory '...' with parent 'shrinker' already present! This occurs since commit badc28d4924b ("mm: shrinkers: fix deadlock in shrinker debugfs") / v6.2: Since the call to `debugfs_remove_recursive` was moved outside the `shrinker_rwsem`/`shrinker_mutex` lock, but the call to `ida_free` stayed inside, a newly registered shrinker can be re-assigned that ID and attempt to create the debugfs directory before the directory from the previous shrinker has been removed. The locking changes in commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless") made the race condition more likely, though it existed before then. Commit badc28d4924b ("mm: shrinkers: fix deadlock in shrinker debugfs") could be reverted since the issue is addressed should no longer occur since the count and scan operations are lockless since commit 20cd1892fcc3 ("mm: shrinkers: make count and scan in shrinker debugfs lockless"). However, since this is a contended lock, prefer instead moving `ida_free` outside the lock to avoid the race. Link: https://lkml.kernel.org/r/20230503013232.299211-1-joanbrugueram@gmail.com Fixes: badc28d4924b ("mm: shrinkers: fix deadlock in shrinker debugfs") Signed-off-by: Joan Bruguera Micó Cc: Qi Zheng Cc: Roman Gushchin Signed-off-by: Andrew Morton commit 0257d9908d38c0b1669af4bb1bc4dbca1f273fe6 Author: Peng Zhang Date: Fri May 5 22:58:29 2023 +0800 maple_tree: make maple state reusable after mas_empty_area() Make mas->min and mas->max point to a node range instead of a leaf entry range. This allows mas to still be usable after mas_empty_area() returns. Users would get unexpected results from other operations on the maple state after calling the affected function. For example, x86 MAP_32BIT mmap() acts as if there is no suitable gap when there should be one. Link: https://lkml.kernel.org/r/20230505145829.74574-1-zhangpeng.00@bytedance.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang Reported-by: "Edgecombe, Rick P" Reported-by: Tad Reported-by: Michael Keyes Link: https://lore.kernel.org/linux-mm/32f156ba80010fd97dbaf0a0cdfc84366608624d.camel@intel.com/ Link: https://lore.kernel.org/linux-mm/e6108286ac025c268964a7ead3aab9899f9bc6e9.camel@spotco.us/ Reviewed-by: Liam R. Howlett Tested-by: Rick Edgecombe Cc: Signed-off-by: Andrew Morton commit 571a2a50a8fc546145ffd3bf673547e9fe128ed2 Author: Ze Gao Date: Wed May 17 11:45:09 2023 +0800 rethook, fprobe: do not trace rethook related functions These functions are already marked as NOKPROBE to prevent recursion and we have the same reason to blacklist them if rethook is used with fprobe, since they are beyond the recursion-free region ftrace can guard. Link: https://lore.kernel.org/all/20230517034510.15639-5-zegao@tencent.com/ Fixes: f3a112c0c40d ("x86,rethook,kprobes: Replace kretprobe with rethook on x86") Signed-off-by: Ze Gao Reviewed-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit 2752741080f84f9b2fc93fa92735315d10a415bf Author: Ze Gao Date: Wed May 17 11:45:08 2023 +0800 fprobe: add recursion detection in fprobe_exit_handler fprobe_hander and fprobe_kprobe_handler has guarded ftrace recursion detection but fprobe_exit_handler has not, which possibly introduce recursive calls if the fprobe exit callback calls any traceable functions. Checking in fprobe_hander or fprobe_kprobe_handler is not enough and misses this case. So add recursion free guard the same way as fprobe_hander. Since ftrace recursion check does not employ ip(s), so here use entry_ip and entry_parent_ip the same as fprobe_handler. Link: https://lore.kernel.org/all/20230517034510.15639-4-zegao@tencent.com/ Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support") Signed-off-by: Ze Gao Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 3cc4e2c5fbae84e5033723fb7e350bc6c164e3a2 Author: Ze Gao Date: Wed May 17 11:45:07 2023 +0800 fprobe: make fprobe_kprobe_handler recursion free Current implementation calls kprobe related functions before doing ftrace recursion check in fprobe_kprobe_handler, which opens door to kernel crash due to stack recursion if preempt_count_{add, sub} is traceable in kprobe_busy_{begin, end}. Things goes like this without this patch quoted from Steven: " fprobe_kprobe_handler() { kprobe_busy_begin() { preempt_disable() { preempt_count_add() { <-- trace fprobe_kprobe_handler() { [ wash, rinse, repeat, CRASH!!! ] " By refactoring the common part out of fprobe_kprobe_handler and fprobe_handler and call ftrace recursion detection at the very beginning, the whole fprobe_kprobe_handler is free from recursion. [ Fix the indentation of __fprobe_handler() parameters. ] Link: https://lore.kernel.org/all/20230517034510.15639-3-zegao@tencent.com/ Fixes: ab51e15d535e ("fprobe: Introduce FPROBE_FL_KPROBE_SHARED flag for fprobe") Signed-off-by: Ze Gao Acked-by: Masami Hiramatsu (Google) Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit be243bacfb25f5219f2396d787408e8cf1301dd1 Author: Ze Gao Date: Wed May 17 11:45:06 2023 +0800 rethook: use preempt_{disable, enable}_notrace in rethook_trampoline_handler This patch replaces preempt_{disable, enable} with its corresponding notrace version in rethook_trampoline_handler so no worries about stack recursion or overflow introduced by preempt_count_{add, sub} under fprobe + rethook context. Link: https://lore.kernel.org/all/20230517034510.15639-2-zegao@tencent.com/ Fixes: 54ecbe6f1ed5 ("rethook: Add a generic return hook") Signed-off-by: Ze Gao Acked-by: Masami Hiramatsu (Google) Cc: Signed-off-by: Masami Hiramatsu (Google) commit 56518a603fd2bf74762d176ac980572db84a3e14 Author: Yangyang Li Date: Fri May 12 17:22:45 2023 +0800 RDMA/hns: Modify the value of long message loopback slice Long message loopback slice is used for achieving traffic balance between QPs. It prevents the problem that QPs with large traffic occupying the hardware pipeline for a long time and QPs with small traffic cannot be scheduled. Currently, its maximum value is set to 16K, which means only after a QP sends 16K will the second QP be scheduled. This value is too large, which will lead to unbalanced traffic scheduling, and thus it needs to be modified. The setting range of the long message loopback slice is modified to be from 1024 (the lower limit supported by hardware) to mtu. Actual testing shows that this value can significantly reduce error in hardware traffic scheduling. This solution is compatible with both HIP08 and HIP09. The modified lp_pktn_ini has a maximum value of 2 (when mtu is 256), so the range checking code for lp_pktn_ini is no longer necessary and needs to be deleted. Fixes: 0e60778efb07 ("RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility") Link: https://lore.kernel.org/r/20230512092245.344442-4-huangjunxian6@hisilicon.com Signed-off-by: Yangyang Li Signed-off-by: Junxian Huang Signed-off-by: Jason Gunthorpe commit 7f3969b14f356dd65fa95b3528eb05c32e68bc06 Author: Chengchang Tang Date: Fri May 12 17:22:44 2023 +0800 RDMA/hns: Fix base address table allocation For hns, the specification of an entry like resource (E.g. WQE/CQE/EQE) depends on BT page size, buf page size and hopnum. For user mode, the buf page size depends on UMEM. Therefore, the actual specification is controlled by BT page size and hopnum. The current BT page size and hopnum are obtained from firmware. This makes the driver inflexible and introduces unnecessary constraints. Resource allocation failures occur in many scenarios. This patch will calculate whether the BT page size set by firmware is sufficient before allocating BT, and increase the BT page size if it is insufficient. Fixes: 1133401412a9 ("RDMA/hns: Optimize base address table config flow for qp buffer") Link: https://lore.kernel.org/r/20230512092245.344442-3-huangjunxian6@hisilicon.com Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Signed-off-by: Jason Gunthorpe commit 58caa2a51ad4fd21763696cc6c4defc9fc1b4b4f Author: Chengchang Tang Date: Fri May 12 17:22:43 2023 +0800 RDMA/hns: Fix timeout attr in query qp for HIP08 On HIP08, the queried timeout attr is different from the timeout attr configured by the user. It is found by rdma-core testcase test_rdmacm_async_traffic: ====================================================================== FAIL: test_rdmacm_async_traffic (tests.test_rdmacm.CMTestCase) ---------------------------------------------------------------------- Traceback (most recent call last): File "./tests/test_rdmacm.py", line 33, in test_rdmacm_async_traffic self.two_nodes_rdmacm_traffic(CMAsyncConnection, self.rdmacm_traffic, File "./tests/base.py", line 382, in two_nodes_rdmacm_traffic raise(res) AssertionError Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") Link: https://lore.kernel.org/r/20230512092245.344442-2-huangjunxian6@hisilicon.com Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Signed-off-by: Jason Gunthorpe commit 36a6418bb125944838b91a33eddca4064a5eb610 Author: Marc Kleine-Budde Date: Wed May 17 20:02:51 2023 +0200 Revert "ARM: dts: stm32: add CAN support on stm32f746" This reverts commit 0920ccdf41e3078a4dd2567eb905ea154bc826e6. The commit 0920ccdf41e3 ("ARM: dts: stm32: add CAN support on stm32f746") depends on the patch "dt-bindings: mfd: stm32f7: add binding definition for CAN3" [1], which is not in net/main, yet. This results in a parsing error of "stm32f746.dtsi". So revert this commit. [1] https://lore.kernel.org/all/20230423172528.1398158-2-dario.binacchi@amarulasolutions.com Cc: Dario Binacchi Cc: Alexandre TORGUE Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202305172108.x5acbaQG-lkp@intel.com Closes: https://lore.kernel.org/oe-kbuild-all/202305172130.eGGEUhpi-lkp@intel.com Fixes: 0920ccdf41e3 ("ARM: dts: stm32: add CAN support on stm32f746") Suggested-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20230517181950.1106697-1-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 4d6d4c7f541d7027beed4fb86eb2c451bd8d6fff Merge: 1b66c114d161a dbcf76390eb9a Author: Linus Torvalds Date: Wed May 17 11:16:36 2023 -0700 Merge tag 'linux-kselftest-fixes-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: - sgx test fix for false negatives - ftrace output is hard to parses and it masks inappropriate skips etc. This fix addresses the problems by integrating with kselftest runner * tag 'linux-kselftest-fixes-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/ftrace: Improve integration with kselftest runner selftests/sgx: Add "test_encl.elf" to TEST_FILES commit 39428f6ea9eace95011681628717062ff7f5eb5f Merge: f1fcbaa18b28d c3a62df457ff9 Author: Paolo Bonzini Date: Wed May 17 13:35:31 2023 -0400 Merge tag 'kvmarm-fixes-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.4, take #1 - Plug a race in the stage-2 mapping code where the IPA and the PA would end up being out of sync - Make better use of the bitmap API (bitmap_zero, bitmap_zalloc...) - FP/SVE/SME documentation update, in the hope that this field becomes clearer... - Add workaround for the usual Apple SEIS brokenness - Random comment fixes commit 59a556aebc43dded08535fe97d94ca3f657915e4 Author: Bharath SM Date: Mon May 15 21:25:12 2023 +0000 SMB3: drop reference to cfile before sending oplock break In cifs_oplock_break function we drop reference to a cfile at the end of function, due to which close command goes on wire after lease break acknowledgment even if file is already closed by application but we had deferred the handle close. If other client with limited file shareaccess waiting on lease break ack proceeds operation on that file as soon as first client sends ack, then we may encounter status sharing violation error because of open handle. Solution is to put reference to cfile(send close on wire if last ref) and then send oplock acknowledgment to server. Fixes: 9e31678fb403 ("SMB3: fix lease break timeout when multiple deferred close handles for the same file.") Cc: stable@kernel.org Signed-off-by: Bharath SM Reviewed-by: Shyam Prasad N Signed-off-by: Steve French commit 47592fa8eb03742048b096b4696ec133384c45eb Author: Bharath SM Date: Wed May 3 14:38:35 2023 +0000 SMB3: Close all deferred handles of inode in case of handle lease break Oplock break may occur for different file handle than the deferred handle. Check for inode deferred closes list, if it's not empty then close all the deferred handles of inode because we should not cache handles if we dont have handle lease. Eg: If openfilelist has one deferred file handle and another open file handle from app for a same file, then on a lease break we choose the first handle in openfile list. The first handle in list can be deferred handle or actual open file handle from app. In case if it is actual open handle then today, we don't close deferred handles if we lose handle lease on a file. Problem with this is, later if app decides to close the existing open handle then we still be caching deferred handles until deferred close timeout. Leaving open handle may result in sharing violation when windows client tries to open a file with limited file share access. So we should check for deferred list of inode and walk through the list of deferred files in inode and close all deferred files. Fixes: 9e31678fb403 ("SMB3: fix lease break timeout when multiple deferred close handles for the same file.") Cc: stable@kernel.org Signed-off-by: Bharath SM Signed-off-by: Steve French commit 1b66c114d161a457897d269420c74620c032135c Merge: cba582631ee40 21a3f3328972b Author: Linus Torvalds Date: Wed May 17 09:56:01 2023 -0700 Merge tag 'nfsd-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - A collection of minor bug fixes * tag 'nfsd-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: Remove open coding of string copy SUNRPC: Fix trace_svc_register() call site SUNRPC: always free ctxt when freeing deferred request SUNRPC: double free xprt_ctxt while still in use SUNRPC: Fix error handling in svc_setup_socket() SUNRPC: Fix encoding of accepted but unsuccessful RPC replies lockd: define nlm_port_min,max with CONFIG_SYSCTL nfsd: define exports_proc_ops with CONFIG_PROC_FS SUNRPC: Avoid relying on crypto API to derive CBC-CTS output IV commit cba582631ee40772c6dbe24e945b9173572dfca0 Merge: a18ef64fe1e45 e7d3e5c4b1dd5 Author: Linus Torvalds Date: Wed May 17 09:49:21 2023 -0700 Merge tag 'tpmdd-v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "Three bug fixes for recently discovered issues" * tag 'tpmdd-v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm/tpm_tis: Disable interrupts for more Lenovo devices tpm: Prevent hwrng from activating during resume tpm_tis: Use tpm_chip_{start,stop} decoration inside tpm_tis_resume commit d5aa417808cf14c052ca042920b3c6b9f1dc6aa4 Author: Alex Deucher Date: Mon Apr 10 12:02:29 2023 -0400 drm/amdgpu/gfx11: update gpu_clock_counter logic This code was written prior to previous updates to this logic for other chips. The RSC registers are part of SMUIO which is an always on block so there is no need to disable gfxoff. Additionally add the carryover and preemption checks. v2: rebase Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.y: 5591a051b86b: drm/amdgpu: refine get gpu clock counter method Cc: stable@vger.kernel.org # 6.2.y: 5591a051b86b: drm/amdgpu: refine get gpu clock counter method Cc: stable@vger.kernel.org # 6.3.y: 5591a051b86b: drm/amdgpu: refine get gpu clock counter method commit a18ef64fe1e4558b14a6e0ca9fbe8264475b7013 Author: Arnd Bergmann Date: Wed May 17 14:47:12 2023 +0200 tracing: make ftrace_likely_update() declaration visible This function is only used when CONFIG_TRACE_BRANCH_PROFILING is set and DISABLE_BRANCH_PROFILING is not set, and the declaration is hidden behind this combination of tests. But that causes a warning when building with CONFIG_TRACING_BRANCHES, since that sets DISABLE_BRANCH_PROFILING for the tracing code, and the declaration is thus hidden: kernel/trace/trace_branch.c:205:6: error: no previous prototype for 'ftrace_likely_update' [-Werror=missing-prototypes] Move the declaration out of the #ifdef to avoid the warning. Signed-off-by: Arnd Bergmann Signed-off-by: Linus Torvalds commit ce0b15d11ad837fbacc5356941712218e38a0a83 Author: Dave Hansen Date: Tue May 16 12:24:25 2023 -0700 x86/mm: Avoid incomplete Global INVLPG flushes The INVLPG instruction is used to invalidate TLB entries for a specified virtual address. When PCIDs are enabled, INVLPG is supposed to invalidate TLB entries for the specified address for both the current PCID *and* Global entries. (Note: Only kernel mappings set Global=1.) Unfortunately, some INVLPG implementations can leave Global translations unflushed when PCIDs are enabled. As a workaround, never enable PCIDs on affected processors. I expect there to eventually be microcode mitigations to replace this software workaround. However, the exact version numbers where that will happen are not known today. Once the version numbers are set in stone, the processor list can be tweaked to only disable PCIDs on affected processors with affected microcode. Note: if anyone wants a quick fix that doesn't require patching, just stick 'nopcid' on your kernel command-line. Signed-off-by: Dave Hansen Reviewed-by: Thomas Gleixner Cc: stable@vger.kernel.org commit 5c054db54c43a5fcb5cc81012361f5e3fac37637 Author: Rob Clark Date: Tue May 16 15:20:37 2023 -0700 drm/msm: Be more shouty if per-process pgtables aren't working Otherwise it is not always obvious if a dt or iommu change is causing us to fall back to global pgtable. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/537359/ Link: https://lore.kernel.org/r/20230516222039.907690-2-robdclark@gmail.com commit e36ca2fad6bb4ef0603bdb5556578e9082fe0056 Author: Rob Clark Date: Tue May 16 15:20:36 2023 -0700 iommu/arm-smmu-qcom: Fix missing adreno_smmu's When the special handling of qcom,adreno-smmu was moved into qcom_smmu_create(), it was overlooked that we didn't have all the required entries in qcom_smmu_impl_of_match. So we stopped getting adreno_smmu_priv on sc7180, breaking per-process pgtables. Fixes: 30b912a03d91 ("iommu/arm-smmu-qcom: Move the qcom,adreno-smmu check into qcom_smmu_create") Cc: Suggested-by: Lepton Wu Signed-off-by: Rob Clark Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/537357/ Link: https://lore.kernel.org/r/20230516222039.907690-1-robdclark@gmail.com commit dc4f2ccaedddb489a83e7b12ebbdc347272aacc9 Author: Nikhil Mahale Date: Wed May 17 14:37:36 2023 +0530 ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table These IDs are for AD102, AD103, AD104, AD106, and AD107 gpus with audio functions that are largely similar to the existing ones. Tested audio using gnome-settings, over HDMI, DP-SST and DP-MST connections on AD106 gpu. Signed-off-by: Nikhil Mahale Cc: Link: https://lore.kernel.org/r/20230517090736.15088-1-nmahale@nvidia.com Signed-off-by: Takashi Iwai commit 040b5a046a9e18098580d3ccd029e2318fca7859 Author: Arnd Bergmann Date: Tue May 16 21:50:42 2023 +0200 ALSA: oss: avoid missing-prototype warnings Two functions are defined and used in pcm_oss.c but also optionally used from io.c, with an optional prototype. If CONFIG_SND_PCM_OSS_PLUGINS is disabled, this causes a warning as the functions are not static and have no prototype: sound/core/oss/pcm_oss.c:1235:19: error: no previous prototype for 'snd_pcm_oss_write3' [-Werror=missing-prototypes] sound/core/oss/pcm_oss.c:1266:19: error: no previous prototype for 'snd_pcm_oss_read3' [-Werror=missing-prototypes] Avoid this by making the prototypes unconditional. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230516195046.550584-2-arnd@kernel.org Signed-off-by: Takashi Iwai commit ccecefa4f89971e34745abbffdaf4d2c3fb2f457 Author: Arnd Bergmann Date: Tue May 16 21:50:41 2023 +0200 ALSA: cs46xx: mark snd_cs46xx_download_image as static snd_cs46xx_download_image() was originally called from dsp_spos.c, but is now local to cs46xx_lib.c. Mark it as 'static' to avoid a warning about it lacking a declaration, and '__maybe_unused' to avoid a warning about it being unused when CONFIG_SND_CS46XX_NEW_DSP is disabled: sound/pci/cs46xx/cs46xx_lib.c:534:5: error: no previous prototype for 'snd_cs46xx_download_image' Fixes: 89f157d9e6bf ("[ALSA] cs46xx - Fix PM resume") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230516195046.550584-1-arnd@kernel.org Signed-off-by: Takashi Iwai commit 1b5f159ce8751b61aea426293cd71a510a081939 Author: Arnaldo Carvalho de Melo Date: Wed May 17 11:47:38 2023 -0300 tools headers disabled-features: Sync with the kernel sources To pick the changes from: e0bddc19ba9578bc ("x86/mm: Reduce untagged_addr() overhead for systems without LAM") This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/disabled-features.h' differs from latest version at 'arch/x86/include/asm/disabled-features.h' diff -u tools/arch/x86/include/asm/disabled-features.h arch/x86/include/asm/disabled-features.h Cc: Adrian Hunter Cc: Dave Hansen Cc: Ian Rogers Cc: Jiri Olsa Cc: Kirill A. Shutemov Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZGTpdlzrlRjjnY6K@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2eb94dd56a4a4e3fe286def3e2ba207804a37345 Author: Maurizio Lombardi Date: Thu May 11 13:07:41 2023 +0200 nvme: do not let the user delete a ctrl before a complete initialization If a userspace application performes a "delete_controller" command early during the ctrl initialization, the delete operation may race against the init code and the kernel will crash. nvme nvme5: Connect command failed: host path error nvme nvme5: failed to connect queue: 0 ret=880 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page blk_mq_quiesce_queue+0x18/0x90 nvme_tcp_delete_ctrl+0x24/0x40 [nvme_tcp] nvme_do_delete_ctrl+0x7f/0x8b [nvme_core] nvme_sysfs_delete.cold+0x8/0xd [nvme_core] kernfs_fop_write_iter+0x124/0x1b0 new_sync_write+0xff/0x190 vfs_write+0x1ef/0x280 Fix the crash by checking the NVME_CTRL_STARTED_ONCE bit; if it's not set it means that the nvme controller is still in the process of getting initialized and the kernel will return an -EBUSY error to userspace. Set the NVME_CTRL_STARTED_ONCE later in the nvme_start_ctrl() function, after the controller start operation is completed. Signed-off-by: Maurizio Lombardi Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 1743e5f6000901a11f4e1cd741bfa9136f3ec9b1 Author: Christoph Hellwig Date: Wed May 17 09:53:45 2023 +0200 nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk nvme_mpath_remove_disk is called after del_gendisk, at which point a blk_mark_disk_dead call doesn't make any sense. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch commit 29719e319869c6b3f09e6e92310b019e32943696 Author: Arnaldo Carvalho de Melo Date: Wed May 17 11:15:53 2023 -0300 tools headers UAPI: Sync arch prctl headers with the kernel sources To pick the changes in this cset: a03c376ebaf38394 ("x86/arch_prctl: Add AMX feature numbers as ABI constants") 23e5d9ec2bab53c4 ("x86/mm/iommu/sva: Make LAM and SVA mutually exclusive") 2f8794bd087e7958 ("x86/mm: Provide arch_prctl() interface for LAM") This picks these new prctls in a third range, that was also added to the tools/perf/trace/beauty/arch_prctl.c beautifier. $ tools/perf/trace/beauty/x86_arch_prctl.sh > /tmp/before $ cp arch/x86/include/uapi/asm/prctl.h tools/arch/x86/include/uapi/asm/prctl.h $ tools/perf/trace/beauty/x86_arch_prctl.sh > /tmp/after $ diff -u /tmp/before /tmp/after @@ -20,3 +20,11 @@ [0x2003 - 0x2001]= "MAP_VDSO_64", }; +#define x86_arch_prctl_codes_3_offset 0x4001 +static const char *x86_arch_prctl_codes_3[] = { + [0x4001 - 0x4001]= "GET_UNTAG_MASK", + [0x4002 - 0x4001]= "ENABLE_TAGGED_ADDR", + [0x4003 - 0x4001]= "GET_MAX_TAG_BITS", + [0x4004 - 0x4001]= "FORCE_TAGGED_SVA", +}; + $ With this 'perf trace' can translate those numbers into strings and use the strings in filter expressions: # perf trace -e prctl 0.000 ( 0.011 ms): DOM Worker/3722622 prctl(option: SET_NAME, arg2: 0x7f9c014b7df5) = 0 0.032 ( 0.002 ms): DOM Worker/3722622 prctl(option: SET_NAME, arg2: 0x7f9bb6b51580) = 0 5.452 ( 0.003 ms): StreamT~ns #30/3722623 prctl(option: SET_NAME, arg2: 0x7f9bdbdfeb70) = 0 5.468 ( 0.002 ms): StreamT~ns #30/3722623 prctl(option: SET_NAME, arg2: 0x7f9bdbdfea70) = 0 24.494 ( 0.009 ms): IndexedDB #556/3722624 prctl(option: SET_NAME, arg2: 0x7f562a32ae28) = 0 24.540 ( 0.002 ms): IndexedDB #556/3722624 prctl(option: SET_NAME, arg2: 0x7f563c6d4b30) = 0 670.281 ( 0.008 ms): systemd-userwo/3722339 prctl(option: SET_NAME, arg2: 0x564be30805c8) = 0 670.293 ( 0.002 ms): systemd-userwo/3722339 prctl(option: SET_NAME, arg2: 0x564be30800f0) = 0 ^C# This addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/prctl.h' differs from latest version at 'arch/x86/include/uapi/asm/prctl.h' diff -u tools/arch/x86/include/uapi/asm/prctl.h arch/x86/include/uapi/asm/prctl.h Cc: Adrian Hunter Cc: Chang S. Bae Cc: Dave Hansen Cc: Ian Rogers Cc: Jiri Olsa Cc: Kirill A. Shutemov Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZGTjNPpD3FOWfetM@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7f02ce62a6cfc0feb164bb7eb36c6647c00b43c8 Author: Arnaldo Carvalho de Melo Date: Wed May 17 10:34:59 2023 -0300 tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench' This is to get the changes from: 68674f94ffc9dddc ("x86: don't use REP_GOOD or ERMS for small memory copies") 20f3337d350c4e1b ("x86: don't use REP_GOOD or ERMS for small memory clearing") This also make the 'perf bench mem' files stop referring to the erms versions that gone away with the above patches. That addresses these perf tools build warning: Warning: Kernel ABI header at 'tools/arch/x86/lib/memcpy_64.S' differs from latest version at 'arch/x86/lib/memcpy_64.S' diff -u tools/arch/x86/lib/memcpy_64.S arch/x86/lib/memcpy_64.S Warning: Kernel ABI header at 'tools/arch/x86/lib/memset_64.S' differs from latest version at 'arch/x86/lib/memset_64.S' diff -u tools/arch/x86/lib/memset_64.S arch/x86/lib/memset_64.S Signed-off-by: Arnaldo Carvalho de Melo commit 9bc83d6e3824f09cef73b01256962d950965ddc4 Author: Arnaldo Carvalho de Melo Date: Wed May 17 10:10:57 2023 -0300 tools headers x86 cpufeatures: Sync with the kernel sources To pick the changes from: 3d8f61bf8bcd69bc ("x86: KVM: Add common feature flag for AMD's PSFD") 3763bf58029f3459 ("x86/cpufeatures: Redefine synthetic virtual NMI bit as AMD's "real" vNMI") 6449dcb0cac73821 ("x86: CPUID and CR3/CR4 flags for Linear Address Masking") be8de49bea505e77 ("x86/speculation: Identify processors vulnerable to SMT RSB predictions") e7862eda309ecfcc ("x86/cpu: Support AMD Automatic IBRS") faabfcb194a8d068 ("x86/cpu, kvm: Add the SMM_CTL MSR not present feature") 5b909d4ae59aedc7 ("x86/cpu, kvm: Add the Null Selector Clears Base feature") 84168ae786f8a15a ("x86/cpu, kvm: Move X86_FEATURE_LFENCE_RDTSC to its native leaf") a9dc9ec5a1fafc3d ("x86/cpu, kvm: Add the NO_NESTED_DATA_BP feature") f8df91e73a6827a4 ("x86/cpufeatures: Add macros for Intel's new fast rep string features") 78335aac6156eada ("x86/cpufeatures: Add Bandwidth Monitoring Event Configuration feature flag") f334f723a63cfc25 ("x86/cpufeatures: Add Slow Memory Bandwidth Allocation feature flag") a018d2e3d4b1abc4 ("x86/cpufeatures: Add Architectural PerfMon Extension bit") This causes these perf files to be rebuilt and brings some X86_FEATURE that will be used when updating the copies of tools/arch/x86/lib/mem{cpy,set}_64.S with the kernel sources: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Borislav Petkov (AMD) Cc: Kim Phillips Cc: Jim Mattson Cc: Babu Moger Cc: Ingo Molnar Cc: Kan Liang Cc: Sean Christopherson Cc: Dave Hansen Cc: Kirill A. Shutemov Cc: Paolo Bonzini Cc: Tom Lendacky Link: https://lore.kernel.org/lkml/ZGTTw642q8mWgv2Y@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 48524463f807ec516a291bdf717dcf2c8e059f51 Author: Namjae Jeon Date: Wed May 17 16:07:39 2023 +0900 ntfs: Add myself as a reviewer I'm volunteering to help review patches for current unmaintained ntfs filesytem. Signed-off-by: Namjae Jeon Acked-by: Bagas Sanjaya Message-Id: <20230517070739.6505-1-linkinjeon@kernel.org> Signed-off-by: Christian Brauner commit 3a7bb21b6f49b4d1695d4ba8ff31e9619cbcebe3 Author: Jeff Layton Date: Tue May 16 08:46:54 2023 -0400 fs: don't call posix_acl_listxattr in generic_listxattr Commit f2620f166e2a caused the kernel to start emitting POSIX ACL xattrs for NFSv4 inodes, which it doesn't support. The only other user of generic_listxattr is HFS (classic) and it doesn't support POSIX ACLs either. Fixes: f2620f166e2a xattr: simplify listxattr helpers Reported-by: Ondrej Valousek Signed-off-by: Jeff Layton Message-Id: <20230516124655.82283-1-jlayton@kernel.org> Signed-off-by: Christian Brauner commit f15afbd34d8fadbd375f1212e97837e32bc170cc Author: Hao Ge Date: Mon Apr 24 13:18:35 2023 +0800 fs: fix undefined behavior in bit shift for SB_NOUSER Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. It was spotted by UBSAN. So let's just fix this by using the BIT() helper for all SB_* flags. Fixes: e462ec50cb5f ("VFS: Differentiate mount flags (MS_*) from internal superblock flags") Signed-off-by: Hao Ge Message-Id: <20230424051835.374204-1-gehao@kylinos.cn> [brauner@kernel.org: use BIT() for all SB_* flags] Signed-off-by: Christian Brauner commit 0f1cbf941d5949110adf70725a9614e622de8d99 Author: Jason Gunthorpe Date: Mon May 1 14:11:28 2023 -0300 s390/iommu: get rid of S390_CCW_IOMMU and S390_AP_IOMMU These don't do anything anymore, the only user of the symbol was VFIO_CCW/AP which already "depends on VFIO" and VFIO itself selects IOMMU_API. When this was added VFIO was wrongly doing "depends on IOMMU_API" which required some contortions like this to ensure IOMMU_API was turned on. Reviewed-by: Eric Farman Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/0-v2-eb322ce2e547+188f-rm_iommu_ccw_jgg@nvidia.com Signed-off-by: Alexander Gordeev commit e534167cee150d900bf800ddb9bf1514d966635f Author: Lukas Bulwahn Date: Mon May 8 06:09:16 2023 +0200 s390/Kconfig: remove obsolete configs SCHED_{BOOK,DRAWER} Commit f1045056c726 ("topology/sysfs: rework book and drawer topology ifdefery") activates the book and drawer topology, previously activated by CONFIG_SCHED_{BOOK,DRAWER}, dependent on the existence of certain macro definitions. Hence, since then, CONFIG_SCHED_{BOOK,DRAWER} have no effect and any further purpose. Remove the obsolete configs SCHED_{BOOK,DRAWER}. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20230508040916.16733-1-lukas.bulwahn@gmail.com Signed-off-by: Alexander Gordeev commit 6d9406f80cd82964c8ed75d482d885f18921e0b8 Author: Ilya Leoshkevich Date: Thu May 4 16:40:21 2023 +0200 s390/uapi: cover statfs padding by growing f_spare pahole says: struct compat_statfs64 { ... u32 f_spare[4]; /* 68 16 */ /* size: 88, cachelines: 1, members: 12 */ /* padding: 4 */ struct statfs { ... unsigned int f_spare[4]; /* 68 16 */ /* size: 88, cachelines: 1, members: 12 */ /* padding: 4 */ struct statfs64 { ... unsigned int f_spare[4]; /* 68 16 */ /* size: 88, cachelines: 1, members: 12 */ /* padding: 4 */ One has to keep the existence of padding in mind when working with these structs. Grow f_spare arrays to 5 in order to simplify things. Acked-by: Heiko Carstens Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20230504144021.808932-3-iii@linux.ibm.com Signed-off-by: Alexander Gordeev commit ed40866ec7d328b3dfb70db7e2011640a16202c3 Author: Ilya Leoshkevich Date: Thu May 4 16:40:20 2023 +0200 statfs: enforce statfs[64] structure initialization s390's struct statfs and struct statfs64 contain padding, which field-by-field copying does not set. Initialize the respective structs with zeros before filling them and copying them to userspace, like it's already done for the compat versions of these structs. Found by KMSAN. [agordeev@linux.ibm.com: fixed typo in patch description] Acked-by: Heiko Carstens Cc: stable@vger.kernel.org # v4.14+ Signed-off-by: Ilya Leoshkevich Reviewed-by: Andrew Morton Link: https://lore.kernel.org/r/20230504144021.808932-2-iii@linux.ibm.com Signed-off-by: Alexander Gordeev commit 2862a2fdfae875888e3c1c3634e3422e01d98147 Author: Heiko Carstens Date: Thu May 11 17:04:41 2023 +0200 s390/qdio: fix do_sqbs() inline assembly constraint Use "a" constraint instead of "d" constraint to pass the state parameter to the do_sqbs() inline assembly. This prevents that general purpose register zero is used for the state parameter. If the compiler would select general purpose register zero this would be problematic for the used instruction in rsy format: the register used for the state parameter is a base register. If the base register is general purpose register zero the contents of the register are unexpectedly ignored when the instruction is executed. This only applies to z/VM guests using QIOASSIST with dedicated (pass through) QDIO-based devices such as FCP [zfcp driver] as well as real OSA or HiperSockets [qeth driver]. A possible symptom for this case using zfcp is the following repeating kernel message pattern: zfcp : A QDIO problem occurred zfcp : A QDIO problem occurred zfcp : qdio: ZFCP on SC using AI:1 QEBSM:1 PRI:1 TDD:1 SIGA: W zfcp : A QDIO problem occurred zfcp : A QDIO problem occurred Each of the qdio problem message can be accompanied by the following entries for the affected subchannel in /sys/kernel/debug/s390dbf/qdio_error/hex_ascii for zfcp or qeth: ccq: 69.... SQBS ERROR. Reviewed-by: Benjamin Block Cc: Steffen Maier Fixes: 8129ee164267 ("[PATCH] s390: qdio V=V pass-through") Cc: Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 1e94be78ec1556e90056ac038b15231723d315a9 Merge: fe82f16aafdaf c4af8e3fecd03 Author: Greg Kroah-Hartman Date: Wed May 17 14:49:36 2023 +0200 Merge tag 'thunderbolt-for-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fix for v6.4-rc3 This includes a single fix that fixes an error when resuming from hibernation if the driver is built into the kernel. This has been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Clear registers properly when auto clear isn't in use commit 61ae320a29b0540c16931816299eb86bf2b66c08 Author: Florian Westphal Date: Thu May 11 22:39:30 2023 +0200 netfilter: nft_set_rbtree: fix null deref on element insertion There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem(): general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] nft_add_set_elem+0x14b0/0x2990 nf_tables_newsetelem+0x528/0xb30 Furthermore, there is a possible use-after-free while iterating, 'node' can be free'd so we need to cache the next value to use. Fixes: c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection") Signed-off-by: Florian Westphal commit e3c361b8acd636f5fe80c02849ca175201edf10c Author: Florian Westphal Date: Thu May 11 14:15:15 2023 +0200 netfilter: nf_tables: fix nft_trans type confusion nft_trans_FOO objects all share a common nft_trans base structure, but trailing fields depend on the real object size. Access is only safe after trans->msg_type check. Check for rule type first. Found by code inspection. Fixes: 1a94e38d254b ("netfilter: nf_tables: add NFTA_RULE_ID attribute") Signed-off-by: Florian Westphal commit 224a876e37543eee111bf9b6aa4935080e619335 Author: Tom Rix Date: Sun May 14 10:00:10 2023 -0400 netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT gcc with W=1 and ! CONFIG_NF_NAT net/netfilter/nf_conntrack_netlink.c:3463:32: error: ‘exp_nat_nla_policy’ defined but not used [-Werror=unused-const-variable=] 3463 | static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = { | ^~~~~~~~~~~~~~~~~~ net/netfilter/nf_conntrack_netlink.c:2979:33: error: ‘any_addr’ defined but not used [-Werror=unused-const-variable=] 2979 | static const union nf_inet_addr any_addr; | ^~~~~~~~ These variables use is controlled by CONFIG_NF_NAT, so should their definitions. Signed-off-by: Tom Rix Reviewed-by: Simon Horman Signed-off-by: Florian Westphal commit ab87603b251134441a67385ecc9d3371be17b7a7 Author: Kai-Heng Feng Date: Wed May 17 13:24:51 2023 +0800 net: wwan: t7xx: Ensure init is completed before system sleep When the system attempts to sleep while mtk_t7xx is not ready, the driver cannot put the device to sleep: [ 12.472918] mtk_t7xx 0000:57:00.0: [PM] Exiting suspend, modem in invalid state [ 12.472936] mtk_t7xx 0000:57:00.0: PM: pci_pm_suspend(): t7xx_pci_pm_suspend+0x0/0x20 [mtk_t7xx] returns -14 [ 12.473678] mtk_t7xx 0000:57:00.0: PM: dpm_run_callback(): pci_pm_suspend+0x0/0x1b0 returns -14 [ 12.473711] mtk_t7xx 0000:57:00.0: PM: failed to suspend async: error -14 [ 12.764776] PM: Some devices failed to suspend, or early wake event detected Mediatek confirmed the device can take a rather long time to complete its initialization, so wait for up to 20 seconds until init is done. Signed-off-by: Kai-Heng Feng Signed-off-by: David S. Miller commit 9ba9485b87ac97fd159abdb4cbd53099bc9f01c6 Author: Benjamin Poirier Date: Tue May 16 14:49:24 2023 -0400 net: selftests: Fix optstring The cited commit added a stray colon to the 'v' option. That makes the option work incorrectly. ex: tools/testing/selftests/net# ./fib_nexthops.sh -v (should enable verbose mode, instead it shows help text due to missing arg) Fixes: 5feba4727395 ("selftests: fib_nexthops: Make ping timeout configurable") Reviewed-by: Ido Schimmel Signed-off-by: Benjamin Poirier Signed-off-by: David S. Miller commit c46e78ba9a7a09da4f192dc8df15c4e8a07fb9e0 Author: Vladimir Oltean Date: Tue May 16 18:44:10 2023 +0300 net: pcs: xpcs: fix C73 AN not getting enabled The XPCS expects clause 73 (copper backplane) autoneg to follow the ethtool autoneg bit. It actually did that until the blamed commit inaptly replaced state->an_enabled (coming from ethtool) with phylink_autoneg_inband() (coming from the device tree or struct phylink_config), as part of an unrelated phylink_pcs API conversion. Russell King suggests that state->an_enabled from the original code was just a proxy for the ethtool Autoneg bit, and that the correct way of restoring the functionality is to check for this bit in the advertising mask. Fixes: 11059740e616 ("net: pcs: xpcs: convert to phylink_pcs_ops") Link: https://lore.kernel.org/netdev/ZGNt2MFeRolKGFck@shell.armlinux.org.uk/ Suggested-by: Russell King (Oracle) Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 60829145f1e2650b31ebe6a0ec70a9725b38fa2c Author: M Chetan Kumar Date: Tue May 16 21:09:46 2023 +0530 net: wwan: iosm: fix NULL pointer dereference when removing device In suspend and resume cycle, the removal and rescan of device ends up in NULL pointer dereference. During driver initialization, if the ipc_imem_wwan_channel_init() fails to get the valid device capabilities it returns an error and further no resource (wwan struct) will be allocated. Now in this situation if driver removal procedure is initiated it would result in NULL pointer exception since unallocated wwan struct is dereferenced inside ipc_wwan_deinit(). ipc_imem_run_state_worker() to handle the called functions return value and to release the resource in failure case. It also reports the link down event in failure cases. The user space application can handle this event to do a device reset for restoring the device communication. Fixes: 3670970dd8c6 ("net: iosm: shared memory IPC interface") Reported-by: Samuel Wein PhD Closes: https://lore.kernel.org/netdev/20230427140819.1310f4bd@kernel.org/T/ Signed-off-by: M Chetan Kumar Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit dacab578c7c6cd06c50c89dfa36b0e0f10decd4e Author: Eric Dumazet Date: Tue May 16 14:23:42 2023 +0000 vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() syzbot triggered the following splat [1], sending an empty message through pppoe_sendmsg(). When VLAN_FLAG_REORDER_HDR flag is set, vlan_dev_hard_header() does not push extra bytes for the VLAN header, because vlan is offloaded. Unfortunately vlan_dev_hard_start_xmit() first reads veth->h_vlan_proto before testing (vlan->flags & VLAN_FLAG_REORDER_HDR). We need to swap the two conditions. [1] BUG: KMSAN: uninit-value in vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111 vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111 __netdev_start_xmit include/linux/netdevice.h:4883 [inline] netdev_start_xmit include/linux/netdevice.h:4897 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x253/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x3c7f/0x5ac0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3053 [inline] pppoe_sendmsg+0xa93/0xb80 drivers/net/ppp/pppoe.c:900 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555 __sys_sendmmsg+0x411/0xa50 net/socket.c:2641 __do_sys_sendmmsg net/socket.c:2670 [inline] __se_sys_sendmmsg net/socket.c:2667 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:774 slab_alloc_node mm/slub.c:3452 [inline] kmem_cache_alloc_node+0x543/0xab0 mm/slub.c:3497 kmalloc_reserve+0x148/0x470 net/core/skbuff.c:520 __alloc_skb+0x3a7/0x850 net/core/skbuff.c:606 alloc_skb include/linux/skbuff.h:1277 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2583 pppoe_sendmsg+0x3af/0xb80 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555 __sys_sendmmsg+0x411/0xa50 net/socket.c:2641 __do_sys_sendmmsg net/socket.c:2670 [inline] __se_sys_sendmmsg net/socket.c:2667 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 29770 Comm: syz-executor.0 Not tainted 6.3.0-rc6-syzkaller-gc478e5b17829 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 6049674b5720edbbb13a7cb3e2f3d2affaa40c19 Author: Masami Hiramatsu (Google) Date: Sun Apr 9 11:28:31 2023 +0900 tracing: fprobe: Initialize ret valiable to fix smatch error The commit 39d954200bf6 ("fprobe: Skip exit_handler if entry_handler returns !0") introduced a hidden dependency of 'ret' local variable in the fprobe_handler(), Smatch warns the `ret` can be accessed without initialization. kernel/trace/fprobe.c:59 fprobe_handler() error: uninitialized symbol 'ret'. kernel/trace/fprobe.c 49 fpr->entry_ip = ip; 50 if (fp->entry_data_size) 51 entry_data = fpr->data; 52 } 53 54 if (fp->entry_handler) 55 ret = fp->entry_handler(fp, ip, ftrace_get_regs(fregs), entry_data); ret is only initialized if there is an ->entry_handler 56 57 /* If entry_handler returns !0, nmissed is not counted. */ 58 if (rh) { rh is only true if there is an ->exit_handler. Presumably if you have and ->exit_handler that means you also have a ->entry_handler but Smatch is not smart enough to figure it out. --> 59 if (ret) ^^^ Warning here. 60 rethook_recycle(rh); 61 else 62 rethook_hook(rh, ftrace_get_regs(fregs), true); 63 } 64 out: 65 ftrace_test_recursion_unlock(bit); 66 } Link: https://lore.kernel.org/all/168100731160.79534.374827110083836722.stgit@devnote2/ Reported-by: Dan Carpenter Link: https://lore.kernel.org/all/85429a5c-a4b9-499e-b6c0-cbd313291c49@kili.mountain Fixes: 39d954200bf6 ("fprobe: Skip exit_handler if entry_handler returns !0") Acked-by: Dan Carpenter Signed-off-by: Masami Hiramatsu (Google) commit 597441b3436a43011f31ce71dc0a6c0bf5ce958a Author: Josef Bacik Date: Thu May 11 12:45:59 2023 -0400 btrfs: use nofs when cleaning up aborted transactions Our CI system caught a lockdep splat: ====================================================== WARNING: possible circular locking dependency detected 6.3.0-rc7+ #1167 Not tainted ------------------------------------------------------ kswapd0/46 is trying to acquire lock: ffff8c6543abd650 (sb_internal#2){++++}-{0:0}, at: btrfs_commit_inode_delayed_inode+0x5f/0x120 but task is already holding lock: ffffffffabe61b40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x4aa/0x7a0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (fs_reclaim){+.+.}-{0:0}: fs_reclaim_acquire+0xa5/0xe0 kmem_cache_alloc+0x31/0x2c0 alloc_extent_state+0x1d/0xd0 __clear_extent_bit+0x2e0/0x4f0 try_release_extent_mapping+0x216/0x280 btrfs_release_folio+0x2e/0x90 invalidate_inode_pages2_range+0x397/0x470 btrfs_cleanup_dirty_bgs+0x9e/0x210 btrfs_cleanup_one_transaction+0x22/0x760 btrfs_commit_transaction+0x3b7/0x13a0 create_subvol+0x59b/0x970 btrfs_mksubvol+0x435/0x4f0 __btrfs_ioctl_snap_create+0x11e/0x1b0 btrfs_ioctl_snap_create_v2+0xbf/0x140 btrfs_ioctl+0xa45/0x28f0 __x64_sys_ioctl+0x88/0xc0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc -> #0 (sb_internal#2){++++}-{0:0}: __lock_acquire+0x1435/0x21a0 lock_acquire+0xc2/0x2b0 start_transaction+0x401/0x730 btrfs_commit_inode_delayed_inode+0x5f/0x120 btrfs_evict_inode+0x292/0x3d0 evict+0xcc/0x1d0 inode_lru_isolate+0x14d/0x1e0 __list_lru_walk_one+0xbe/0x1c0 list_lru_walk_one+0x58/0x80 prune_icache_sb+0x39/0x60 super_cache_scan+0x161/0x1f0 do_shrink_slab+0x163/0x340 shrink_slab+0x1d3/0x290 shrink_node+0x300/0x720 balance_pgdat+0x35c/0x7a0 kswapd+0x205/0x410 kthread+0xf0/0x120 ret_from_fork+0x29/0x50 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(sb_internal#2); lock(fs_reclaim); lock(sb_internal#2); *** DEADLOCK *** 3 locks held by kswapd0/46: #0: ffffffffabe61b40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x4aa/0x7a0 #1: ffffffffabe50270 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x113/0x290 #2: ffff8c6543abd0e0 (&type->s_umount_key#44){++++}-{3:3}, at: super_cache_scan+0x38/0x1f0 stack backtrace: CPU: 0 PID: 46 Comm: kswapd0 Not tainted 6.3.0-rc7+ #1167 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 Call Trace: dump_stack_lvl+0x58/0x90 check_noncircular+0xd6/0x100 ? save_trace+0x3f/0x310 ? add_lock_to_list+0x97/0x120 __lock_acquire+0x1435/0x21a0 lock_acquire+0xc2/0x2b0 ? btrfs_commit_inode_delayed_inode+0x5f/0x120 start_transaction+0x401/0x730 ? btrfs_commit_inode_delayed_inode+0x5f/0x120 btrfs_commit_inode_delayed_inode+0x5f/0x120 btrfs_evict_inode+0x292/0x3d0 ? lock_release+0x134/0x270 ? __pfx_wake_bit_function+0x10/0x10 evict+0xcc/0x1d0 inode_lru_isolate+0x14d/0x1e0 __list_lru_walk_one+0xbe/0x1c0 ? __pfx_inode_lru_isolate+0x10/0x10 ? __pfx_inode_lru_isolate+0x10/0x10 list_lru_walk_one+0x58/0x80 prune_icache_sb+0x39/0x60 super_cache_scan+0x161/0x1f0 do_shrink_slab+0x163/0x340 shrink_slab+0x1d3/0x290 shrink_node+0x300/0x720 balance_pgdat+0x35c/0x7a0 kswapd+0x205/0x410 ? __pfx_autoremove_wake_function+0x10/0x10 ? __pfx_kswapd+0x10/0x10 kthread+0xf0/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 This happens because when we abort the transaction in the transaction commit path we call invalidate_inode_pages2_range on our block group cache inodes (if we have space cache v1) and any delalloc inodes we may have. The plain invalidate_inode_pages2_range() call passes through GFP_KERNEL, which makes sense in most cases, but not here. Wrap these two invalidate callees with memalloc_nofs_save/memalloc_nofs_restore to make sure we don't end up with the fs reclaim dependency under the transaction dependency. CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 806570c0bb7b4847828c22c4934fcf2dc8fc572f Author: Johannes Thumshirn Date: Thu May 4 13:58:13 2023 +0200 btrfs: handle memory allocation failure in btrfs_csum_one_bio Since f8a53bb58ec7 ("btrfs: handle checksum generation in the storage layer") the failures of btrfs_csum_one_bio() are handled via bio_end_io(). This means, we can return BLK_STS_RESOURCE from btrfs_csum_one_bio() in case the allocation of the ordered sums fails. This also fixes a syzkaller report, where injecting a failure into the kvzalloc() call results in a BUG_ON(). Reported-by: syzbot+d8941552e21eac774778@syzkaller.appspotmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Anand Jain Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7561551e7ba870b9659083b95feb520fb2dacce3 Author: Qu Wenruo Date: Thu Apr 13 13:57:17 2023 +0800 btrfs: scrub: try harder to mark RAID56 block groups read-only Currently we allow a block group not to be marked read-only for scrub. But for RAID56 block groups if we require the block group to be read-only, then we're allowed to use cached content from scrub stripe to reduce unnecessary RAID56 reads. So this patch would: - Make btrfs_inc_block_group_ro() try harder During my tests, for cases like btrfs/061 and btrfs/064, we can hit ENOSPC from btrfs_inc_block_group_ro() calls during scrub. The reason is if we only have one single data chunk, and trying to scrub it, we won't have any space left for any newer data writes. But this check should be done by the caller, especially for scrub cases we only temporarily mark the chunk read-only. And newer data writes would always try to allocate a new data chunk when needed. - Return error for scrub if we failed to mark a RAID56 chunk read-only Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 7dd3d9bd873f138675cb727eaa51a498d99f0e89 Author: Andreas Kemnade Date: Thu May 4 08:04:21 2023 +0200 gpiolib: fix allocation of mixed dynamic/static GPIOs If static allocation and dynamic allocation GPIOs are present, dynamic allocation pollutes the numberspace for static allocation, causing static allocation to fail. Enforce dynamic allocation above GPIO_DYNAMIC_BASE. Seen on a GTA04 when omap-gpio (static) and twl-gpio (dynamic) raced: [some successful registrations of omap_gpio instances] [ 2.553833] twl4030_gpio twl4030-gpio: gpio (irq 145) chaining IRQs 161..178 [ 2.561401] gpiochip_find_base: found new base at 160 [ 2.564392] gpio gpiochip5: (twl4030): added GPIO chardev (254:5) [ 2.564544] gpio gpiochip5: registered GPIOs 160 to 177 on twl4030 [...] [ 2.692169] omap-gpmc 6e000000.gpmc: GPMC revision 5.0 [ 2.697357] gpmc_mem_init: disabling cs 0 mapped at 0x0-0x1000000 [ 2.703643] gpiochip_find_base: found new base at 178 [ 2.704376] gpio gpiochip6: (omap-gpmc): added GPIO chardev (254:6) [ 2.704589] gpio gpiochip6: registered GPIOs 178 to 181 on omap-gpmc [...] [ 2.840393] gpio gpiochip7: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 2.849365] gpio gpiochip7: (gpio-160-191): GPIO integer space overlap, cannot add chip [ 2.857513] gpiochip_add_data_with_key: GPIOs 160..191 (gpio-160-191) failed to register, -16 [ 2.866149] omap_gpio 48310000.gpio: error -EBUSY: Could not register gpio chip On that device it is fixed invasively by commit 92bf78b33b0b4 ("gpio: omap: use dynamic allocation of base") but let's also fix that for devices where there is still a mixture of static and dynamic allocation. Fixes: 7b61212f2a07 ("gpiolib: Get rid of ARCH_NR_GPIOS") Signed-off-by: Andreas Kemnade Reviewed-by: Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit 1aa7f416175619e0286fddc5fc44e968b06bf2aa Author: Maya Matuszczyk Date: Mon May 15 20:48:43 2023 +0200 drm: panel-orientation-quirks: Change Air's quirk to support Air Plus It turned out that Aya Neo Air Plus had a different board name than expected. This patch changes Aya Neo Air's quirk to account for that, as both devices share "Air" in DMI product name. Tested on Air claiming to be an Air Pro, and on Air Plus. Signed-off-by: Maya Matuszczyk Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20230515184843.1552612-1-maccraft123mc@gmail.com commit 0a1bb16e0fe6650c3841e611de374bfd5578ad70 Author: Zev Weiss Date: Tue May 16 22:47:56 2023 -0700 gpio: mockup: Fix mode of debugfs files This driver's debugfs files have had a read operation since commit 2a9e27408e12 ("gpio: mockup: rework debugfs interface"), but were still being created with write-only mode bits. Update them to indicate that the files can also be read. Signed-off-by: Zev Weiss Fixes: 2a9e27408e12 ("gpio: mockup: rework debugfs interface") Cc: stable@kernel.org # v5.1+ Signed-off-by: Bartosz Golaszewski commit 66353baf3762fa0968b4424a2075fb395b329e9d Author: Nikolay Aleksandrov Date: Tue May 16 11:48:49 2023 +0300 mailmap: add entries for Nikolay Aleksandrov Turns out I missed a few patches due to use of old addresses by senders. Add a mailmap entry with my old addresses. Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 60d758659f1fb49e0d5b6ac2691ede8c0958795b Author: Aleksandr Loktionov Date: Tue May 16 10:41:46 2023 -0700 igb: fix bit_shift to be in [1..8] range In igb_hash_mc_addr() the expression: "mc_addr[4] >> 8 - bit_shift", right shifting "mc_addr[4]" shift by more than 7 bits always yields zero, so hash becomes not so different. Add initialization with bit_shift = 1 and add a loop condition to ensure bit_shift will be always in [1..8] range. Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver") Signed-off-by: Aleksandr Loktionov Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit 5ad3bd8444021a227959891c14b436e4067d67fd Merge: 1323e0c6e1d7e 7dcbdf29282fb Author: David S. Miller Date: Wed May 17 09:19:23 2023 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony nguyen says: ==================== Intel Wired LAN Driver Updates 2023-05-16 This series contains updates to ice and iavf drivers. Ahmed adds setting of missed condition for statistics which caused incorrect reporting of values for ice. For iavf, he removes a call to set VLAN offloads during re-initialization which can cause incorrect values to be set. Dawid adds checks to ensure VF is ready to be reset before executing commands that will require it to be reset on ice. --- v2: Patch 2 - Redo commit message ==================== Signed-off-by: David S. Miller commit 1323e0c6e1d7e103d59384c3ac50f72b17a6936c Author: Marco Migliore Date: Tue May 16 09:38:54 2023 +0200 net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset According to datasheet, the command opcode must be specified into bits [14:12] of the Extended Port Control register (EPC). Fixes: de776d0d316f ("net: dsa: mv88e6xxx: add support for mv88e6393x family") Signed-off-by: Marco Migliore Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 412cd77a2c24b191c65ea53025222418db09817c Author: Christophe JAILLET Date: Mon May 15 21:09:11 2023 +0200 cassini: Fix a memory leak in the error handling path of cas_init_one() cas_saturn_firmware_init() allocates some memory using vmalloc(). This memory is freed in the .remove() function but not it the error handling path of the probe. Add the missing vfree() to avoid a memory leak, should an error occur. Fixes: fcaa40669cd7 ("cassini: use request_firmware") Signed-off-by: Christophe JAILLET Reviewed-by: Pavan Chebbi Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 82b2bc279467c875ec36f8ef820f00997c2a4e8e Author: Kuniyuki Iwashima Date: Mon May 15 11:42:04 2023 -0700 tun: Fix memory leak for detached NAPI queue. syzkaller reported [0] memory leaks of sk and skb related to the TUN device with no repro, but we can reproduce it easily with: struct ifreq ifr = {} int fd_tun, fd_tmp; char buf[4] = {}; fd_tun = openat(AT_FDCWD, "/dev/net/tun", O_WRONLY, 0); ifr.ifr_flags = IFF_TUN | IFF_NAPI | IFF_MULTI_QUEUE; ioctl(fd_tun, TUNSETIFF, &ifr); ifr.ifr_flags = IFF_DETACH_QUEUE; ioctl(fd_tun, TUNSETQUEUE, &ifr); fd_tmp = socket(AF_PACKET, SOCK_PACKET, 0); ifr.ifr_flags = IFF_UP; ioctl(fd_tmp, SIOCSIFFLAGS, &ifr); write(fd_tun, buf, sizeof(buf)); close(fd_tun); If we enable NAPI and multi-queue on a TUN device, we can put skb into tfile->sk.sk_write_queue after the queue is detached. We should prevent it by checking tfile->detached before queuing skb. Note this must be done under tfile->sk.sk_write_queue.lock because write() and ioctl(IFF_DETACH_QUEUE) can run concurrently. Otherwise, there would be a small race window: write() ioctl(IFF_DETACH_QUEUE) `- tun_get_user `- __tun_detach |- if (tfile->detached) |- tun_disable_queue | `-> false | `- tfile->detached = tun | `- tun_queue_purge |- spin_lock_bh(&queue->lock) `- __skb_queue_tail(queue, skb) Another solution is to call tun_queue_purge() when closing and reattaching the detached queue, but it could paper over another problems. Also, we do the same kind of test for IFF_NAPI_FRAGS. [0]: unreferenced object 0xffff88801edbc800 (size 2048): comm "syz-executor.1", pid 33269, jiffies 4295743834 (age 18.756s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<000000008c16ea3d>] __do_kmalloc_node mm/slab_common.c:965 [inline] [<000000008c16ea3d>] __kmalloc+0x4a/0x130 mm/slab_common.c:979 [<000000003addde56>] kmalloc include/linux/slab.h:563 [inline] [<000000003addde56>] sk_prot_alloc+0xef/0x1b0 net/core/sock.c:2035 [<000000003e20621f>] sk_alloc+0x36/0x2f0 net/core/sock.c:2088 [<0000000028e43843>] tun_chr_open+0x3d/0x190 drivers/net/tun.c:3438 [<000000001b0f1f28>] misc_open+0x1a6/0x1f0 drivers/char/misc.c:165 [<000000004376f706>] chrdev_open+0x111/0x300 fs/char_dev.c:414 [<00000000614d379f>] do_dentry_open+0x2f9/0x750 fs/open.c:920 [<000000008eb24774>] do_open fs/namei.c:3636 [inline] [<000000008eb24774>] path_openat+0x143f/0x1a30 fs/namei.c:3791 [<00000000955077b5>] do_filp_open+0xce/0x1c0 fs/namei.c:3818 [<00000000b78973b0>] do_sys_openat2+0xf0/0x260 fs/open.c:1356 [<00000000057be699>] do_sys_open fs/open.c:1372 [inline] [<00000000057be699>] __do_sys_openat fs/open.c:1388 [inline] [<00000000057be699>] __se_sys_openat fs/open.c:1383 [inline] [<00000000057be699>] __x64_sys_openat+0x83/0xf0 fs/open.c:1383 [<00000000a7d2182d>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<00000000a7d2182d>] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 [<000000004cc4e8c4>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff88802f671700 (size 240): comm "syz-executor.1", pid 33269, jiffies 4295743854 (age 18.736s) hex dump (first 32 bytes): 68 c9 db 1e 80 88 ff ff 68 c9 db 1e 80 88 ff ff h.......h....... 00 c0 7b 2f 80 88 ff ff 00 c8 db 1e 80 88 ff ff ..{/............ backtrace: [<00000000e9d9fdb6>] __alloc_skb+0x223/0x250 net/core/skbuff.c:644 [<000000002c3e4e0b>] alloc_skb include/linux/skbuff.h:1288 [inline] [<000000002c3e4e0b>] alloc_skb_with_frags+0x6f/0x350 net/core/skbuff.c:6378 [<00000000825f98d7>] sock_alloc_send_pskb+0x3ac/0x3e0 net/core/sock.c:2729 [<00000000e9eb3df3>] tun_alloc_skb drivers/net/tun.c:1529 [inline] [<00000000e9eb3df3>] tun_get_user+0x5e1/0x1f90 drivers/net/tun.c:1841 [<0000000053096912>] tun_chr_write_iter+0xac/0x120 drivers/net/tun.c:2035 [<00000000b9282ae0>] call_write_iter include/linux/fs.h:1868 [inline] [<00000000b9282ae0>] new_sync_write fs/read_write.c:491 [inline] [<00000000b9282ae0>] vfs_write+0x40f/0x530 fs/read_write.c:584 [<00000000524566e4>] ksys_write+0xa1/0x170 fs/read_write.c:637 [<00000000a7d2182d>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<00000000a7d2182d>] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 [<000000004cc4e8c4>] entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: cde8b15f1aab ("tuntap: add ioctl to attach or detach a file form tuntap device") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit c1e4f5a411dd354c2ad20deadd56eadb4a461bbc Merge: 6ad85ed0ebf7e 11164bc394593 Author: Marc Kleine-Budde Date: Wed May 17 09:02:43 2023 +0200 Merge patch series "can: kvaser_pciefd: Bug fixes" Jimmy Assarsson says: This patch series contains various bug fixes for the kvaser_pciefd driver. Link: https://lore.kernel.org/r/20230516134318.104279-1-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 11164bc39459335ab93c6e99d53b7e4292fba38b Author: Jimmy Assarsson Date: Tue May 16 15:43:18 2023 +0200 can: kvaser_pciefd: Disable interrupts in probe error path Disable interrupts in error path of probe function. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson Link: https://lore.kernel.org/r/20230516134318.104279-7-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 262d7a52ba27525e3c1203230c9f0524e48bbb34 Author: Jimmy Assarsson Date: Tue May 16 15:43:17 2023 +0200 can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt Under certain circumstances we send two EFLUSH commands, resulting in two EFLUSH ack packets, while only expecting a single EFLUSH ack. This can cause the driver Tx flush completion to get out of sync. To avoid this problem, don't enable the "Transmit buffer flush done" (TFD) interrupt and remove the code handling it. Now we only send EFLUSH command after receiving status packet with "Init detected" (IDET) bit set. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson Link: https://lore.kernel.org/r/20230516134318.104279-6-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit c589557dd1426f5adf90c7a919d4fde5a3e4ef64 Author: Jimmy Assarsson Date: Tue May 16 15:43:16 2023 +0200 can: kvaser_pciefd: Empty SRB buffer in probe Empty the "Shared receive buffer" (SRB) in probe, to assure we start in a known state, and don't process any irrelevant packets. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson Link: https://lore.kernel.org/r/20230516134318.104279-5-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 84762d8da89d29ba842317eb842973e628c27391 Author: Jimmy Assarsson Date: Tue May 16 15:43:15 2023 +0200 can: kvaser_pciefd: Call request_irq() before enabling interrupts Make sure the interrupt handler is registered before enabling interrupts. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson Link: https://lore.kernel.org/r/20230516134318.104279-4-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit bf7ac55e991ca177f1ac16be51152f1ef291a4df Author: Jimmy Assarsson Date: Tue May 16 15:43:14 2023 +0200 can: kvaser_pciefd: Clear listen-only bit if not explicitly requested The listen-only bit was never cleared, causing the controller to always use listen-only mode, if previously set. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson Link: https://lore.kernel.org/r/20230516134318.104279-3-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit aed0e6ca7dbb8fbea9bc69c9ac663d5533c8c5d8 Author: Jimmy Assarsson Date: Tue May 16 15:43:13 2023 +0200 can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() Set can.state to CAN_STATE_STOPPED in kvaser_pciefd_stop(). Without this fix, wrong CAN state was repported after the interface was brought down. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson Link: https://lore.kernel.org/r/20230516134318.104279-2-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 38de368a66360f1859428d5e191b45bd01c20786 Author: Vinod Koul Date: Tue May 16 23:13:11 2023 +0530 dmaengine: ti: k3-udma: annotate pm function with __maybe_unused We get a warning when PM is not set: ../drivers/dma/ti/k3-udma.c:5552:12: warning: 'udma_pm_resume' defined but not used [-Wunused-function] 5552 | static int udma_pm_resume(struct device *dev) | ^~~~~~~~~~~~~~ ../drivers/dma/ti/k3-udma.c:5530:12: warning: 'udma_pm_suspend' defined but not used [-Wunused-function] 5530 | static int udma_pm_suspend(struct device *dev) | ^~~~~~~~~~~~~~~ Fix this by annotating pm function with __maybe_unused Fixes: fbe05149e40b ("dmaengine: ti: k3-udma: Add system suspend/resume support") Reported-by: Randy Dunlap Signed-off-by: Vinod Koul Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/20230516174311.117264-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit 0642287e3ecdd0d1f88e6a2e63768e16153a990c Author: Harshit Mogalapalli Date: Mon May 8 23:07:16 2023 -0700 dmaengine: idxd: Fix passing freed memory in idxd_cdev_open() Smatch warns: drivers/dma/idxd/cdev.c:327: idxd_cdev_open() warn: 'sva' was already freed. When idxd_wq_set_pasid() fails, the current code unbinds sva and then goes to 'failed_set_pasid' where iommu_sva_unbind_device is called again causing the above warning. [ device_user_pasid_enabled(idxd) is still true when calling failed_set_pasid ] Fix this by removing additional unbind when idxd_wq_set_pasid() fails Fixes: b022f59725f0 ("dmaengine: idxd: add idxd_copy_cr() to copy user completion record during page fault handling") Signed-off-by: Harshit Mogalapalli Acked-by: Fenghua Yu Acked-by: Dave Jiang Link: https://lore.kernel.org/r/20230509060716.2830630-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Vinod Koul commit 212457ccbd60dba34f965e4ffbe62f0e4f970538 Author: Arnd Bergmann Date: Tue May 16 20:34:22 2023 +0200 wifi: b43: fix incorrect __packed annotation clang warns about an unpacked structure inside of a packed one: drivers/net/wireless/broadcom/b43/b43.h:654:4: error: field data within 'struct b43_iv' is less aligned than 'union (unnamed union at /home/arnd/arm-soc/drivers/net/wireless/broadcom/b43/b43.h:651:2)' and is usually due to 'struct b43_iv' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] The problem here is that the anonymous union has the default alignment from its members, apparently because the original author mixed up the placement of the __packed attribute by placing it next to the struct member rather than the union definition. As the struct itself is also marked as __packed, there is no need to mark its members, so just move the annotation to the inner type instead. As Michael noted, the same problem is present in b43legacy, so change both at the same time. Acked-by: Michael Büsch Reported-by: kernel test robot Reviewed-by: Simon Horman Tested-by: Larry Finger Link: https://lore.kernel.org/oe-kbuild-all/202305160749.ay1HAoyP-lkp@intel.com/ Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230516183442.536589-1-arnd@kernel.org commit cb0ddaaa5db09d7d216fcbf0e68779be223a1128 Author: Martin Blumenstingl Date: Mon May 15 21:50:43 2023 +0200 wifi: rtw88: sdio: Always use two consecutive bytes for word operations The Allwinner sunxi-mmc controller cannot handle word (16 bit) transfers. So and sdio_{read,write}w fails with messages like the following example using an RTL8822BS (but the same problems were also observed with RTL8822CS and RTL8723DS chips): rtw_8822bs mmc1:0001:1: Firmware version 27.2.0, H2C version 13 sunxi-mmc 4021000.mmc: unaligned scatterlist: os f80 length 2 sunxi-mmc 4021000.mmc: map DMA failed rtw_8822bs mmc1:0001:1: sdio read16 failed (0x10230): -22 Use two consecutive single byte accesses for word operations instead. It turns out that upon closer inspection this is also what the vendor driver does, even though it does have support for sdio_{read,write}w. So we can conclude that the rtw88 chips do support word access but only on SDIO controllers that also support it. Since there's no way to detect if the controller supports word access or not the rtw88 sdio driver switches to the easiest approach: avoiding word access. Reported-by: Larry Finger Closes: https://lore.kernel.org/linux-wireless/527585e5-9cdd-66ed-c3af-6da162f4b720@lwfinger.net/ Reported-by: Rudi Heitbaum Link: https://github.com/LibreELEC/LibreELEC.tv/pull/7837#issue-1708469467 Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO based chipsets") Reviewed-by: Ping-Ke Shih Signed-off-by: Martin Blumenstingl Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230515195043.572375-1-martin.blumenstingl@googlemail.com commit 6ad85ed0ebf7ece0f376950a6b3b3c6048093d35 Merge: 47d55c62bdb9c 8680407b6f8f5 Author: Jakub Kicinski Date: Tue May 16 20:52:34 2023 -0700 Merge tag 'ipsec-2023-05-16' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2023-05-16 1) Don't check the policy default if we have an allow policy. Fix from Sabrina Dubroca. 2) Fix netdevice refount usage on offload. From Leon Romanovsky. 3) Use netdev_put instead of dev_puti to correctly release the netdev on failure in xfrm_dev_policy_add. From Leon Romanovsky. 4) Revert "Fix XFRM-I support for nested ESP tunnels" This broke Netfilter policy matching. From Martin Willi. 5) Reject optional tunnel/BEET mode templates in outbound policies on netlink and pfkey sockets. From Tobias Brunner. 6) Check if_id in inbound policy/secpath match to make it symetric to the outbound codepath. From Benedict Wong. * tag 'ipsec-2023-05-16' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: Check if_id in inbound policy/secpath match af_key: Reject optional tunnel/BEET mode templates in outbound policies xfrm: Reject optional tunnel/BEET mode templates in outbound policies Revert "Fix XFRM-I support for nested ESP tunnels" xfrm: Fix leak of dev tracker xfrm: release all offloaded policy memory xfrm: don't check the default policy if the policy allows the packet ==================== Link: https://lore.kernel.org/r/20230516052405.2677554-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit 47d55c62bdb9ce55283243f61b0575d4a9ce3744 Merge: d6352dae0903f c08e24013aba4 Author: Jakub Kicinski Date: Tue May 16 20:49:42 2023 -0700 Merge tag 'linux-can-fixes-for-6.4-20230515' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2023-05-15 The first 2 patches are by Oliver Hartkopp and allow the MSG_CMSG_COMPAT flag for isotp and j1939. The next patch is by Oliver Hartkopp, too and adds missing CAN XL support in can_put_echo_skb(). Geert Uytterhoeven's patch let's the bxcan driver depend on ARCH_STM32. The last 5 patches are from Dario Binacchi and also affect the bxcan driver. The bxcan driver hit mainline with v6.4-rc1 and was originally written for IP cores containing 2 CAN interfaces with shared resources. Dario's series updates the DT bindings and driver to support IP cores with a single CAN interface instance as well as adding the bxcan to the stm32f746's device tree. * tag 'linux-can-fixes-for-6.4-20230515' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: ARM: dts: stm32: add CAN support on stm32f746 can: bxcan: add support for single peripheral configuration ARM: dts: stm32: add pin map for CAN controller on stm32f7 ARM: dts: stm32f429: put can2 in secondary mode dt-bindings: net: can: add "st,can-secondary" property can: CAN_BXCAN should depend on ARCH_STM32 can: dev: fix missing CAN XL support in can_put_echo_skb() can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag ==================== Link: https://lore.kernel.org/r/20230515204722.1000957-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit d6352dae0903fe8beae4c007dc320e9e9f1fed45 Author: Ido Schimmel Date: Mon May 15 19:29:25 2023 +0300 devlink: Fix crash with CONFIG_NET_NS=n '__net_initdata' becomes a no-op with CONFIG_NET_NS=y, but when this option is disabled it becomes '__initdata', which means the data can be freed after the initialization phase. This annotation is obviously incorrect for the devlink net device notifier block which is still registered after the initialization phase [1]. Fix this crash by removing the '__net_initdata' annotation. [1] general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] PREEMPT SMP CPU: 3 PID: 117 Comm: (udev-worker) Not tainted 6.4.0-rc1-custom-gdf0acdc59b09 #64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc37 04/01/2014 RIP: 0010:notifier_call_chain+0x58/0xc0 [...] Call Trace: dev_set_mac_address+0x85/0x120 dev_set_mac_address_user+0x30/0x50 do_setlink+0x219/0x1270 rtnl_setlink+0xf7/0x1a0 rtnetlink_rcv_msg+0x142/0x390 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x188/0x270 netlink_sendmsg+0x214/0x470 __sys_sendto+0x12f/0x1a0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: e93c9378e33f ("devlink: change per-devlink netdev notifier to static one") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/netdev/600ddf9e-589a-2aa0-7b69-a438f833ca10@samsung.com/ Tested-by: Marek Szyprowski Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230515162925.1144416-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 09e797c8641f6ad435c33ae24c223351197ea29a Author: Wenchao Hao Date: Mon May 15 15:01:56 2023 +0800 scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed If scsi_dispatch_cmd() failed, the SCSI command was not sent to the target, scsi_queue_rq() would return BLK_STS_RESOURCE and the related request would be requeued. The timeout of this request would not fire, no one would increase iodone_cnt. The above flow would result the iodone_cnt smaller than iorequest_cnt. So decrease the iorequest_cnt if dispatch failed to workaround the issue. Signed-off-by: Wenchao Hao Reported-by: Ming Lei Closes: https://lore.kernel.org/r/ZF+zB+bB7iqe0wGd@ovpn-8-17.pek2.redhat.com Link: https://lore.kernel.org/r/20230515070156.1790181-3-haowenchao2@huawei.com Reviewed-by: Ming Lei Signed-off-by: Martin K. Petersen commit 6ca9818d1624e136a76ae8faedb6b6c95ca66903 Author: Wenchao Hao Date: Mon May 15 15:01:55 2023 +0800 scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed" The "atomic_inc(&cmd->device->iorequest_cnt)" in scsi_queue_rq() would cause kernel panic because cmd->device may be freed after returning from scsi_dispatch_cmd(). This reverts commit cfee29ffb45b1c9798011b19d454637d1b0fe87d. Signed-off-by: Wenchao Hao Reported-by: Ming Lei Closes: https://lore.kernel.org/r/ZF+zB+bB7iqe0wGd@ovpn-8-17.pek2.redhat.com Link: https://lore.kernel.org/r/20230515070156.1790181-2-haowenchao2@huawei.com Reviewed-by: Ming Lei Signed-off-by: Martin K. Petersen commit 4e81a6cba517cb33584308a331f14f5e3fec369b Author: Michael Kelley Date: Mon May 15 10:20:41 2023 -0700 scsi: storvsc: Don't pass unused PFNs to Hyper-V host In a SCSI request, storvsc pre-allocates space for up to MAX_PAGE_BUFFER_COUNT physical frame numbers to be passed to Hyper-V. If the size of the I/O request requires more PFNs, a separate memory area of exactly the correct size is dynamically allocated. But when the pre-allocated area is used, current code always passes MAX_PAGE_BUFFER_COUNT PFNs to Hyper-V, even if fewer are needed. While this doesn't break anything because the additional PFNs are always zero, more bytes than necessary are copied into the VMBus channel ring buffer. This takes CPU cycles and wastes space in the ring buffer. For a typical 4 Kbyte I/O that requires only a single PFN, 248 unnecessary bytes are copied. Fix this by setting the payload_sz based on the actual number of PFNs required, not the size of the pre-allocated space. Reported-by: John Starks Fixes: 8f43710543ef ("scsi: storvsc: Support PAGE_SIZE larger than 4K") Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1684171241-16209-1-git-send-email-mikelley@microsoft.com Signed-off-by: Martin K. Petersen commit 8b271370e963370703819bd9795a54d658071bed Author: Matthias Kaehlcke Date: Tue May 16 16:46:30 2023 +0000 ASoC: rt5682: Disable jack detection interrupt during suspend The rt5682 driver switches its regmap to cache-only when the device suspends and back to regular mode on resume. When the jack detect interrupt fires rt5682_irq() schedules the jack detect work. This can result in invalid reads from the regmap in cache-only mode if the work runs before the device has resumed: [ 56.245502] rt5682 9-001a: ASoC: error at soc_component_read_no_lock on rt5682.9-001a for register: [0x000000f0] -16 Disable the jack detection interrupt during suspend and re-enable it on resume. The driver already schedules the jack detection work on resume, so any state change during suspend is still handled. This is essentially the same as commit f7d00a9be147 ("SoC: rt5682s: Disable jack detection interrupt during suspend") for the rt5682s. Cc: stable@kernel.org Signed-off-by: Matthias Kaehlcke Date: Thu May 11 16:55:32 2023 +0530 ASoC: lpass: Fix for KASAN use_after_free out of bounds When we run syzkaller we get below Out of Bounds error. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace of the issue: BUG: KASAN: slab-out-of-bounds in regcache_flat_read+0x10c/0x110 Read of size 4 at addr ffffff8088fbf714 by task syz-executor.4/14144 CPU: 6 PID: 14144 Comm: syz-executor.4 Tainted: G W Hardware name: Qualcomm Technologies, Inc. sc7280 CRD platform (rev5+) (DT) Call trace: dump_backtrace+0x0/0x4ec show_stack+0x34/0x50 dump_stack_lvl+0xdc/0x11c print_address_description+0x30/0x2d8 kasan_report+0x178/0x1e4 __asan_report_load4_noabort+0x44/0x50 regcache_flat_read+0x10c/0x110 regcache_read+0xf8/0x5a0 _regmap_read+0x45c/0x86c _regmap_update_bits+0x128/0x290 regmap_update_bits_base+0xc0/0x15c snd_soc_component_update_bits+0xa8/0x22c snd_soc_component_write_field+0x68/0xd4 tx_macro_put_dec_enum+0x1d0/0x268 snd_ctl_elem_write+0x288/0x474 By Error checking and checking valid values issue gets rectifies. Signed-off-by: Ravulapati Vishnu Vardhan Rao Date: Thu May 4 23:44:51 2023 +0800 scsi: ufs: core: Fix MCQ nr_hw_queues Since MAXQ is 0-based value, add one to obtain number of hardware queues. Signed-off-by: Po-Wen Kao Link: https://lore.kernel.org/r/20230504154454.26654-4-powen.kao@mediatek.com Reviewed-by: Bean Huo Reviewed-by: Manivannan Sadhasivam Reviewed-by: Bart Van Assche Reviewed-by: Stanley Chu Signed-off-by: Martin K. Petersen commit 06caeb536b2b21668efd2d6fa97c09461957b3a7 Author: Po-Wen Kao Date: Thu May 4 23:44:50 2023 +0800 scsi: ufs: core: Rename symbol sizeof_utp_transfer_cmd_desc() Naming the functions after standard operators like sizeof() may cause confusion. Rename it to ufshcd_get_ucd_size(). Signed-off-by: Po-Wen Kao Link: https://lore.kernel.org/r/20230504154454.26654-3-powen.kao@mediatek.com Suggested-by: Manivannan Sadhasivam Reviewed-by: Stanley Chu Reviewed-by: Ziqi Chen Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 5149452ca66289ef33d13897ee845a2f6f5b680f Author: Po-Wen Kao Date: Thu May 4 23:44:49 2023 +0800 scsi: ufs: core: Fix MCQ tag calculation The transfer command descriptor is allocated in ufshcd_memory_alloc() and referenced by the transfer request descriptor with stride size sizeof_utp_transfer_cmd_desc() instead of sizeof(struct utp_transfer_cmd_desc). Consequently, computing tag by address offset should also refer to the same stride. Signed-off-by: Po-Wen Kao Link: https://lore.kernel.org/r/20230504154454.26654-2-powen.kao@mediatek.com Reviewed-by: Bart Van Assche Reviewed-by: Manivannan Sadhasivam Reviewed-by: Stanley Chu Reviewed-by: Ziqi Chen Signed-off-by: Martin K. Petersen commit 866422cdddcdf59d8c68e9472d49ba1be29b5fcf Author: Yonatan Nachum Date: Thu May 11 11:51:03 2023 +0000 RDMA/efa: Fix unsupported page sizes in device Device uses 4KB size blocks for user pages indirect list while the driver creates those blocks with the size of PAGE_SIZE of the kernel. On kernels with PAGE_SIZE different than 4KB (ARM RHEL), this leads to a failure on register MR with indirect list because of the miss communication between driver and device. Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation") Link: https://lore.kernel.org/r/20230511115103.13876-1-ynachum@amazon.com Reviewed-by: Firas Jahjah Reviewed-by: Michael Margolin Signed-off-by: Yonatan Nachum Signed-off-by: Jason Gunthorpe commit b5f3fe27c54b1fe77d4dd834ccd48a6d694f872e Author: Guoqing Jiang Date: Wed May 10 11:50:56 2023 +0800 RDMA/rxe: Convert spin_{lock_bh,unlock_bh} to spin_{lock_irqsave,unlock_irqrestore} We need to call spin_lock_irqsave()/spin_unlock_irqrestore() for state_lock in rxe, otherwsie the callchain: ib_post_send_mad -> spin_lock_irqsave -> ib_post_send -> rxe_post_send -> spin_lock_bh -> spin_unlock_bh -> spin_unlock_irqrestore Causes below traces during run block nvmeof-mp/001 test due to mismatched spinlock nesting: WARNING: CPU: 0 PID: 94794 at kernel/softirq.c:376 __local_bh_enable_ip+0xc2/0x140 [ ... ] CPU: 0 PID: 94794 Comm: kworker/u4:1 Tainted: G E 6.4.0-rc1 #9 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 Workqueue: rdma_cm cma_work_handler [rdma_cm] RIP: 0010:__local_bh_enable_ip+0xc2/0x140 Code: 48 85 c0 74 72 5b 41 5c 5d 31 c0 89 c2 89 c1 89 c6 89 c7 41 89 c0 e9 bd 0e 11 01 65 8b 05 f2 65 72 48 85 c0 0f 85 76 ff ff ff <0f> 0b e9 6f ff ff ff e8 d2 39 1c 00 eb 80 4c 89 e7 e8 68 ad 0a 00 RSP: 0018:ffffb7cf818539f0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000201 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffffc0f25f79 RBP: ffffb7cf81853a00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffc0f25f79 R13: ffff8db1f0fa6000 R14: ffff8db2c63ff000 R15: 00000000000000e8 FS: 0000000000000000(0000) GS:ffff8db33bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559758db0f20 CR3: 0000000105124000 CR4: 00000000003506f0 Call Trace: _raw_spin_unlock_bh+0x31/0x40 rxe_post_send+0x59/0x8b0 [rdma_rxe] ib_send_mad+0x26b/0x470 [ib_core] ib_post_send_mad+0x150/0xb40 [ib_core] ? cm_form_tid+0x5b/0x90 [ib_cm] ib_send_cm_req+0x7c8/0xb70 [ib_cm] rdma_connect_locked+0x433/0x940 [rdma_cm] nvme_rdma_cm_handler+0x5d7/0x9c0 [nvme_rdma] cma_cm_event_handler+0x4f/0x170 [rdma_cm] cma_work_handler+0x6a/0xe0 [rdma_cm] process_one_work+0x2a9/0x580 worker_thread+0x52/0x3f0 ? __pfx_worker_thread+0x10/0x10 kthread+0x109/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 0 PID: 94794 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x37/0x60 [ ... ] CPU: 0 PID: 94794 Comm: kworker/u4:1 Tainted: G W E 6.4.0-rc1 #9 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 Workqueue: rdma_cm cma_work_handler [rdma_cm] RIP: 0010:warn_bogus_irq_restore+0x37/0x60 Code: fb 01 77 36 83 e3 01 74 0e 48 8b 5d f8 c9 31 f6 89 f7 e9 ac ea 01 00 48 c7 c7 e0 52 33 b9 c6 05 bb 1c 69 01 01 e8 39 24 f0 fe <0f> 0b 48 8b 5d f8 c9 31 f6 89 f7 e9 89 ea 01 00 0f b6 f3 48 c7 c7 RSP: 0018:ffffb7cf81853a58 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffb7cf81853a60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8db2cfb1a9e8 R13: ffff8db2cfb1a9d8 R14: ffff8db2c63ff000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8db33bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559758db0f20 CR3: 0000000105124000 CR4: 00000000003506f0 Call Trace: _raw_spin_unlock_irqrestore+0x91/0xa0 ib_send_mad+0x1e3/0x470 [ib_core] ib_post_send_mad+0x150/0xb40 [ib_core] ? cm_form_tid+0x5b/0x90 [ib_cm] ib_send_cm_req+0x7c8/0xb70 [ib_cm] rdma_connect_locked+0x433/0x940 [rdma_cm] nvme_rdma_cm_handler+0x5d7/0x9c0 [nvme_rdma] cma_cm_event_handler+0x4f/0x170 [rdma_cm] cma_work_handler+0x6a/0xe0 [rdma_cm] process_one_work+0x2a9/0x580 worker_thread+0x52/0x3f0 ? __pfx_worker_thread+0x10/0x10 kthread+0x109/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 Fixes: f605f26ea196 ("RDMA/rxe: Protect QP state with qp->state_lock") Link: https://lore.kernel.org/r/20230510035056.881196-1-guoqing.jiang@linux.dev Signed-off-by: Guoqing Jiang Reviewed-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit 95339f40a8b652b5b1773def31e63fc53c26378a Author: Mario Limonciello Date: Tue May 16 13:25:40 2023 -0500 power: supply: Fix logic checking if system is running from battery The logic used for power_supply_is_system_supplied() counts all power supplies and assumes that the system is running from AC if there is either a non-battery power-supply reporting to be online or if no power-supplies exist at all. The second rule is for desktop systems, that don't have any battery/charger devices. These systems will incorrectly report to be powered from battery once a device scope power-supply is registered (e.g. a HID device), since these power-supplies increase the counter. Apart from HID devices, recent dGPUs provide UCSI power supplies on a desktop systems. The dGPU by default doesn't have anything plugged in so it's 'offline'. This makes power_supply_is_system_supplied() return 0 with a count of 1 meaning all drivers that use this get a wrong judgement. To fix this case adjust the logic to also examine the scope of the power supply. If the power supply is deemed a device power supply, then don't count it. Cc: Evan Quan Suggested-by: Lijo Lazar Signed-off-by: Mario Limonciello Signed-off-by: Sebastian Reichel commit 17eabd6a044b57b2c1b5459eb9d11af3ea909e63 Author: Bob Pearson Date: Mon May 15 15:10:57 2023 -0500 RDMA/rxe: Fix double unlock in rxe_qp.c A recent patch can cause a double spin_unlock_bh() in rxe_qp_to_attr() at line 715 in rxe_qp.c. Move the 2nd unlock into the if statement. Fixes: f605f26ea196 ("RDMA/rxe: Protect QP state with qp->state_lock") Link: https://lore.kernel.org/r/20230515201056.1591140-1-rpearsonhpe@gmail.com Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/27773078-40ce-414f-8b97-781954da9f25@kili.mountain Signed-off-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit bd415b5c9552d44069d4e7c1e018b6d42f25af9e Author: Randy Dunlap Date: Sun May 7 22:59:28 2023 -0700 Documentation/filesystems: ramfs-rootfs-initramfs: use :Author: Use the :Author: markup instead of making it a chapter heading. This cleans up the table of contents for this file. Fixes: 7f46a240b0a1 ("[PATCH] ramfs, rootfs, and initramfs docs") Signed-off-by: Randy Dunlap Cc: Rob Landley Reviewed-by: Christian Brauner Link: https://lore.kernel.org/r/20230508055928.3548-1-rdunlap@infradead.org Signed-off-by: Jonathan Corbet commit 7b38ecfdf9fbb133b4d2ea3738c02291a262abe2 Author: Randy Dunlap Date: Sun May 7 22:59:38 2023 -0700 Documentation/filesystems: sharedsubtree: add section headings Several of the sections are missing underlines. This makes the generated contents have missing entries, so add the underlines. Fixes: 16c01b20ae05 ("doc/filesystems: more mount cleanups") Fixes: 9cfcceea8f7e ("[PATCH] Complete description of shared subtrees.") Signed-off-by: Randy Dunlap Reviewed-by: Christian Brauner Link: https://lore.kernel.org/r/20230508055938.6550-1-rdunlap@infradead.org Signed-off-by: Jonathan Corbet commit 0d8aa3212e042bfcb7011e4de841dfdea39dc4b7 Author: Thorsten Leemhuis Date: Mon May 15 10:52:19 2023 +0200 docs: quickly-build-trimmed-linux: various small fixes and improvements * improve the short description of localmodconfig in the step-by-step guide while fixing its broken first sentence * briefly mention immutable Linux distributions * use '--shallow-exclude=v6.0' throughout the document * instead of "git reset --hard; git checkout ..." use "git checkout --force ..." in the step-by-step guide: this matches the TLDR and is one command less to execute. This led to a few small adjustments to the text and the flow in the surrounding area. * fix two thinkos in the section explaining full git clones Signed-off-by: Thorsten Leemhuis Link: https://lore.kernel.org/r/6f4684b9a5d11d3adb04e0af3cfc60db8b28eeb2.1684140700.git.linux@leemhuis.info Signed-off-by: Jonathan Corbet commit 96e3cc270d61cb9945b1c2894effcba15010f097 Author: Randy Dunlap Date: Mon May 15 17:15:18 2023 -0700 Documentation: use capitalization for chapters and acronyms Use capital letters in acronyms for CD-ROM, FPGA, and PCMCIA. Use capital letter in the first word of chapter headings for Locking, Timers, and "Brief tutorial on CRC computation". Signed-off-by: Randy Dunlap Cc: Moritz Fischer Cc: Wu Hao Cc: Tom Rix Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Will Deacon Cc: Waiman Long Cc: Boqun Feng Cc: Dominik Brodowski Cc: Thomas Gleixner Acked-by: Xu Yilun Reviewed-by: Phillip Potter Link: https://lore.kernel.org/r/20230516001518.14514-1-rdunlap@infradead.org Signed-off-by: Jonathan Corbet commit 3b44ec8c5c44790a82f07e90db45643c762878c6 Author: Takashi Iwai Date: Tue May 16 20:44:12 2023 +0200 ALSA: hda: Fix Oops by 9.1 surround channel names get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec. As a workaround, extend for the 9.1 channels and also fix the potential Oops by unifying the code paths accessing the same array with the proper size check. Reported-by: Olliver Schinagl Cc: Link: https://lore.kernel.org/r/64d95eb0-dbdb-cff8-a8b1-988dc22b24cd@schinagl.nl Link: https://lore.kernel.org/r/20230516184412.24078-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b633896314c0f78f2b4eb7b19a530d68f2a35445 Author: Arnaldo Carvalho de Melo Date: Tue May 16 15:27:50 2023 -0300 tools headers UAPI: Sync s390 syscall table file that wires up the memfd_secret syscall To pick the changes in these csets: 7608f70adcb1ea69 ("s390: wire up memfd_secret system call") That add support for this new syscall in tools such as 'perf trace'. For instance, this is now possible (adapted from the x86_64 test output): # perf trace -v -e memfd_secret event qualifier tracepoint filter: (common_pid != 13375 && common_pid != 3713) && (id == 447) ^C# That is the filter expression attached to the raw_syscalls:sys_{enter,exit} tracepoints. $ grep memfd_secret tools/perf/arch/x86/entry/syscalls/syscall_64.tbl 447 common memfd_secret sys_memfd_secret $ This addresses this perf build warnings: Warning: Kernel ABI header at 'tools/perf/arch/s390/entry/syscalls/syscall.tbl' differs from latest version at 'arch/s390/kernel/syscalls/syscall.tbl' diff -u tools/perf/arch/s390/entry/syscalls/syscall.tbl arch/s390/kernel/syscalls/syscall.tbl Cc: Adrian Hunter Cc: Heiko Carstens Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Vasily Gorbik Link: https://lore.kernel.org/lkml/ZGPMW0p++D1Jdvf6@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 71852cd8825077d2d90466ac34d3b94e0be3bfae Author: Arnaldo Carvalho de Melo Date: Tue May 16 15:23:47 2023 -0300 tools headers UAPI: Sync linux/prctl.h with the kernel sources ddc65971bb677aa9 ("prctl: add PR_GET_AUXV to copy auxv to userspace") To pick the changes in: That don't result in any changes in tooling: $ tools/perf/trace/beauty/prctl_option.sh > before $ cp include/uapi/linux/prctl.h tools/include/uapi/linux/prctl.h $ tools/perf/trace/beauty/prctl_option.sh > after $ diff -u before after $ This actually adds a new prctl arg, but it has to be dealt with differently, as it is not in sequence with the other arguments. Just silences this perf tools build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/prctl.h' differs from latest version at 'include/uapi/linux/prctl.h' diff -u tools/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Signed-off-by: Arnaldo Carvalho de Melo commit 9dde12767aa19696a7fb28b2320119b87fb9d299 Author: Ian Rogers Date: Mon May 15 15:45:30 2023 -0700 perf metrics: Avoid segv with --topdown for metrics without a group Some metrics may not have a metric_group which can result in segvs with "perf stat --topdown". Add a condition for the no metric_group case. Fixes: 1647cd5b8802698f ("perf stat: Implement --topdown using json metrics") Reported-by: Kan Liang Signed-off-by: Ian Rogers Tested-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kajol Jain Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230515224530.671331-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit cc638dba23266897c80b9bc87f33de44565fab38 Merge: 9dc68a4fe7089 9be0b3a0074a6 Author: Takashi Iwai Date: Tue May 16 20:11:50 2023 +0200 Merge tag 'asoc-fix-v6.4-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.4 More fixes that came in since the merge window, the bulk of which are for the SOF code, I suspect as a result of the wide usage, active development and large code size rather than huge quality problems. There's also a couple of MAINTAINERS updates and some new device quirks. commit a820ca1a739b7e3ee0ddb48bdfa3c09dc7cd4302 Author: Andrii Nakryiko Date: Mon May 15 17:17:18 2023 -0700 samples/bpf: Drop unnecessary fallthrough __fallthrough is now not supported. Instead of renaming it to now-canonical ([0]) fallthrough pseudo-keyword, just get rid of it and equate 'h' case to default case, as both emit usage information and succeed. [0] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20230516001718.317177-1-andrii@kernel.org commit 098abbd48ec1accf111dde50a2a5392f2a15f59c Author: Zhengchao Shao Date: Mon May 15 17:22:27 2023 +0800 mac80211_hwsim: fix memory leak in hwsim_new_radio_nl When parse_pmsr_capa failed in hwsim_new_radio_nl, the memory resources applied for by pmsr_capa are not released. Add release processing to the incorrect path. Fixes: 92d13386ec55 ("mac80211_hwsim: add PMSR capability support") Reported-by: syzbot+904ce6fbb38532d9795c@syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230515092227.2691437-1-shaozhengchao@huawei.com Signed-off-by: Johannes Berg commit a8938bc881d2a03f9b77f19fae924fe798a01285 Author: Ariel Malamud Date: Sun May 14 12:15:55 2023 +0300 wifi: iwlwifi: mvm: Add locking to the rate read flow The rs_drv_get_rate flow reads the lq_sta to return the optimal rate for tx frames. This read flow is not protected thereby leaving a small window, a few instructions wide, open to contention by an asynchronous rate update. Indeed this race condition was hit and the update occurred in the middle of the read. Fix this by locking the lq_sta struct during read. Signed-off-by: Ariel Malamud Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.b52c9ed5c379.I15290b78e0d966c1b68278263776ca9de841d5fe@changeid Signed-off-by: Johannes Berg commit 207be64f4e60bf5de13fc69fcf7fe2441bf71a97 Author: Miri Korenblit Date: Sun May 14 12:15:54 2023 +0300 wifi: iwlwifi: Don't use valid_links to iterate sta links This bitmap equals to zero when in a non-MLO mode, and then we won't be iterating on any link. Use for_each_sta_active_link() instead, as it handles also the case of non-MLO mode. Signed-off-by: Miri Korenblit Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.f32a8c08730a.Ib02248cd0b7f2bc885f91005c3c110dd027f9dcd@changeid Signed-off-by: Johannes Berg commit 682b6dc29d98e857e6ca4bbc077c7dc2899b7473 Author: Johannes Berg Date: Sun May 14 12:15:53 2023 +0300 wifi: iwlwifi: mvm: don't trust firmware n_channels If the firmware sends us a corrupted MCC response with n_channels much larger than the command response can be, we might copy far too much (uninitialized) memory and even crash if the n_channels is large enough to make it run out of the one page allocated for the FW response. Fix that by checking the lengths. Doing a < comparison would be sufficient, but the firmware should be doing it correctly, so check more strictly. Fixes: dcaf9f5ecb6f ("iwlwifi: mvm: add MCC update FW API") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.d7b233139eb4.I51fd319df8e9d41881fc8450e83d78049518a79a@changeid Signed-off-by: Johannes Berg commit d0246a0e49efee0f8649d0e4f2350614cdfe6565 Author: Alon Giladi Date: Sun May 14 12:15:52 2023 +0300 wifi: iwlwifi: mvm: fix OEM's name in the tas approved list Fix a spelling mistake. Fixes: 2856f623ce48 ("iwlwifi: mvm: Add list of OEMs allowed to use TAS") Signed-off-by: Alon Giladi Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.4090de6d1878.If9391ef6da78f1b2cc5eb6cb8f6965816bb7a7f5@changeid Signed-off-by: Johannes Berg commit eca7296d9a671e9961834d2ace9cc0ce21fc15b3 Author: Alon Giladi Date: Sun May 14 12:15:51 2023 +0300 wifi: iwlwifi: fix OEM's name in the ppag approved list Fix a spelling mistake. Fixes: e8e10a37c51c ("iwlwifi: acpi: move ppag code from mvm to fw/acpi") Signed-off-by: Alon Giladi Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.fdd07f36a8bf.I223e5fb16ab5c95d504c3fdaffd0bd70affad1c2@changeid Signed-off-by: Johannes Berg commit e234c36290430a833aa87532a7740fef031c2c85 Author: Mukesh Sisodiya Date: Sun May 14 12:15:50 2023 +0300 wifi: iwlwifi: mvm: fix initialization of a return value In iwl_mvm_mld_update_sta(), if the flow doesn't enter for_each_sta_active_link(), the default value is returned. Set this default to -EINVAL instead of 0 to better reflect this. Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.98b7e3aacf0b.I2fc274dd7e374ef7fac8e26d71c9cd73323da665@changeid Signed-off-by: Johannes Berg commit 6818266283d191549afa87ac5d7b86635a5fb105 Author: Gregory Greenman Date: Sun May 14 12:15:49 2023 +0300 wifi: iwlwifi: mvm: fix access to fw_id_to_mac_id RCU protected fw_id_to_mac_id can be initialized with either an error code or NULL. Thus, after dereferencing need to check the value with IS_ERR_OR_NULL() and not only that it is not NULL. Fix it. Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.ec5f2880e81c.Ifa8c0f451df2835bde800f5c3670cc46238a3bd8@changeid Signed-off-by: Johannes Berg commit d3ae69180bbd74bcbc03a2b6d10ed7eccbe98c23 Author: Johannes Berg Date: Sun May 14 12:15:48 2023 +0300 wifi: iwlwifi: fw: fix DBGI dump The DBGI dump is (unsurprisingly) of type DBGI, not SRAM. This leads to bad register accesses because the union is built differently, there's no allocation ID, and thus the allocation ID ends up being 0x8000. Note that this was already wrong for DRAM vs. SMEM since they use different parts of the union, but the allocation ID is at the same place, so it worked. Fix all of this but set the allocation ID in a way that the offset calculation ends up without any offset. Fixes: 34bc27783a31 ("iwlwifi: yoyo: fix DBGI_SRAM ini dump header.") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.19a302ae4c65.I12272599f7c1930666157b9d5e7f81fe9ec4c421@changeid Signed-off-by: Johannes Berg commit 204bfec9168ddd869a05e7f70dc5b0a9ae513722 Author: Johannes Berg Date: Sun May 14 12:15:47 2023 +0300 wifi: iwlwifi: mvm: fix number of concurrent link checks The concurrent link checks need to correctly differentiate between AP and non-AP, fix that. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.992b2f981ef6.I7d386c19354e9be39c4822f436dd22c93422b660@changeid Signed-off-by: Johannes Berg commit c2d8b7f257b2398f2d866205365895e038beca12 Author: Johannes Berg Date: Sun May 14 12:15:46 2023 +0300 wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock Lockdep points out that we can deadlock here by calling cancel_delayed_work_sync() because that might be already running and gotten interrupted by the NAPI soft-IRQ. Even just calling something that can sleep is wrong in this context though. Luckily, it doesn't even really matter since the things we need to do are idempotent, so just drop the _sync(). Fixes: e5d153ec54f0 ("iwlwifi: mvm: fix CSA AP side") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.b1813c823b4d.I9d20cc06d24fa40b6774d3dd95ea5e2bf8dd015b@changeid Signed-off-by: Johannes Berg commit 9e949dfdc5d1697ccbcc19c06f5133e1833d8eea Author: Johannes Berg Date: Sun May 14 12:15:45 2023 +0300 wifi: iwlwifi: mvm: don't double-init spinlock We don't need to (and shouldn't) initialize the spinlock during HW restart that was already initialized, so move that into the correct if block. Since then we have two consecutive if statements with the same (though inverted) condition, unify those as well. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.221c22cfdf4e.I2e30113ef4bd8cb5bd9e1a69e52a95671914961c@changeid Signed-off-by: Johannes Berg commit 783336b05f06821c9af3b057ecd5a7aa082ed973 Author: Johannes Berg Date: Sun May 14 12:15:44 2023 +0300 wifi: iwlwifi: mvm: always free dup_data There are some assertions in the STA removal code that can fail, and in that case we may leak memory since we skip the freeing. Fix this by freeing the dup_data earlier in the function, we already have a check for when we free the station, and this we don't need to do it with and without MLD API, so it's a win all around. Fixes: a571f5f635ef ("iwlwifi: mvm: add duplicate packet detection per rx queue") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230514120631.173938681d72.Iff4b55fc52943825d6e3e28d78a24b155ea5cd22@changeid Signed-off-by: Johannes Berg commit 04312de4ced4b152749614e8179f3978a20a992f Author: Johannes Berg Date: Thu May 4 16:45:04 2023 +0300 wifi: mac80211: recalc chanctx mindef before assigning When we allocate a new channel context, or find an existing one that is compatible, we currently assign it to a link before its mindef is updated. This leads to strange situations, especially in link switching where you switch to an 80 MHz link and expect it to be active immediately, but the mindef is still configured to 20 MHz while assigning. Also, it's strange that the chandef passed to the assign method's argument is wider than the one in the context. Fix this by calculating the mindef with the new link considered before calling the driver. In particular, this fixes an iwlwifi problem during link switch where the firmware would assert because the (link) station that was added for the AP is configured to transmit at a bandwidth that's wider than the channel context that it's configured on. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230504134511.828474-5-gregory.greenman@intel.com Signed-off-by: Johannes Berg commit b72a455a2409fd94d6d9b4eb51d659a88213243b Author: Johannes Berg Date: Thu May 4 16:45:03 2023 +0300 wifi: mac80211: consider reserved chanctx for mindef When a chanctx is reserved for a new vif and we recalculate the minimal definition for it, we need to consider the new interface it's being reserved for before we assign it, so it can be used directly with the correct min channel width. Fix the code to - optionally - consider that, and use that option just before doing the reassignment. Also, when considering channel context reservations, we should only consider the one link we're currently working with. Change the boolean argument to a link pointer to do that. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230504134511.828474-4-gregory.greenman@intel.com Signed-off-by: Johannes Berg commit 860e1b43da94551cd1e73adc36b3c64cc3e5dc01 Author: Johannes Berg Date: Thu May 4 16:45:02 2023 +0300 wifi: mac80211: simplify chanctx allocation There's no need to call ieee80211_recalc_chanctx_min_def() since it cannot and won't call the driver anyway; just use _ieee80211_recalc_chanctx_min_def() instead. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230504134511.828474-3-gregory.greenman@intel.com Signed-off-by: Johannes Berg commit a23d7f5b2fbda114de60c4b53311e052281d7533 Author: Michael Lee Date: Thu May 4 16:04:41 2023 +0800 wifi: mac80211: Abort running color change when stopping the AP When stopping the AP, there might be a color change in progress. It should be deactivated here, or the driver might later finalize a color change on a stopped AP. Fixes: 5f9404abdf2a (mac80211: add support for BSS color change) Signed-off-by: Michael Lee Link: https://lore.kernel.org/r/20230504080441.22958-1-michael-cy.lee@mediatek.com Signed-off-by: Johannes Berg commit 248e4776514bf70236e6b1a54c65aa5324c8b1eb Author: Johannes Berg Date: Thu May 4 16:45:01 2023 +0300 wifi: mac80211: fix min center freq offset tracing We need to set the correct trace variable, otherwise we're overwriting something else instead and the right one that we print later is not initialized. Fixes: b6011960f392 ("mac80211: handle channel frequency offset") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230504134511.828474-2-gregory.greenman@intel.com Signed-off-by: Johannes Berg commit 9e26f098a2a5a4c4cd327ad911ed2eb9a067a7b8 Author: Gregory Greenman Date: Sun Apr 30 20:18:30 2023 +0300 wifi: iwlwifi: mvm: rfi: disable RFI feature This feature depends on a platform bugfix. Until we have a mechanism that can verify a platform has the required bugfix, disable RFI. Fixes: ef3ed33dfc8f ("wifi: iwlwifi: bump FW API to 77 for AX devices") Reported-by: Jeff Chua Link: https://lore.kernel.org/linux-wireless/CAAJw_ZvZdFpw9W2Hisc9c2BAFbYAnQuaFFaFG6N7qPUP2fOL_w@mail.gmail.com/ Signed-off-by: Gregory Greenman Signed-off-by: Johannes Berg commit 13ad2b1eeacd48ec0f31f55964e6dc7dfc2c0299 Author: Christophe JAILLET Date: Mon Apr 24 19:42:04 2023 +0200 wifi: mac80211: Fix puncturing bitmap handling in __ieee80211_csa_finalize() 'changed' can be OR'ed with BSS_CHANGED_EHT_PUNCTURING which is larger than an u32. So, turn 'changed' into an u64 and update ieee80211_set_after_csa_beacon() accordingly. In the commit in Fixes, only ieee80211_start_ap() was updated. Fixes: 2cc25e4b2a04 ("wifi: mac80211: configure puncturing bitmap") Signed-off-by: Christophe JAILLET Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/e84a3f80fe536787f7a2c7180507efc36cd14f95.1682358088.git.christophe.jaillet@wanadoo.fr Signed-off-by: Johannes Berg commit ef6e1997da63ad0ac3fe33153fec9524c9ae56c9 Author: Mirsad Goran Todorovac Date: Tue Apr 25 18:40:08 2023 +0200 wifi: mac80211: fortify the spinlock against deadlock by interrupt In the function ieee80211_tx_dequeue() there is a particular locking sequence: begin: spin_lock(&local->queue_stop_reason_lock); q_stopped = local->queue_stop_reasons[q]; spin_unlock(&local->queue_stop_reason_lock); However small the chance (increased by ftracetest), an asynchronous interrupt can occur in between of spin_lock() and spin_unlock(), and the interrupt routine will attempt to lock the same &local->queue_stop_reason_lock again. This will cause a costly reset of the CPU and the wifi device or an altogether hang in the single CPU and single core scenario. The only remaining spin_lock(&local->queue_stop_reason_lock) that did not disable interrupts was patched, which should prevent any deadlocks on the same CPU/core and the same wifi device. This is the probable trace of the deadlock: kernel: ================================ kernel: WARNING: inconsistent lock state kernel: 6.3.0-rc6-mt-20230401-00001-gf86822a1170f #4 Tainted: G W kernel: -------------------------------- kernel: inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. kernel: kworker/5:0/25656 [HC0[0]:SC0[0]:HE1:SE1] takes: kernel: ffff9d6190779478 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: return_to_handler+0x0/0x40 kernel: {IN-SOFTIRQ-W} state was registered at: kernel: lock_acquire+0xc7/0x2d0 kernel: _raw_spin_lock+0x36/0x50 kernel: ieee80211_tx_dequeue+0xb4/0x1330 [mac80211] kernel: iwl_mvm_mac_itxq_xmit+0xae/0x210 [iwlmvm] kernel: iwl_mvm_mac_wake_tx_queue+0x2d/0xd0 [iwlmvm] kernel: ieee80211_queue_skb+0x450/0x730 [mac80211] kernel: __ieee80211_xmit_fast.constprop.66+0x834/0xa50 [mac80211] kernel: __ieee80211_subif_start_xmit+0x217/0x530 [mac80211] kernel: ieee80211_subif_start_xmit+0x60/0x580 [mac80211] kernel: dev_hard_start_xmit+0xb5/0x260 kernel: __dev_queue_xmit+0xdbe/0x1200 kernel: neigh_resolve_output+0x166/0x260 kernel: ip_finish_output2+0x216/0xb80 kernel: __ip_finish_output+0x2a4/0x4d0 kernel: ip_finish_output+0x2d/0xd0 kernel: ip_output+0x82/0x2b0 kernel: ip_local_out+0xec/0x110 kernel: igmpv3_sendpack+0x5c/0x90 kernel: igmp_ifc_timer_expire+0x26e/0x4e0 kernel: call_timer_fn+0xa5/0x230 kernel: run_timer_softirq+0x27f/0x550 kernel: __do_softirq+0xb4/0x3a4 kernel: irq_exit_rcu+0x9b/0xc0 kernel: sysvec_apic_timer_interrupt+0x80/0xa0 kernel: asm_sysvec_apic_timer_interrupt+0x1f/0x30 kernel: _raw_spin_unlock_irqrestore+0x3f/0x70 kernel: free_to_partial_list+0x3d6/0x590 kernel: __slab_free+0x1b7/0x310 kernel: kmem_cache_free+0x52d/0x550 kernel: putname+0x5d/0x70 kernel: do_sys_openat2+0x1d7/0x310 kernel: do_sys_open+0x51/0x80 kernel: __x64_sys_openat+0x24/0x30 kernel: do_syscall_64+0x5c/0x90 kernel: entry_SYSCALL_64_after_hwframe+0x72/0xdc kernel: irq event stamp: 5120729 kernel: hardirqs last enabled at (5120729): [] trace_graph_return+0xd6/0x120 kernel: hardirqs last disabled at (5120728): [] trace_graph_return+0xf0/0x120 kernel: softirqs last enabled at (5069900): [] return_to_handler+0x0/0x40 kernel: softirqs last disabled at (5067555): [] return_to_handler+0x0/0x40 kernel: other info that might help us debug this: kernel: Possible unsafe locking scenario: kernel: CPU0 kernel: ---- kernel: lock(&local->queue_stop_reason_lock); kernel: kernel: lock(&local->queue_stop_reason_lock); kernel: *** DEADLOCK *** kernel: 8 locks held by kworker/5:0/25656: kernel: #0: ffff9d618009d138 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work+0x1ca/0x530 kernel: #1: ffffb1ef4637fe68 ((work_completion)(&local->restart_work)){+.+.}-{0:0}, at: process_one_work+0x1ce/0x530 kernel: #2: ffffffff9f166548 (rtnl_mutex){+.+.}-{3:3}, at: return_to_handler+0x0/0x40 kernel: #3: ffff9d6190778728 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: return_to_handler+0x0/0x40 kernel: #4: ffff9d619077b480 (&mvm->mutex){+.+.}-{3:3}, at: return_to_handler+0x0/0x40 kernel: #5: ffff9d61907bacd8 (&trans_pcie->mutex){+.+.}-{3:3}, at: return_to_handler+0x0/0x40 kernel: #6: ffffffff9ef9cda0 (rcu_read_lock){....}-{1:2}, at: iwl_mvm_queue_state_change+0x59/0x3a0 [iwlmvm] kernel: #7: ffffffff9ef9cda0 (rcu_read_lock){....}-{1:2}, at: iwl_mvm_mac_itxq_xmit+0x42/0x210 [iwlmvm] kernel: stack backtrace: kernel: CPU: 5 PID: 25656 Comm: kworker/5:0 Tainted: G W 6.3.0-rc6-mt-20230401-00001-gf86822a1170f #4 kernel: Hardware name: LENOVO 82H8/LNVNB161216, BIOS GGCN51WW 11/16/2022 kernel: Workqueue: events_freezable ieee80211_restart_work [mac80211] kernel: Call Trace: kernel: kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: dump_stack_lvl+0x5f/0xa0 kernel: dump_stack+0x14/0x20 kernel: print_usage_bug.part.46+0x208/0x2a0 kernel: mark_lock.part.47+0x605/0x630 kernel: ? sched_clock+0xd/0x20 kernel: ? trace_clock_local+0x14/0x30 kernel: ? __rb_reserve_next+0x5f/0x490 kernel: ? _raw_spin_lock+0x1b/0x50 kernel: __lock_acquire+0x464/0x1990 kernel: ? mark_held_locks+0x4e/0x80 kernel: lock_acquire+0xc7/0x2d0 kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: ? ftrace_return_to_handler+0x8b/0x100 kernel: ? preempt_count_add+0x4/0x70 kernel: _raw_spin_lock+0x36/0x50 kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: ieee80211_tx_dequeue+0xb4/0x1330 [mac80211] kernel: ? prepare_ftrace_return+0xc5/0x190 kernel: ? ftrace_graph_func+0x16/0x20 kernel: ? 0xffffffffc02ab0b1 kernel: ? lock_acquire+0xc7/0x2d0 kernel: ? iwl_mvm_mac_itxq_xmit+0x42/0x210 [iwlmvm] kernel: ? ieee80211_tx_dequeue+0x9/0x1330 [mac80211] kernel: ? __rcu_read_lock+0x4/0x40 kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_mvm_mac_itxq_xmit+0xae/0x210 [iwlmvm] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_mvm_queue_state_change+0x311/0x3a0 [iwlmvm] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_mvm_wake_sw_queue+0x17/0x20 [iwlmvm] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_txq_gen2_unmap+0x1c9/0x1f0 [iwlwifi] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_txq_gen2_free+0x55/0x130 [iwlwifi] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_txq_gen2_tx_free+0x63/0x80 [iwlwifi] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: _iwl_trans_pcie_gen2_stop_device+0x3f3/0x5b0 [iwlwifi] kernel: ? _iwl_trans_pcie_gen2_stop_device+0x9/0x5b0 [iwlwifi] kernel: ? mutex_lock_nested+0x4/0x30 kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_trans_pcie_gen2_stop_device+0x5f/0x90 [iwlwifi] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_mvm_stop_device+0x78/0xd0 [iwlmvm] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: __iwl_mvm_mac_start+0x114/0x210 [iwlmvm] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: iwl_mvm_mac_start+0x76/0x150 [iwlmvm] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: drv_start+0x79/0x180 [mac80211] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: ieee80211_reconfig+0x1523/0x1ce0 [mac80211] kernel: ? synchronize_net+0x4/0x50 kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: ieee80211_restart_work+0x108/0x170 [mac80211] kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: process_one_work+0x250/0x530 kernel: ? ftrace_regs_caller_end+0x66/0x66 kernel: worker_thread+0x48/0x3a0 kernel: ? __pfx_worker_thread+0x10/0x10 kernel: kthread+0x10f/0x140 kernel: ? __pfx_kthread+0x10/0x10 kernel: ret_from_fork+0x29/0x50 kernel: Fixes: 4444bc2116ae ("wifi: mac80211: Proper mark iTXQs for resumption") Link: https://lore.kernel.org/all/1f58a0d1-d2b9-d851-73c3-93fcc607501c@alu.unizg.hr/ Reported-by: Mirsad Goran Todorovac Cc: Gregory Greenman Cc: Johannes Berg Link: https://lore.kernel.org/all/cdc80531-f25f-6f9d-b15f-25e16130b53a@alu.unizg.hr/ Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Leon Romanovsky Cc: Alexander Wetzel Signed-off-by: Mirsad Goran Todorovac Reviewed-by: Leon Romanovsky Reviewed-by: tag, or it goes automatically? Link: https://lore.kernel.org/r/20230425164005.25272-1-mirsad.todorovac@alu.unizg.hr Signed-off-by: Johannes Berg commit 1b6b4ed01493b7ea2205ab83c49198f7d13ca9d2 Author: Ilan Peer Date: Mon Apr 24 10:32:24 2023 +0300 wifi: cfg80211: Drop entries with invalid BSSIDs in RNR Ignore AP information for entries that include an invalid BSSID in the TBTT information field, e.g., all zeros BSSIDs. Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning") Signed-off-by: Ilan Peer Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230424103224.5e65d04d1448.Ic10c8577ae4a85272c407106c9d0a2ecb5372743@changeid Signed-off-by: Johannes Berg commit 2d2f5f1e8fd91fe848aacde28f738fb8e8d95a27 Author: Dan Carpenter Date: Wed May 3 13:41:27 2023 +0300 accel/qaic: silence some uninitialized variable warnings Smatch complains that these are not initialized if get_cntl_version() fails but we still print them in the debug message. Not the end of the world, but true enough. Let's just initialize them to a dummy value to make the checker happy. Fixes: c501ca23a6a3 ("accel/qaic: Add uapi and core driver file") Signed-off-by: Dan Carpenter Reviewed-by: Jeffrey Hugo Reviewed-by: Carl Vanderlip Reviewed-by: Pranjal Ramajor Asha Kanojiya [jhugo: Add fixes and reorder varable declarations for style] Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/d11ee378-7b06-4b5e-b56f-d66174be1ab3@kili.mountain commit 7dcbdf29282fbcdb646dc785e8a57ed2c2fec8ba Author: Ahmed Zaki Date: Mon Apr 17 12:09:39 2023 -0600 iavf: send VLAN offloading caps once after VFR When the user disables rxvlan offloading and then changes the number of channels, all VLAN ports are unable to receive traffic. Changing the number of channels triggers a VFR reset. During re-init, when VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS is received, we do: 1 - set the IAVF_FLAG_SETUP_NETDEV_FEATURES flag 2 - call iavf_set_vlan_offload_features(adapter, 0, netdev->features); The second step sends to the PF the __default__ features, in this case aq_required |= IAVF_FLAG_AQ_ENABLE_CTAG_VLAN_STRIPPING While the first step forces the watchdog task to call netdev_update_features() -> iavf_set_features() -> iavf_set_vlan_offload_features(adapter, netdev->features, features). Since the user disabled the "rxvlan", this sets: aq_required |= IAVF_FLAG_AQ_DISABLE_CTAG_VLAN_STRIPPING When we start processing the AQ commands, both flags are enabled. Since we process DISABLE_XTAG first then ENABLE_XTAG, this results in the PF enabling the rxvlan offload. This breaks all communications on the VLAN net devices. Fix by removing the call to iavf_set_vlan_offload_features() (second step). Calling netdev_update_features() from watchdog task is enough for both init and reset paths. Fixes: 7598f4b40bd6 ("iavf: Move netdev_update_features() into watchdog task") Signed-off-by: Ahmed Zaki Tested-by: Rafal Romanowski Reviewed-by: Leon Romanovsky Signed-off-by: Tony Nguyen commit 7255355a0636b4eff08d5e8139c77d98f151c4fc Author: Dawid Wesierski Date: Tue Apr 18 11:52:55 2023 +0200 ice: Fix ice VF reset during iavf initialization Fix the current implementation that causes ice_trigger_vf_reset() to start resetting the VF even when the VF-NIC is still initializing. When we reset NIC with ice driver it can interfere with iavf-vf initialization e.g. during consecutive resets induced by ice iavf ice | | |<-----------------| | ice resets vf iavf | reset | start | |<-----------------| | ice resets vf | causing iavf | initialization | error | | iavf reset end This leads to a series of -53 errors (failed to init adminq) from the IAVF. Change the state of the vf_state field to be not active when the IAVF is still initializing. Make sure to wait until receiving the message on the message box to ensure that the vf is ready and initializded. In simple terms we use the ACTIVE flag to make sure that the ice driver knows if the iavf is ready for another reset iavf ice | | | | |<------------- ice resets vf iavf vf_state != ACTIVE reset | start | | | | | iavf | reset-------> vf_state == ACTIVE end ice resets vf | | | | Fixes: c54d209c78b8 ("ice: Wait for VF to be reset/ready before configuration") Signed-off-by: Dawid Wesierski Signed-off-by: Kamil Maziarz Acked-by: Jacob Keller Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit ab7470bc6d8fb5f3004ccc8e4dfd49aab0f27561 Author: Ahmed Zaki Date: Mon Apr 17 17:44:45 2023 -0600 ice: Fix stats after PF reset After a core PF reset, the VFs were showing wrong Rx/Tx stats. This is a regression in commit 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") caused by missing to set "stat_offsets_loaded = false" in the ice_vsi_rebuild() path. Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") Signed-off-by: Ahmed Zaki Reviewed-by: Alexander Lobakin Tested-by: Rafal Romanowski Reviewed-by: Leon Romanovsky Signed-off-by: Tony Nguyen commit e7b8b8ed9960bf699bf4029f482d9e869c094ed6 Author: Gustav Johansson Date: Sat May 6 00:05:07 2023 +0900 ksmbd: smb2: Allow messages padded to 8byte boundary clc length is now accepted to <= 8 less than length, rather than < 8. Solve issues on some of Axis's smb clients which send messages where clc length is 8 bytes less than length. The specific client was running kernel 4.19.217 with smb dialect 3.0.2 on armv7l. Cc: stable@vger.kernel.org Signed-off-by: Gustav Johansson Acked-by: Namjae Jeon Signed-off-by: Steve French commit 443d61d1fa9faa60ef925513d83742902390100f Author: Chih-Yen Chang Date: Sat May 6 00:03:54 2023 +0900 ksmbd: allocate one more byte for implied bcc[0] ksmbd_smb2_check_message allows client to return one byte more, so we need to allocate additional memory in ksmbd_conn_handler_loop to avoid out-of-bound access. Cc: stable@vger.kernel.org Signed-off-by: Chih-Yen Chang Acked-by: Namjae Jeon Signed-off-by: Steve French commit f0a96d1aafd8964e1f9955c830a3e5cb3c60a90f Author: Chih-Yen Chang Date: Sat May 6 00:01:54 2023 +0900 ksmbd: fix wrong UserName check in session_user The offset of UserName is related to the address of security buffer. To ensure the validaty of UserName, we need to compare name_off + name_len with secbuf_len instead of auth_msg_len. [ 27.096243] ================================================================== [ 27.096890] BUG: KASAN: slab-out-of-bounds in smb_strndup_from_utf16+0x188/0x350 [ 27.097609] Read of size 2 at addr ffff888005e3b542 by task kworker/0:0/7 ... [ 27.099950] Call Trace: [ 27.100194] [ 27.100397] dump_stack_lvl+0x33/0x50 [ 27.100752] print_report+0xcc/0x620 [ 27.102305] kasan_report+0xae/0xe0 [ 27.103072] kasan_check_range+0x35/0x1b0 [ 27.103757] smb_strndup_from_utf16+0x188/0x350 [ 27.105474] smb2_sess_setup+0xaf8/0x19c0 [ 27.107935] handle_ksmbd_work+0x274/0x810 [ 27.108315] process_one_work+0x419/0x760 [ 27.108689] worker_thread+0x2a2/0x6f0 [ 27.109385] kthread+0x160/0x190 [ 27.110129] ret_from_fork+0x1f/0x30 [ 27.110454] Cc: stable@vger.kernel.org Signed-off-by: Chih-Yen Chang Acked-by: Namjae Jeon Signed-off-by: Steve French commit 02f76c401d17e409ed45bf7887148fcc22c93c85 Author: Chih-Yen Chang Date: Sun May 14 12:05:05 2023 +0900 ksmbd: fix global-out-of-bounds in smb2_find_context_vals Add tag_len argument in smb2_find_context_vals() to avoid out-of-bound read when create_context's name_len is larger than tag length. [ 7.995411] ================================================================== [ 7.995866] BUG: KASAN: global-out-of-bounds in memcmp+0x83/0xa0 [ 7.996248] Read of size 8 at addr ffffffff8258d940 by task kworker/0:0/7 ... [ 7.998191] Call Trace: [ 7.998358] [ 7.998503] dump_stack_lvl+0x33/0x50 [ 7.998743] print_report+0xcc/0x620 [ 7.999458] kasan_report+0xae/0xe0 [ 7.999895] kasan_check_range+0x35/0x1b0 [ 8.000152] memcmp+0x83/0xa0 [ 8.000347] smb2_find_context_vals+0xf7/0x1e0 [ 8.000635] smb2_open+0x1df2/0x43a0 [ 8.006398] handle_ksmbd_work+0x274/0x810 [ 8.006666] process_one_work+0x419/0x760 [ 8.006922] worker_thread+0x2a2/0x6f0 [ 8.007429] kthread+0x160/0x190 [ 8.007946] ret_from_fork+0x1f/0x30 [ 8.008181] Cc: stable@vger.kernel.org Signed-off-by: Chih-Yen Chang Acked-by: Namjae Jeon Signed-off-by: Steve French commit fe82f16aafdaf8002281d3b9524291d4a4a28460 Author: Mathias Nyman Date: Mon May 15 16:40:59 2023 +0300 xhci: Fix incorrect tracking of free space on transfer rings This incorrect tracking caused unnecessary ring expansion in some usecases which over days of use consume a lot of memory. xhci driver tries to keep track of free transfer blocks (TRBs) on the ring buffer, but failed to add back some cancelled transfers that were turned into no-op operations instead of just moving past them. This can happen if there are several queued pending transfers which then are cancelled in reverse order. Solve this by counting the numer of steps we move the dequeue pointer once we complete a transfer, and add it to the number of free trbs instead of just adding the trb number of the current transfer. This way we ensure we count the no-op trbs on the way as well. Fixes: 55f6153d8cc8 ("xhci: remove extra loop in interrupt context") Cc: stable@vger.kernel.org Reported-by: Miller Hunter Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217242 Tested-by: Miller Hunter Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230515134059.161110-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2a821fc3136d5d99dcb9de152be8a052ca27d870 Author: Mario Limonciello Date: Mon May 15 16:40:58 2023 +0300 xhci-pci: Only run d3cold avoidance quirk for s2idle Donghun reports that a notebook that has an AMD Ryzen 5700U but supports S3 has problems with USB after resuming from suspend. The issue was bisected down to commit d1658268e439 ("usb: pci-quirks: disable D3cold on xhci suspend for s2idle on AMD Renoir"). As this issue only happens on S3, narrow the broken D3cold quirk to only run in s2idle. Fixes: d1658268e439 ("usb: pci-quirks: disable D3cold on xhci suspend for s2idle on AMD Renoir") Reported-and-tested-by: Donghun Yoon Cc: stable@vger.kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230515134059.161110-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1f7aacc5eb9ed2cc17be7a90da5cd559effb9d59 Author: Gaurav Batra Date: Fri May 5 13:47:01 2023 -0500 powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device For an SR-IOV device, while enabling DDW, a new table is created and added at index 1 in the group. In the below 2 scenarios, the table is incorrectly referenced at index 0 (which is where the table is for default DMA window). 1. When adding DDW This issue is exposed with "slub_debug". Error thrown out from dma_iommu_dma_supported() Warning: IOMMU offset too big for device mask mask: 0xffffffff, table offset: 0x800000000000000 2. During Dynamic removal of the PCI device. Error is from iommu_tce_table_put() since a NULL table pointer is passed in. Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Gaurav Batra Reviewed-by: Brian King Signed-off-by: Michael Ellerman Link: https://msgid.link/20230505184701.91613-1-gbatra@linux.vnet.ibm.com commit 096339ab84f36beae0b1db25e0ce63fb3873e8b2 Author: Gaurav Batra Date: Thu May 4 12:59:13 2023 -0500 powerpc/iommu: DMA address offset is incorrectly calculated with 2MB TCEs When DMA window is backed by 2MB TCEs, the DMA address for the mapped page should be the offset of the page relative to the 2MB TCE. The code was incorrectly setting the DMA address to the beginning of the TCE range. Mellanox driver is reporting timeout trying to ENABLE_HCA for an SR-IOV ethernet port, when DMA window is backed by 2MB TCEs. Fixes: 387273118714 ("powerps/pseries/dma: Add support for 2M IOMMU page size") Cc: stable@vger.kernel.org # v5.16+ Signed-off-by: Gaurav Batra Reviewed-by: Greg Joyce Reviewed-by: Brian King Signed-off-by: Michael Ellerman Link: https://msgid.link/20230504175913.83844-1-gbatra@linux.vnet.ibm.com commit ad593827db9b73f15eb65416ec975ec0311f773a Author: Jason Gunthorpe Date: Mon May 15 21:12:31 2023 -0300 powerpc/iommu: Remove iommu_del_device() Now that power calls iommu_device_register() and populates its groups using iommu_ops->device_group it should not be calling iommu_group_remove_device(). The core code owns the groups and all the other related iommu data, it will clean it up automatically. Remove the bus notifiers and explicit calls to iommu_group_remove_device(). Fixes: a940904443e4 ("powerpc/iommu: Add iommu_ops to report capabilities and allow blocking domains") Signed-off-by: Jason Gunthorpe Signed-off-by: Michael Ellerman Link: https://msgid.link/0-v1-1421774b874b+167-ppc_device_group_jgg@nvidia.com commit 2a881183dc5ab2474ef602e48fe7af34db460d95 Author: Krzysztof Kozlowski Date: Sun May 7 16:48:18 2023 +0200 phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc Update kerneldoc of struct qcom_snps_hsphy to fix: drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c:135: warning: Function parameter or member 'update_seq_cfg' not described in 'qcom_snps_hsphy' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230507144818.193039-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit b949193011540bb17cf1da7795ec42af1b875203 Author: Neil Armstrong Date: Fri May 12 15:11:41 2023 +0200 phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value Use the same CNTL2_DIF_TX_CTL0 value used by the vendor, it was reported fixing timings issues. Fixes: 2a56dc650e54 ("phy: amlogic: Add G12A Analog MIPI D-PHY driver") Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20230512-amlogic-v6-4-upstream-dsi-ccf-vim3-v4-10-2592c29ea263@linaro.org Signed-off-by: Vinod Koul commit 03262a3f5b5b910c7c2900c2f8884832794355f5 Author: Tom Rix Date: Tue May 2 10:50:05 2023 -0400 phy: mediatek: rework the floating point comparisons to fixed point gcc on aarch64 reports drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c: In function ‘mtk_hdmi_pll_set_rate’: drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c:240:52: error: ‘-mgeneral-regs-only’ is incompatible with the use of floating-point types 240 | else if (tmds_clk >= 54 * MEGA && tmds_clk < 148.35 * MEGA) Floating point should not be used, so rework the floating point comparisons to fixed point. Signed-off-by: Tom Rix Reviewed-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230502145005.2927101-1-trix@redhat.com Signed-off-by: Vinod Koul commit c4c597f1b367433c52c531dccd6859a39b4580fb Author: Peter Collingbourne Date: Thu Apr 20 14:43:27 2023 -0700 arm64: mte: Do not set PG_mte_tagged if tags were not initialized The mte_sync_page_tags() function sets PG_mte_tagged if it initializes page tags. Then we return to mte_sync_tags(), which sets PG_mte_tagged again. At best, this is redundant. However, it is possible for mte_sync_page_tags() to return without having initialized tags for the page, i.e. in the case where check_swap is true (non-compound page), is_swap_pte(old_pte) is false and pte_is_tagged is false. So at worst, we set PG_mte_tagged on a page with uninitialized tags. This can happen if, for example, page migration causes a PTE for an untagged page to be replaced. If the userspace program subsequently uses mprotect() to enable PROT_MTE for that page, the uninitialized tags will be exposed to userspace. Fix it by removing the redundant call to set_page_mte_tagged(). Fixes: e059853d14ca ("arm64: mte: Fix/clarify the PG_mte_tagged semantics") Signed-off-by: Peter Collingbourne Cc: # 6.1 Link: https://linux-review.googlesource.com/id/Ib02d004d435b2ed87603b858ef7480f7b1463052 Reviewed-by: Catalin Marinas Reviewed-by: Alexandru Elisei Link: https://lore.kernel.org/r/20230420214327.2357985-1-pcc@google.com Signed-off-by: Will Deacon commit 2efbafb91e12ff5a16cbafb0085e4c10c3fca493 Author: Peter Collingbourne Date: Thu Apr 20 14:09:45 2023 -0700 arm64: Also reset KASAN tag if page is not PG_mte_tagged Consider the following sequence of events: 1) A page in a PROT_READ|PROT_WRITE VMA is faulted. 2) Page migration allocates a page with the KASAN allocator, causing it to receive a non-match-all tag, and uses it to replace the page faulted in 1. 3) The program uses mprotect() to enable PROT_MTE on the page faulted in 1. As a result of step 3, we are left with a non-match-all tag for a page with tags accessible to userspace, which can lead to the same kind of tag check faults that commit e74a68468062 ("arm64: Reset KASAN tag in copy_highpage with HW tags only") intended to fix. The general invariant that we have for pages in a VMA with VM_MTE_ALLOWED is that they cannot have a non-match-all tag. As a result of step 2, the invariant is broken. This means that the fix in the referenced commit was incomplete and we also need to reset the tag for pages without PG_mte_tagged. Fixes: e5b8d9218951 ("arm64: mte: reset the page tag in page->flags") Cc: # 5.15 Link: https://linux-review.googlesource.com/id/I7409cdd41acbcb215c2a7417c1e50d37b875beff Signed-off-by: Peter Collingbourne Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20230420210945.2313627-1-pcc@google.com Signed-off-by: Will Deacon commit 3bc879e355da4ff925e9d82278a829547d9d54bf Author: Geert Uytterhoeven Date: Mon May 8 18:05:19 2023 +0200 arm64: perf: Mark all accessor functions inline When just including : arch/arm64/include/asm/arm_pmuv3.h:31:13: error: ‘write_pmevtypern’ defined but not used [-Werror=unused-function] 31 | static void write_pmevtypern(int n, unsigned long val) | ^~~~~~~~~~~~~~~~ arch/arm64/include/asm/arm_pmuv3.h:24:13: error: ‘write_pmevcntrn’ defined but not used [-Werror=unused-function] 24 | static void write_pmevcntrn(int n, unsigned long val) | ^~~~~~~~~~~~~~~ arch/arm64/include/asm/arm_pmuv3.h:16:22: error: ‘read_pmevcntrn’ defined but not used [-Werror=unused-function] 16 | static unsigned long read_pmevcntrn(int n) | ^~~~~~~~~~~~~~ Fix this by adding the missing "inline" keywords to the three accessor functions that lack them. Fixes: df29ddf4f04b ("arm64: perf: Abstract system register accesses away") Signed-off-by: Geert Uytterhoeven Reviewed-by: Marc Zyngier Acked-by: Mark Rutland Link: https://lore.kernel.org/r/d53a19043c0c3bd25f6c203e73a2fb08a9661824.1683561482.git.geert+renesas@glider.be Signed-off-by: Will Deacon commit 68e3f61eb9f58798e28b18152cd38cb269eebc34 Author: Geert Uytterhoeven Date: Mon May 8 18:05:18 2023 +0200 ARM: perf: Mark all accessor functions inline When just including : arch/arm/include/asm/arm_pmuv3.h:110:13: error: ‘write_pmevtypern’ defined but not used [-Werror=unused-function] 110 | static void write_pmevtypern(int n, unsigned long val) | ^~~~~~~~~~~~~~~~ arch/arm/include/asm/arm_pmuv3.h:103:13: error: ‘write_pmevcntrn’ defined but not used [-Werror=unused-function] 103 | static void write_pmevcntrn(int n, unsigned long val) | ^~~~~~~~~~~~~~~ arch/arm/include/asm/arm_pmuv3.h:95:22: error: ‘read_pmevcntrn’ defined but not used [-Werror=unused-function] 95 | static unsigned long read_pmevcntrn(int n) | ^~~~~~~~~~~~~~ Fix this by adding the missing "inline" keywords to the three accessor functions that lack them. Fixes: 009d6dc87a56 ("ARM: perf: Allow the use of the PMUv3 driver on 32bit ARM") Signed-off-by: Geert Uytterhoeven Acked-by: Mark Rutland Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/3a7d9bc7470aa2d85696ee9765c74f8c03fb5454.1683561482.git.geert+renesas@glider.be Signed-off-by: Will Deacon commit b0abde80620f42d1ceb3de5e4c1a49cdd5628229 Author: Linus Walleij Date: Wed May 10 08:48:11 2023 +0200 arm64: vdso: Pass (void *) to virt_to_page() Like the other calls in this function virt_to_page() expects a pointer, not an integer. However since many architectures implement virt_to_pfn() as a macro, this function becomes polymorphic and accepts both a (unsigned long) and a (void *). Fix this up with an explicit cast. Signed-off-by: Linus Walleij Link: http://lists.infradead.org/pipermail/linux-arm-kernel/2023-May/832583.html Signed-off-by: Will Deacon commit d91d580878064b880f3574ac35b98d8b70ee8620 Author: Min-Hua Chen Date: Tue May 2 23:19:06 2023 +0800 arm64/mm: mark private VM_FAULT_X defines as vm_fault_t This patch fixes several sparse warnings for fault.c: arch/arm64/mm/fault.c:493:24: sparse: warning: incorrect type in return expression (different base types) arch/arm64/mm/fault.c:493:24: sparse: expected restricted vm_fault_t arch/arm64/mm/fault.c:493:24: sparse: got int arch/arm64/mm/fault.c:501:32: sparse: warning: incorrect type in return expression (different base types) arch/arm64/mm/fault.c:501:32: sparse: expected restricted vm_fault_t arch/arm64/mm/fault.c:501:32: sparse: got int arch/arm64/mm/fault.c:503:32: sparse: warning: incorrect type in return expression (different base types) arch/arm64/mm/fault.c:503:32: sparse: expected restricted vm_fault_t arch/arm64/mm/fault.c:503:32: sparse: got int arch/arm64/mm/fault.c:511:24: sparse: warning: incorrect type in return expression (different base types) arch/arm64/mm/fault.c:511:24: sparse: expected restricted vm_fault_t arch/arm64/mm/fault.c:511:24: sparse: got int arch/arm64/mm/fault.c:670:13: sparse: warning: restricted vm_fault_t degrades to integer arch/arm64/mm/fault.c:670:13: sparse: warning: restricted vm_fault_t degrades to integer arch/arm64/mm/fault.c:713:39: sparse: warning: restricted vm_fault_t degrades to integer Reported-by: kernel test robot Signed-off-by: Min-Hua Chen Link: https://lore.kernel.org/r/20230502151909.128810-1-minhuadotchen@gmail.com Signed-off-by: Will Deacon commit 2e4be0d011f21593c6b316806779ba1eba2cd7e0 Author: Vernon Lovejoy Date: Fri May 12 12:42:32 2023 +0200 x86/show_trace_log_lvl: Ensure stack pointer is aligned, again The commit e335bb51cc15 ("x86/unwind: Ensure stack pointer is aligned") tried to align the stack pointer in show_trace_log_lvl(), otherwise the "stack < stack_info.end" check can't guarantee that the last read does not go past the end of the stack. However, we have the same problem with the initial value of the stack pointer, it can also be unaligned. So without this patch this trivial kernel module #include static int init(void) { asm volatile("sub $0x4,%rsp"); dump_stack(); asm volatile("add $0x4,%rsp"); return -EAGAIN; } module_init(init); MODULE_LICENSE("GPL"); crashes the kernel. Fixes: e335bb51cc15 ("x86/unwind: Ensure stack pointer is aligned") Signed-off-by: Vernon Lovejoy Signed-off-by: Oleg Nesterov Link: https://lore.kernel.org/r/20230512104232.GA10227@redhat.com Signed-off-by: Josh Poimboeuf commit f7ba52f302fdc392e0047f38e50841483d997144 Author: Josh Poimboeuf Date: Tue Apr 18 14:49:25 2023 -0700 vmlinux.lds.h: Discard .note.gnu.property section When tooling reads ELF notes, it assumes each note entry is aligned to the value listed in the .note section header's sh_addralign field. The kernel-created ELF notes in the .note.Linux and .note.Xen sections are aligned to 4 bytes. This causes the toolchain to set those sections' sh_addralign values to 4. On the other hand, the GCC-created .note.gnu.property section has an sh_addralign value of 8 for some reason, despite being based on struct Elf32_Nhdr which only needs 4-byte alignment. When the mismatched input sections get linked together into the vmlinux .notes output section, the higher alignment "wins", resulting in an sh_addralign of 8, which confuses tooling. For example: $ readelf -n .tmp_vmlinux.btf ... readelf: .tmp_vmlinux.btf: Warning: note with invalid namesz and/or descsz found at offset 0x170 readelf: .tmp_vmlinux.btf: Warning: type: 0x4, namesize: 0x006e6558, descsize: 0x00008801, alignment: 8 In this case readelf thinks there's alignment padding where there is none, so it starts reading an ELF note in the middle. With newer toolchains (e.g., latest Fedora Rawhide), a similar mismatch triggers a build failure when combined with CONFIG_X86_KERNEL_IBT: btf_encoder__encode: btf__dedup failed! Failed to encode BTF libbpf: failed to find '.BTF' ELF section in vmlinux FAILED: load BTF from vmlinux: No data available make[1]: *** [scripts/Makefile.vmlinux:35: vmlinux] Error 255 This latter error was caused by pahole crashing when it encountered the corrupt .notes section. This crash has been fixed in dwarves version 1.25. As Tianyi Liu describes: "Pahole reads .notes to look for LINUX_ELFNOTE_BUILD_LTO. When LTO is enabled, pahole needs to call cus__merge_and_process_cu to merge compile units, at which point there should only be one unspecified type (used to represent some compilation information) in the global context. However, when the kernel is compiled without LTO, if pahole calls cus__merge_and_process_cu due to alignment issues with notes, multiple unspecified types may appear after merging the cus, and older versions of pahole only support up to one. This is why pahole 1.24 crashes, while newer versions support multiple. However, the latest version of pahole still does not solve the problem of incorrect LTO recognition, so compiling the kernel may be slower than normal." Even with the newer pahole, the note section misaligment issue still exists and pahole is misinterpreting the LTO note. Fix it by discarding the .note.gnu.property section. While GNU properties are important for user space (and VDSO), they don't seem to have any use for vmlinux. (In fact, they're already getting (inadvertently) stripped from vmlinux when CONFIG_DEBUG_INFO_BTF is enabled. The BTF data is extracted from vmlinux.o with "objcopy --only-section=.BTF" into .btf.vmlinux.bin.o. That file doesn't have .note.gnu.property, so when it gets modified and linked back into the main object, the linker automatically strips it (see "How GNU properties are merged" in the ld man page).) Reported-by: Daniel Xu Link: https://lkml.kernel.org/bpf/57830c30-cd77-40cf-9cd1-3bb608aa602e@app.fastmail.com Debugged-by: Tianyi Liu Suggested-by: Joan Bruguera Micó Link: https://lore.kernel.org/r/20230418214925.ay3jpf2zhw75kgmd@treble Signed-off-by: Josh Poimboeuf commit 5b10ff013e8a57f8845615ac2cc37edf7f6eef05 Author: Martin Hundebøll Date: Fri May 12 08:49:25 2023 +0200 pinctrl: meson-axg: add missing GPIOA_18 gpio group Without this, the gpio cannot be explicitly mux'ed to its gpio function. Fixes: 83c566806a68a ("pinctrl: meson-axg: Add new pinctrl driver for Meson AXG SoC") Cc: stable@vger.kernel.org Signed-off-by: Martin Hundebøll Reviewed-by: Neil Armstrong Reviewed-by: Dmitry Rokosov Link: https://lore.kernel.org/r/20230512064925.133516-1-martin@geanix.com Signed-off-by: Linus Walleij commit 0f554e37dad416f445cd3ec5935f5aec1b0e7ba5 Author: Frank Li Date: Mon May 15 12:20:53 2023 -0400 arm64: dts: imx8: fix USB 3.0 Gadget Failure in QM & QXPB0 at super speed Resolve USB 3.0 gadget failure for QM and QXPB0 in super speed mode with single IN and OUT endpoints, like mass storage devices, due to incorrect ACTUAL_MEM_SIZE in ep_cap2 (32k instead of actual 18k). Implement dt property cdns,on-chip-buff-size to override ep_cap2 and set it to 18k for imx8QM and imx8QXP chips. No adverse effects for 8QXP C0. Cc: stable@vger.kernel.org Fixes: dce49449e04f ("usb: cdns3: allocate TX FIFO size according to composite EP number") Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 50a1726b148ff30778cb8a6cf3736130b07c93fd Author: Frank Li Date: Mon May 15 12:20:52 2023 -0400 dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type In cdns3-gadget.c, 'cdns,on-chip-buff-size' was read using device_property_read_u16(). It resulted in 0 if a 32bit value was used in dts. This commit fixes the dt binding doc to declare it as u16. Cc: stable@vger.kernel.org Fixes: 68989fe1c39d ("dt-bindings: usb: Convert cdns-usb3.txt to YAML schema") Signed-off-by: Frank Li Reviewed-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit cddb536a73ef2c82ce04059dc61c65e85a355561 Author: Kefeng Wang Date: Fri May 5 17:06:54 2023 +0800 irqchip/mbigen: Unify the error handling in mbigen_of_create_domain() Dan Carpenter reported that commit fea087fc291b "irqchip/mbigen: move to use bus_get_dev_root()" leads to the following Smatch static checker warning: drivers/irqchip/irq-mbigen.c:258 mbigen_of_create_domain() error: potentially dereferencing uninitialized 'child'. It should not cause a problem on real hardware, but better to fix the warning, let's move the bus_get_dev_root() out of the loop, and unify the error handling to silence it. Reported-by: Dan Carpenter Signed-off-by: Kefeng Wang Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230505090654.12793-1-wangkefeng.wang@huawei.com commit 14130211be5366a91ec07c3284c183b75d8fba17 Author: Krzysztof Kozlowski Date: Fri May 12 18:45:06 2023 +0200 irqchip/meson-gpio: Mark OF related data as maybe unused The driver can be compile tested with !CONFIG_OF making certain data unused: drivers/irqchip/irq-meson-gpio.c:153:34: error: ‘meson_irq_gpio_matches’ defined but not used [-Werror=unused-const-variable=] Acked-by: Martin Blumenstingl Signed-off-by: Krzysztof Kozlowski Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230512164506.212267-1-krzysztof.kozlowski@linaro.org commit 3d6a0e4197c04599d75d85a608c8bb16a630a38c Author: Jiaxun Yang Date: Mon Apr 24 11:31:56 2023 +0100 irqchip/mips-gic: Use raw spinlock for gic_lock Since we may hold gic_lock in hardirq context, use raw spinlock makes more sense given that it is for low-level interrupt handling routine and the critical section is small. Fixes BUG: [ 0.426106] ============================= [ 0.426257] [ BUG: Invalid wait context ] [ 0.426422] 6.3.0-rc7-next-20230421-dirty #54 Not tainted [ 0.426638] ----------------------------- [ 0.426766] swapper/0/1 is trying to lock: [ 0.426954] ffffffff8104e7b8 (gic_lock){....}-{3:3}, at: gic_set_type+0x30/08 Fixes: 95150ae8b330 ("irqchip: mips-gic: Implement irq_set_type callback") Cc: stable@vger.kernel.org Signed-off-by: Jiaxun Yang Reviewed-by: Serge Semin Tested-by: Serge Semin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230424103156.66753-3-jiaxun.yang@flygoat.com commit 2c6c9c049510163090b979ea5f92a68ae8d93c45 Author: Jiaxun Yang Date: Mon Apr 24 11:31:55 2023 +0100 irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable When a GIC local interrupt is not routable, it's vl_map will be used to control some internal states for core (providing IPTI, IPPCI, IPFDC input signal for core). Overriding it will interfere core's intetrupt controller. Do not touch vl_map if a local interrupt is not routable, we are not going to remap it. Before dd098a0e0319 (" irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()"), if a local interrupt is not routable, then it won't be requested from GIC Local domain, and thus gic_all_vpes_irq_cpu_online won't be called for that particular interrupt. Fixes: dd098a0e0319 (" irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()") Cc: stable@vger.kernel.org Signed-off-by: Jiaxun Yang Reviewed-by: Serge Semin Tested-by: Serge Semin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230424103156.66753-2-jiaxun.yang@flygoat.com commit 44bd78dd2b8897f59b7e3963f088caadb7e4f047 Author: Douglas Anderson Date: Mon May 15 13:13:51 2023 -0700 irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues Some Chromebooks with Mediatek SoCs have a problem where the firmware doesn't properly save/restore certain GICR registers. Newer Chromebooks should fix this issue and we may be able to do firmware updates for old Chromebooks. At the moment, the only known issue with these Chromebooks is that we can't enable "pseudo NMIs" since the priority register can be lost. Enabling "pseudo NMIs" on Chromebooks with the problematic firmware causes crashes and freezes. Let's detect devices with this problem and then disable "pseudo NMIs" on them. We'll detect the problem by looking for the presence of the "mediatek,broken-save-restore-fw" property in the GIC device tree node. Any devices with fixed firmware will not have this property. Our detection plan works because we never bake a Chromebook's device tree into firmware. Instead, device trees are always bundled with the kernel. We'll update the device trees of all affected Chromebooks and then we'll never enable "pseudo NMI" on a kernel that is bundled with old device trees. When a firmware update is shipped that fixes this issue it will know to patch the device tree to remove the property. In order to make this work, the quick detection mechanism of the GICv3 code is extended to be able to look for properties in addition to looking at "compatible". Reviewed-by: Julius Werner Signed-off-by: Douglas Anderson Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230515131353.v2.2.I88dc0a0eb1d9d537de61604cd8994ecc55c0cac1@changeid commit 43cd3ddbff3c1635d0e09fe5b09af48d39dbb9d7 Author: Douglas Anderson Date: Mon May 15 13:13:50 2023 -0700 dt-bindings: interrupt-controller: arm,gic-v3: Add quirk for Mediatek SoCs w/ broken FW When trying to turn on the "pseudo NMI" kernel feature in Linux, it was discovered that all Mediatek-based Chromebooks that ever shipped (at least ones with GICv3) had a firmware bug where they wouldn't save certain GIC "GICR" registers properly. If a processor ever entered a suspend/idle mode where the GICR registers lost state then they'd be reset to their default state. As a result of the bug, if you try to enable "pseudo NMIs" on the affected devices then certain interrupts will unexpectedly get promoted to be "pseudo NMIs" and cause crashes / freezes / general mayhem. ChromeOS is looking to start turning on "pseudo NMIs" in production to make crash reports more actionable. To do so, we will release firmware updates for at least some of the affected Mediatek Chromebooks. However, even when we update the firmware of a Chromebook it's always possible that a user will end up booting with old firmware. We need to be able to detect when we're running with firmware that will crash and burn if pseudo NMIs are enabled. The current plan is: * Update the device trees of all affected Chromebooks to include the 'mediatek,broken-save-restore-fw' property. The kernel can use this to know not to enable certain features like "pseudo NMI". NOTE: device trees for Chromebooks are never baked into the firmware but are bundled with the kernel. A kernel will never be configured to use "pseudo NMIs" and be bundled with an old device tree. * When we get a fixed firmware for one of these Chromebooks, it will patch the device tree to remove this property. For some details, you can also see the public bug Reviewed-by: Julius Werner Signed-off-by: Douglas Anderson Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230515131353.v2.1.Iabe67a827e206496efec6beb5616d5a3b99c1e65@changeid commit 140809738d969376f26f13264b16669703956f6c Author: Linus Walleij Date: Mon May 15 11:29:43 2023 +0200 drm/pl111: Fix FB depth on IMPD-1 framebuffer The last argument to the function drm_fbdev_dma_setup() was changed from desired BPP to desired depth. In our case the desired depth was 15 but BPP was 16, so we specified 16 as BPP and we relied on the FB emulation core to select a format with a suitable depth for the limited bandwidth and end up with e.g. XRGB1555 like in the past: [drm] Initialized pl111 1.0.0 20170317 for c1000000.display on minor 0 drm-clcd-pl111 c1000000.display: [drm] requested bpp 16, scaled depth down to 15 drm-clcd-pl111 c1000000.display: enable IM-PD1 CLCD connectors Console: switching to colour frame buffer device 80x30 drm-clcd-pl111 c1000000.display: [drm] fb0: pl111drmfb frame buffer device However the current code will fail at that: [drm] Initialized pl111 1.0.0 20170317 for c1000000.display on minor 0 drm-clcd-pl111 c1000000.display: [drm] bpp/depth value of 16/16 not supported drm-clcd-pl111 c1000000.display: [drm] No compatible format found drm-clcd-pl111 c1000000.display: [drm] *ERROR* fbdev: Failed to setup generic emulation (ret=-12) Fix this by passing the desired depth of 15 for the IM/PD-1 display instead of 16 to drm_fbdev_dma_setup(). The desired depth is however in turn used for bandwidth limiting calculations and that was done with a simple / integer division, whereas we now have to modify that to use DIV_ROUND_UP() so that we get DIV_ROUND_UP(15, 2) = 2 not 15/2 = 1. After this the display works again on the Integrator/AP IM/PD-1. Cc: Emma Anholt Cc: stable@vger.kernel.org Suggested-by: Thomas Zimmermann Fixes: 37c90d589dc0 ("drm/fb-helper: Fix single-probe color-format selection") Link: https://lore.kernel.org/dri-devel/20230102112927.26565-1-tzimmermann@suse.de/ Reviewed-by: Thomas Zimmermann Signed-off-by: Linus Walleij Link: https://patchwork.freedesktop.org/patch/msgid/20230515092943.1401558-1-linus.walleij@linaro.org commit 225c657945c4a6307741cb3cc89467eadcc26e9b Author: Florian Fainelli Date: Sun May 14 19:56:07 2023 -0700 net: bcmgenet: Restore phy_stop() depending upon suspend/close Removing the phy_stop() from bcmgenet_netif_stop() ended up causing warnings from the PHY library that phy_start() is called from the RUNNING state since we are no longer stopping the PHY state machine during bcmgenet_suspend(). Restore the call to phy_stop() but make it conditional on being called from the close or suspend path. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Fixes: 93e0401e0fc0 ("net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()") Signed-off-by: Florian Fainelli Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230515025608.2587012-1-f.fainelli@gmail.com Signed-off-by: Paolo Abeni commit 445164e8c136f1445caf735d6d268c948e71caf1 Author: Amit Kumar Mahapatra Date: Mon May 15 18:33:43 2023 +0530 spi: dw: Replace spi->chip_select references with function calls New set/get APIs for accessing spi->chip_select were introduced by 'commit 9e264f3f85a5 ("spi: Replace all spi->chip_select and spi->cs_gpiod references with function call")', but the 'commit 2c8606040a80 ("spi: dw: Add support for AMD Pensando Elba SoC")' uses the old interface by directly accessing spi->chip_select. So, replace all spi->chip_select references in the driver with new get/set APIs. Signed-off-by: Amit Kumar Mahapatra Date: Mon May 15 22:29:38 2023 +0500 regulator: Fix error checking for debugfs_create_dir This patch fixes the error checking in core.c in debugfs_create_dir. The correct way to check if an error occurred is 'IS_ERR' inline function. Signed-off-by: Osama Muhammad Date: Wed May 10 17:54:03 2023 -0700 tpm/tpm_tis: Disable interrupts for more Lenovo devices The P360 Tiny suffers from an irq storm issue like the T490s, so add an entry for it to tpm_tis_dmi_table, and force polling. There also previously was a report from the previous attempt to enable interrupts that involved a ThinkPad L490. So an entry is added for it as well. Cc: stable@vger.kernel.org Reported-by: Peter Zijlstra # P360 Tiny Closes: https://lore.kernel.org/linux-integrity/20230505130731.GO83892@hirez.programming.kicks-ass.net/ Signed-off-by: Jerry Snitselaar Signed-off-by: Jarkko Sakkinen commit 99d46450625590d410f86fe4660a5eff7d3b8343 Author: Jarkko Sakkinen Date: Wed Apr 26 20:29:28 2023 +0300 tpm: Prevent hwrng from activating during resume Set TPM_CHIP_FLAG_SUSPENDED in tpm_pm_suspend() and reset in tpm_pm_resume(). While the flag is set, tpm_hwrng() gives back zero bytes. This prevents hwrng from racing during resume. Cc: stable@vger.kernel.org Fixes: 6e592a065d51 ("tpm: Move Linux RNG connection to hwrng") Reviewed-by: Jerry Snitselaar Signed-off-by: Jarkko Sakkinen commit 1398aa803f198b7a386fdd8404666043e95f4c16 Author: Jarkko Sakkinen Date: Wed Apr 26 20:29:27 2023 +0300 tpm_tis: Use tpm_chip_{start,stop} decoration inside tpm_tis_resume Before sending a TPM command, CLKRUN protocol must be disabled. This is not done in the case of tpm1_do_selftest() call site inside tpm_tis_resume(). Address this by decorating the calls with tpm_chip_{start,stop}, which should be always used to arm and disarm the TPM chip for transmission. Finally, move the call to the main TPM driver callback as the last step because it should arm the chip by itself, if it needs that type of functionality. Cc: stable@vger.kernel.org Reported-by: Jason A. Donenfeld Closes: https://lore.kernel.org/linux-integrity/CS68AWILHXS4.3M36M1EKZLUMS@suppilovahvero/ Fixes: a3fbfae82b4c ("tpm: take TPM chip power gating out of tpm_transmit()") Reviewed-by: Jerry Snitselaar Signed-off-by: Jarkko Sakkinen commit 4cbb0d358883a27e432714b5256f0362946f5e25 Author: Kang Chen Date: Mon Feb 27 11:14:10 2023 +0800 power: supply: mt6360: add a check of devm_work_autocancel in mt6360_charger_probe devm_work_autocancel may fail, add a check and return early. Fixes: 0402e8ebb8b86 ("power: supply: mt6360_charger: add MT6360 charger support") Signed-off-by: Kang Chen Signed-off-by: Sebastian Reichel commit b2f2a3c9800208b0db2c2e34b05323757117faa2 Author: Daisuke Nojiri Date: Mon Apr 24 11:25:58 2023 -0700 power: supply: sbs-charger: Fix INHIBITED bit for Status reg CHARGE_INHIBITED bit position of the ChargerStatus register is actually 0 not 1. This patch corrects it. Fixes: feb583e37f8a8 ("power: supply: add sbs-charger driver") Signed-off-by: Daisuke Nojiri Signed-off-by: Sebastian Reichel commit c08e24013aba49a593424715ffc04c928c84b9c9 Merge: 4920bded3ee07 0920ccdf41e30 Author: Marc Kleine-Budde Date: Mon May 15 22:26:39 2023 +0200 Merge patch series "can: bxcan: add support for single peripheral configuration" Dario Binacchi says: The series adds support for managing bxCAN controllers in single peripheral configuration. Unlike stm32f4 SOCs, where bxCAN controllers are only in dual peripheral configuration, stm32f7 SOCs contain three CAN peripherals, CAN1 and CAN2 in dual peripheral configuration and CAN3 in single peripheral configuration: - Dual CAN peripheral configuration: * CAN1: Primary bxCAN for managing the communication between a secondary bxCAN and the 512-byte SRAM memory. * CAN2: Secondary bxCAN with no direct access to the SRAM memory. This means that the two bxCAN cells share the 512-byte SRAM memory and CAN2 can't be used without enabling CAN1. - Single CAN peripheral configuration: * CAN3: Primary bxCAN with dedicated Memory Access Controller unit and 512-byte SRAM memory. The driver has been tested on the stm32f769i-discovery board with a kernel version 5.19.0-rc2 in loopback + silent mode: | ip link set can[0-2] type can bitrate 125000 loopback on listen-only on | ip link set up can[0-2] | candump can[0-2] -L & | cansend can[0-2] 300#AC.AB.AD.AE.75.49.AD.D1 Changes in v2: - s/fiter/filter/ in the commit message - Replace struct bxcan_mb::primary with struct bxcan_mb::cfg. - Move after the patch "can: bxcan: add support for single peripheral configuration". - Add node gcan3. - Rename gcan as gcan1. - Add property "st,can-secondary" to can2 node. - Drop patch "dt-bindings: mfd: stm32f7: add binding definition for CAN3" because it has been accepted. - Add patch "ARM: dts: stm32f429: put can2 in secondary mode". - Add patch "dt-bindings: net: can: add "st,can-secondary" property". v1: https://lore.kernel.org/all/20230423172528.1398158-1-dario.binacchi@amarulasolutions.com Link: https://lore.kernel.org/all/20230427204540.3126234-1-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 0920ccdf41e3078a4dd2567eb905ea154bc826e6 Author: Dario Binacchi Date: Thu Apr 27 22:45:40 2023 +0200 ARM: dts: stm32: add CAN support on stm32f746 Add support for bxcan (Basic eXtended CAN controller) to STM32F746. The chip contains three CAN peripherals, CAN1 and CAN2 in dual peripheral configuration and CAN3 in single peripheral configuration: - Dual CAN peripheral configuration: * CAN1: Primary bxCAN for managing the communication between a secondary bxCAN and the 512-byte SRAM memory. * CAN2: Secondary bxCAN with no direct access to the SRAM memory. This means that the two bxCAN cells share the 512-byte SRAM memory and CAN2 can't be used without enabling CAN1. - Single CAN peripheral configuration: * CAN3: Primary bxCAN with dedicated Memory Access Controller unit and 512-byte SRAM memory. ------------------------------------------------------------------------- | features | CAN1 | CAN2 | CAN 3 | ------------------------------------------------------------------------- | SRAM | 512-byte shared between CAN1 & CAN2 | 512-byte | ------------------------------------------------------------------------- | Filters | 26 filters shared between CAN1 & CAN2 | 14 filters | ------------------------------------------------------------------------- Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20230427204540.3126234-6-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 85a79b971164c4636b2db7f4aef9788142e3f885 Author: Dario Binacchi Date: Thu Apr 27 22:45:39 2023 +0200 can: bxcan: add support for single peripheral configuration Add support for bxCAN controller in single peripheral configuration: - primary bxCAN - dedicated Memory Access Controller unit - 512-byte SRAM memory - 14 filter banks Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20230427204540.3126234-5-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 011644249686f2675e142519cd59e81e04cfc231 Author: Dario Binacchi Date: Thu Apr 27 22:45:38 2023 +0200 ARM: dts: stm32: add pin map for CAN controller on stm32f7 Add pin configurations for using CAN controller on stm32f7. Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20230427204540.3126234-4-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 6b443faa313c519db755ff90be32758fd9c66453 Author: Dario Binacchi Date: Thu Apr 27 22:45:37 2023 +0200 ARM: dts: stm32f429: put can2 in secondary mode This is a preparation patch for the upcoming support to manage CAN peripherals in single configuration. The addition ensures backwards compatibility. Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20230427204540.3126234-3-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit caf78f0f491981893b6a5a71c9dabd2734909c4a Author: Dario Binacchi Date: Thu Apr 27 22:45:36 2023 +0200 dt-bindings: net: can: add "st,can-secondary" property On the stm32f7 Socs the can peripheral can be in single or dual configuration. In the dual configuration, in turn, it can be in primary or secondary mode. The addition of the 'st,can-secondary' property allows you to specify this mode in the dual configuration. CAN peripheral nodes in single configuration contain neither "st,can-primary" nor "st,can-secondary". Signed-off-by: Dario Binacchi Reviewed-by: Rob Herring Link: https://lore.kernel.org/all/20230427204540.3126234-2-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 4920bded3ee077c99cd52666519cb50f9ee35b26 Author: Geert Uytterhoeven Date: Tue Apr 4 13:59:00 2023 +0200 can: CAN_BXCAN should depend on ARCH_STM32 The STMicroelectronics STM32 basic extended CAN Controller (bxCAN) is only present on STM32 SoCs. Hence drop the "|| OF" part from its dependency rule, to prevent asking the user about this driver when configuring a kernel without STM32 SoC support. Fixes: f00647d8127be4d3 ("can: bxcan: add support for ST bxCAN controller") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman Link: https://lore.kernel.org/all/40095112efd1b2214e4223109fd9f0c6d0158a2d.1680609318.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 6bffdc38f9935bae49f980448f3f6be2dada0564 Author: Oliver Hartkopp Date: Sat May 6 20:45:15 2023 +0200 can: dev: fix missing CAN XL support in can_put_echo_skb() can_put_echo_skb() checks for the enabled IFF_ECHO flag and the correct ETH_P type of the given skbuff. When implementing the CAN XL support the new check for ETH_P_CANXL has been forgotten. Fixes: fb08cba12b52 ("can: canxl: update CAN infrastructure for CAN XL frames") Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230506184515.39241-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 1db080cbdbab28752bbb1c86d64daf96253a5da1 Author: Oliver Hartkopp Date: Thu Apr 6 13:08:45 2023 +0200 can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag The control message provided by J1939 support MSG_CMSG_COMPAT but blocked recvmsg() syscalls that have set this flag, i.e. on 32bit user space on 64 bit kernels. Link: https://github.com/hartkopp/can-isotp/issues/59 Cc: Oleksij Rempel Suggested-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Link: https://lore.kernel.org/20230505110308.81087-3-mkl@pengutronix.de Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit db2773d65b02aed319a93efdfb958087771d4e19 Author: Oliver Hartkopp Date: Thu Apr 6 13:08:45 2023 +0200 can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag The control message provided by isotp support MSG_CMSG_COMPAT but blocked recvmsg() syscalls that have set this flag, i.e. on 32bit user space on 64 bit kernels. Link: https://github.com/hartkopp/can-isotp/issues/59 Cc: Oleksij Rempel Suggested-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Fixes: 42bf50a1795a ("can: isotp: support MSG_TRUNC flag when reading from socket") Link: https://lore.kernel.org/20230505110308.81087-2-mkl@pengutronix.de Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit 20429444e653ee8242dfbf815c0c37866beb371b Author: Yun Lu Date: Fri May 12 09:20:55 2023 +0800 wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value When using rtl8192cu with rtl8xxxu driver to connect wifi, there is a probability of failure, which shows "authentication with ... timed out". Through debugging, it was found that the RCR register has been inexplicably modified to an incorrect value, resulting in the nic not being able to receive authenticated frames. To fix this problem, add regrcr in rtl8xxxu_priv struct, and store the RCR value every time the register is written, and use it the next time the register need to be modified. Signed-off-by: Yun Lu Link: https://lore.kernel.org/all/20230427020512.1221062-1-luyun_611@163.com Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230512012055.2990472-1-luyun_611@163.com commit 60fc756fc8e6954a5618eecac73b255d651602e4 Author: Hans de Goede Date: Wed May 10 16:18:56 2023 +0200 wifi: brcmfmac: Check for probe() id argument being NULL The probe() id argument may be NULL in 2 scenarios: 1. brcmf_pcie_pm_leave_D3() calling brcmf_pcie_probe() to reprobe the device. 2. If a user tries to manually bind the driver from sysfs then the sdio / pcie / usb probe() function gets called with NULL as id argument. 1. Is being hit by users causing the following oops on resume and causing wifi to stop working: BUG: kernel NULL pointer dereference, address: 0000000000000018 Hardware name: Dell Inc. XPS 13 9350/0PWNCR, BIDS 1.13.0 02/10/2020 Workgueue: events_unbound async_run_entry_fn RIP: 0010:brcmf_pcie_probe+Ox16b/0x7a0 [brcmfmac] Call Trace: brcmf_pcie_pm_leave_D3+0xc5/8x1a0 [brcmfmac be3b4cefca451e190fa35be8f00db1bbec293887] ? pci_pm_resume+0x5b/0xf0 ? pci_legacy_resume+0x80/0x80 dpm_run_callback+0x47/0x150 device_resume+0xa2/0x1f0 async_resume+0x1d/0x30 Fix this by checking for id being NULL. In the PCI and USB cases try a manual lookup of the id so that manually binding the driver through sysfs and more importantly brcmf_pcie_probe() on resume will work. For the SDIO case there is no helper to do a manual sdio_device_id lookup, so just directly error out on a NULL id there. Fixes: da6d9c8ecd00 ("wifi: brcmfmac: add firmware vendor info in driver info") Reported-by: Felix Link: https://lore.kernel.org/regressions/4ef3f252ff530cbfa336f5a0d80710020fc5cb1e.camel@gmail.com/ Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Reviewed-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230510141856.46532-1-hdegoede@redhat.com commit 8e4942db5f5ed7b7d9690d93235b3ca49c5c59ce Author: Ping-Ke Shih Date: Mon May 8 16:55:39 2023 +0800 wifi: rtw88: correct qsel_to_ep[] type as int qsel_to_ep[] can be assigned negative value, so change type from 'u8' to 'int'. Otherwise, Smatch static checker warns: drivers/net/wireless/realtek/rtw88/usb.c:219 rtw_usb_parse() warn: assigning (-22) to unsigned variable 'rtwusb->qsel_to_ep[8]' Cc: stable@vger.kernel.org Fixes: a6f187f92bcc ("wifi: rtw88: usb: fix priority queue to endpoint mapping") Reported-by: Dan Carpenter Link: https://lore.kernel.org/linux-wireless/c3f70197-829d-48ed-ae15-66a9de80fa90@kili.mountain/ Cc: Sascha Hauer Signed-off-by: Ping-Ke Shih Acked-by: Sascha Hauer Tested-by: Larry Finger Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230508085539.46795-1-pkshih@realtek.com commit 73c7f8246539da12c76bb731a2fe7389ae55eae8 Author: Petr Pavlu Date: Thu May 11 14:53:12 2023 +0200 cpufreq: ACPI: Prevent a warning when another frequency driver is loaded The recent change to use platform devices to load ACPI PPC and PCC drivers caused that a misleading warning is reported when a respective module cannot be loaded because another CPU frequency driver is already registered: kernel: acpi-cpufreq: probe of acpi-cpufreq failed with error -17 Address it by changing the return code in acpi-cpufreq and pcc-cpufreq for this case from -EEXIST to -ENODEV which silences the warning in call_driver_probe(). The change has also a benefit for users of init_module() as this return code is propagated out from the syscall. The previous -EEXIST code made the callers, such as kmod, wrongly believe that the module was already loaded instead of that it failed to load. Fixes: 691a63712347 ("ACPI: cpufreq: Use platform devices to load ACPI PPC and PCC drivers") Reported-by: Kevin Locke Link: https://lore.kernel.org/lkml/ZFreh8SDMX67EaB6@kevinlocke.name/ Signed-off-by: Petr Pavlu Tested-by: Kevin Locke Signed-off-by: Rafael J. Wysocki commit 9be0b3a0074a61df1c94c37faea35ec8b9ea130b Merge: 1c0d023c8c2f7 ccc2f0c1b6b61 Author: Mark Brown Date: Tue May 16 00:13:09 2023 +0900 ASoC: SOF: Intel: hda-mlink: fixes and extensions Merge series from Pierre-Louis Bossart : With additional testing with multiple links and multiple DAI types, we found a couple of mistakes with refcounts, base address, missing initialization. A new helper was also added due to a change in the SoundWire programming sequences, with the host driver in charge of setting up the DMA channel mapping instead of the firmware. commit e1505c1cc8d527fcc5bcaf9c1ad82eed817e3e10 Author: Jakub Kicinski Date: Fri May 5 14:58:36 2023 -0700 bpf: netdev: init the offload table earlier Some netdevices may get unregistered before late_initcall(), we have to move the hashtable init earlier. Fixes: f1fc43d03946 ("bpf: Move offload initialization into late_initcall") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217399 Signed-off-by: Jakub Kicinski Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20230505215836.491485-1-kuba@kernel.org Signed-off-by: Alexei Starovoitov commit 95e4b25192e9238fd2dbe85d96dd2f8fd1ce9d14 Author: Dan Carpenter Date: Mon May 15 13:32:37 2023 +0300 platform/mellanox: mlxbf-pmc: fix sscanf() error checking The sscanf() function never returns negatives. It returns the number of items successfully read. Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") Signed-off-by: Dan Carpenter Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/4ccdfd28-099b-40bf-8d77-ad4ea2e76b93@kili.mountain Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit b54147fa374dbeadcb01b1762db1a793e06e37de Author: Mario Limonciello Date: Fri May 12 20:14:08 2023 -0500 platform/x86/amd/pmf: Fix CnQF and auto-mode after resume After suspend/resume cycle there is an error message and auto-mode or CnQF stops working. [ 5741.447511] amd-pmf AMDI0100:00: SMU cmd failed. err: 0xff [ 5741.447523] amd-pmf AMDI0100:00: AMD_PMF_REGISTER_RESPONSE:ff [ 5741.447527] amd-pmf AMDI0100:00: AMD_PMF_REGISTER_ARGUMENT:7 [ 5741.447531] amd-pmf AMDI0100:00: AMD_PMF_REGISTER_MESSAGE:16 [ 5741.447540] amd-pmf AMDI0100:00: [AUTO_MODE] avg power: 0 mW mode: QUIET This is because the DRAM address used for accessing metrics table needs to be refreshed after a suspend resume cycle. Add a resume callback to reset this again. Fixes: 1a409b35c995 ("platform/x86/amd/pmf: Get performance metrics from PMFW") Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230513011408.958-1-mario.limonciello@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 362c1f2ec82cb65940e1c73e15a395a7a891fc6f Author: Alexandru Sorodoc Date: Fri May 12 13:15:17 2023 +0300 platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 On ASUS GU604V the key 0x7B is issued when the charger is connected or disconnected, and key 0xC0 is issued when an external display is connected or disconnected. This commit maps them to KE_IGNORE to slience kernel messages about unknown keys, such as: kernel: asus_wmi: Unknown key code 0x7b Signed-off-by: Alexandru Sorodoc Link: https://lore.kernel.org/r/20230512101517.47416-1-ealex95@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 8133a3f0aa66ed3d7d974c89ac6aca6fe6cec837 Author: Michael Ellerman Date: Mon May 15 22:40:08 2023 +1000 powerpc/crypto: Fix aes-gcm-p10 build when VSX=n When VSX is disabled, eg. microwatt_defconfig, the build fails with: In function ‘enable_kernel_vsx’, inlined from ‘vsx_begin’ at arch/powerpc/crypto/aes-gcm-p10-glue.c:68:2, inlined from ‘p10_aes_gcm_crypt.constprop’ at arch/powerpc/crypto/aes-gcm-p10-glue.c:244:2: ... arch/powerpc/include/asm/switch_to.h:86:9: note: in expansion of macro ‘BUILD_BUG’ 86 | BUILD_BUG(); | ^~~~~~~~~ Fix it by making the p10-aes-gcm code depend on VSX. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230515124731.122962-1-mpe%40ellerman.id.au commit 71a485624c4cbb144169852d7bb8ca8c0667d7a3 Author: Rubén Gómez Date: Mon May 8 18:03:07 2023 +0000 ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P Add an ACPI IRQ override quirk for LG UltraPC 17U70P to address the internal keyboard problem on it. Link: https://bugzilla.kernel.org/show_bug.cgi?id=213031 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216983 Signed-off-by: Rubén Gómez Agudo [ rjw: Subject, changelog, white space damage fixes ] Signed-off-by: Rafael J. Wysocki commit 2facd5d3980f3a26c04fe6ec8689a1d019a5812c Author: Alexander Gordeev Date: Sun May 7 18:09:02 2023 +0200 s390/ipl: fix IPIB virtual vs physical address confusion The pointer to IPL Parameter Information Block is stored in the absolute lowcore for later use by dump tools. That pointer is a virtual address, though it should be physical instead. Note, this does not fix a real issue, since virtual and physical addresses are currently the same. Suggested-by: Heiko Carstens Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit a33239be2d38ff5a44427db1707c08787508d34a Author: Alexander Gordeev Date: Thu May 4 16:21:48 2023 +0200 s390/topology: honour nr_cpu_ids when adding CPUs When SMT thread CPUs are added to CPU masks the nr_cpu_ids limit is not checked and could be exceeded. This leads to a warning for example if CONFIG_DEBUG_PER_CPU_MAPS is set and the command line parameter nr_cpus is set to 1. Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit b1b0d5aec1cf9f9a900a14964f869c68688d923e Author: Vineeth Vijayan Date: Tue May 2 11:12:42 2023 +0200 s390/cio: include subchannels without devices also for evaluation Currently when the new channel-path is enabled, we do evaluation only on the subchannels with a device connected on it. This is because, in the past, if the device in the subchannel is not working or not available, we used to unregister the subchannels. But, from the 'commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")' we allow subchannels with or without an active device connected on it. So, when we do the io_subchannel_verify, make sure that, we are evaluating the subchannels without any device too. Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") Reported-by: Boris Fiuczynski Signed-off-by: Vineeth Vijayan Reviewed-by: Peter Oberparleiter Signed-off-by: Alexander Gordeev commit 124acbe275040809abfa5fbe6e25790a53d5a161 Author: Heiko Carstens Date: Thu May 4 13:40:46 2023 +0200 s390/defconfigs: set CONFIG_INIT_STACK_NONE=y Set CONFIG_INIT_STACK_NONE=y in defconfigs to avoid the extra overhead of initializing all stack variables by default. Users who want to have that must change the configuration on their own. Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 844cf829e5f33e00b279230470c8c93b58b8c16f Author: Holger Dengler Date: Thu Apr 20 14:34:10 2023 +0200 s390/pkey: zeroize key blobs Key blobs for the IOCTLs PKEY_KBLOB2PROTK[23] may contain clear key material. Zeroize the copies of these keys in kernel memory after creating the protected key. Reviewed-by: Harald Freudenberger Signed-off-by: Holger Dengler Signed-off-by: Alexander Gordeev commit 8703dd6b238da0ec6c276e53836f8200983d3d9b Author: Heiko Carstens Date: Thu Apr 20 13:31:29 2023 +0200 s390/crypto: use vector instructions only if available for ChaCha20 Commit 349d03ffd5f6 ("crypto: s390 - add crypto library interface for ChaCha20") added a library interface to the s390 specific ChaCha20 implementation. However no check was added to verify if the required facilities are installed before branching into the assembler code. If compiled into the kernel, this will lead to the following crash, if vector instructions are not available: data exception: 0007 ilc:3 [#1] SMP Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7+ #11 Hardware name: IBM 3931 A01 704 (KVM/Linux) Krnl PSW : 0704e00180000000 000000001857277a (chacha20_vx+0x32/0x818) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000037f0000000a ffffffffffffff60 000000008184b000 0000000019f5c8e6 0000000000000109 0000037fffb13c58 0000037fffb13c78 0000000019bb1780 0000037fffb13c58 0000000019f5c8e6 000000008184b000 0000000000000109 00000000802d8000 0000000000000109 0000000018571ebc 0000037fffb13718 Krnl Code: 000000001857276a: c07000b1f80b larl %r7,0000000019bb1780 0000000018572770: a708000a lhi %r0,10 #0000000018572774: e78950000c36 vlm %v24,%v25,0(%r5),0 >000000001857277a: e7a060000806 vl %v26,0(%r6),0 0000000018572780: e7bf70004c36 vlm %v27,%v31,0(%r7),4 0000000018572786: e70b00000456 vlr %v0,%v27 000000001857278c: e71800000456 vlr %v1,%v24 0000000018572792: e74b00000456 vlr %v4,%v27 Call Trace: [<000000001857277a>] chacha20_vx+0x32/0x818 Last Breaking-Event-Address: [<0000000018571eb6>] chacha20_crypt_s390.constprop.0+0x6e/0xd8 ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix this by adding a missing MACHINE_HAS_VX check. Fixes: 349d03ffd5f6 ("crypto: s390 - add crypto library interface for ChaCha20") Reported-by: Marc Hartmayer Cc: # 5.19+ Reviewed-by: Harald Freudenberger [agordeev@linux.ibm.com: remove duplicates in commit message] Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 21a3f3328972bdb774c62b301a715b5cebf03fa2 Author: Azeem Shaikh Date: Mon May 15 02:40:44 2023 +0000 NFSD: Remove open coding of string copy Instead of open coding a __dynamic_array(), use the __string() and __assign_str() helper macros that exist for this kind of use case. Part of an effort to remove deprecated strlcpy() [1] completely from the kernel[2]. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Fixes: 3c92fba557c6 ("NFSD: Enhance the nfsd_cb_setup tracepoint") Signed-off-by: Azeem Shaikh Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 1c0d023c8c2f7c56750a3d58207b263a39d39554 Author: Ranjani Sridharan Date: Mon May 15 11:52:00 2023 +0300 ASoC: SOF: topology: Fix tuples array allocation The memory allocated for the tuples array assumes that there's 1 instance of all tokens already. So for those tokens that have multiple instances in topology, we need to exclude the initial instance that has already been accounted for. Fixes: 4fdef47a44d6 ("ASoC: SOF: ipc4-topology: Add new tokens for input/output pin format count") Signed-off-by: Ranjani Sridharan Date: Mon May 15 13:44:03 2023 +0300 ASoC: SOF: Separate the tokens for input and output pin index Using the same token ID for both input and output format pin index results in collisions and incorrect pin index getting parsed from topology. Signed-off-by: Ranjani Sridharan Date: Mon May 15 20:08:26 2023 +0900 ASoC: SOF: Various runtime pm fixes, improvements Merge series from Peter Ujfalusi : Three patch to correct error path PM runtime handling in few places. Regards, Peter --- Pierre-Louis Bossart (3): ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions ASoC: SOF: pcm: fix pm_runtime imbalance in error handling ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling sound/soc/sof/debug.c | 4 ++-- sound/soc/sof/pcm.c | 11 ++++++----- sound/soc/sof/sof-client-probes.c | 14 ++++++++------ 3 files changed, 16 insertions(+), 13 deletions(-) -- 2.40.1 commit df0acdc59b094cdaef19b1c8d83c9721082bab7b Author: Russell King (Oracle) Date: Sat May 13 22:03:45 2023 +0100 net: phylink: fix ksettings_set() ethtool call While testing a Fiberstore SFP-10G-T module (which uses 10GBASE-R with rate adaption) in a Clearfog platform (which can't do that) it was found that the PHYs advertisement was not limited according to the hosts capabilities when using ethtool to change it. Fix this by ensuring that we mask the advertisement with the computed support mask as the very first thing we do. Fixes: cbc1bb1e4689 ("net: phylink: simplify phy case for ksettings_set method") Signed-off-by: Russell King (Oracle) Signed-off-by: David S. Miller commit d1b2777d1467a3aa86d403492cc0411bf429dbe4 Merge: b48a18644046c 35a089b5d793d Author: David S. Miller Date: Mon May 15 10:21:21 2023 +0100 Merge branch 'tipc-fixes' Xin Long says: ==================== tipc: fix the mtu update in link mtu negotiation This patchset fixes a crash caused by a too small MTU carried in the activate msg. Note that as such malicious packet does not exist in the normal env, the fix won't break any application The 1st patch introduces a function to calculate the minimum MTU for the bearer, and the 2nd patch fixes the crash with this helper. While at it, the 3rd patch fixes the udp bearer mtu update by netlink with this helper. ==================== Reviewed-by: Tung Nguyen Signed-off-by: David S. Miller commit 35a089b5d793d2bfd2cc7cfa6104545184de2ce7 Author: Xin Long Date: Sun May 14 15:52:29 2023 -0400 tipc: check the bearer min mtu properly when setting it by netlink Checking the bearer min mtu with tipc_udp_mtu_bad() only works for IPv4 UDP bearer, and IPv6 UDP bearer has a different value for the min mtu. This patch checks with encap_hlen + TIPC_MIN_BEARER_MTU for min mtu, which works for both IPv4 and IPv6 UDP bearer. Note that tipc_udp_mtu_bad() is still used to check media min mtu in __tipc_nl_media_set(), as m->mtu currently is only used by the IPv4 UDP bearer as its default mtu value. Fixes: 682cd3cf946b ("tipc: confgiure and apply UDP bearer MTU on running links") Signed-off-by: Xin Long Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 56077b56cd3fb78e1c8619e29581ba25a5c55e86 Author: Xin Long Date: Sun May 14 15:52:28 2023 -0400 tipc: do not update mtu if msg_max is too small in mtu negotiation When doing link mtu negotiation, a malicious peer may send Activate msg with a very small mtu, e.g. 4 in Shuang's testing, without checking for the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then n->links[bearer_id].mtu is set to 4294967228, which is a overflow of '4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss(). With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning: tipc: Too large msg, purging xmit list 1 5 0 40 4! tipc: Too large msg, purging xmit list 1 15 0 60 4! And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in named_distribute(), and when purging it in tipc_link_xmit(), a crash was even caused: general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19 RIP: 0010:kfree_skb_list_reason+0x7e/0x1f0 Call Trace: skb_release_data+0xf9/0x1d0 kfree_skb_reason+0x40/0x100 tipc_link_xmit+0x57a/0x740 [tipc] tipc_node_xmit+0x16c/0x5c0 [tipc] tipc_named_node_up+0x27f/0x2c0 [tipc] tipc_node_write_unlock+0x149/0x170 [tipc] tipc_rcv+0x608/0x740 [tipc] tipc_udp_recv+0xdc/0x1f0 [tipc] udp_queue_rcv_one_skb+0x33e/0x620 udp_unicast_rcv_skb.isra.72+0x75/0x90 __udp4_lib_rcv+0x56d/0xc20 ip_protocol_deliver_rcu+0x100/0x2d0 This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(), and not updating mtu if it is too small. Fixes: ed193ece2649 ("tipc: simplify link mtu negotiation") Reported-by: Shuang Li Signed-off-by: Xin Long Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 3ae6d66b605be604644d4bb5708a7ffd9cf1abe8 Author: Xin Long Date: Sun May 14 15:52:27 2023 -0400 tipc: add tipc_bearer_min_mtu to calculate min mtu As different media may requires different min mtu, and even the same media with different net family requires different min mtu, add tipc_bearer_min_mtu() to calculate min mtu accordingly. This API will be used to check the new mtu when doing the link mtu negotiation in the next patch. Signed-off-by: Xin Long Acked-by: Jon Maloy Signed-off-by: David S. Miller commit b48a18644046c9bc0667493a147dfa01e8241eab Author: Russell King (Oracle) Date: Sat May 13 09:57:27 2023 +0100 net: mdio: i2c: fix rollball accessors Commit 87e3bee0f247 ("net: mdio: i2c: Separate C22 and C45 transactions") separated the non-rollball bus accessors, but left the rollball accessors as is. As rollball accessors are clause 45, this results in the rollball protocol being completely non-functional. Fix this. Fixes: 87e3bee0f247 ("net: mdio: i2c: Separate C22 and C45 transactions") Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 5306623a9826aa7d63b32c6a3803c798a765474d Author: Feng Liu Date: Fri May 12 11:18:12 2023 -0400 virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rqs have already initialized XDP and enabled NAPI, which is not the expected behavior. Need to roll back the previous rq initialization to avoid leaks in error unwinding of init code. Also extract helper functions of disable and enable queue pairs. Use newly introduced disable helper function in error unwinding and virtnet_close. Use enable helper function in virtnet_open. Fixes: 754b8a21a96d ("virtio_net: setup xdp_rxq_info") Signed-off-by: Feng Liu Reviewed-by: Jiri Pirko Reviewed-by: William Tu Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Xuan Zhuo Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit 6ead9c98cafcbc6992cf35f0ca393df2c03e3316 Author: Shenwei Wang Date: Fri May 12 08:38:43 2023 -0500 net: fec: remove the xdp_return_frame when lack of tx BDs In the implementation, the sent_frame count does not increment when transmit errors occur. Therefore, bq_xmit_all() will take care of returning the XDP frames. Fixes: 26312c685ae0 ("net: fec: correct the counting of XDP sent frames") Signed-off-by: Shenwei Wang Reviewed-by: Horatiu Vultur Signed-off-by: David S. Miller commit 5896f2d363d5cfb7510856c90d5e0ed934a1d340 Author: Suraj Kandpal Date: Fri May 5 09:45:12 2023 +0530 drm/i915/hdcp: Check if media_gt exists Check if media_gt exists if we are using gsc cs --v2 -correct typo [Ankit] -assign gsc variable if gt exists [Ankit] --v3 -declare gsc and gt variables in if block [Ankit] --v4 -add fixes tag [Ankit] Fixes: 883631771038 ("drm/i915/mtl: Add HDCP GSC interface") Cc: Tomas Winkler Cc: Rodrigo Vivi Cc: Uma Shankar Cc: Anshuman Gupta Cc: Ankit Nautiyal Signed-off-by: Suraj Kandpal Reviewed-by: Gustavo Sousa Reviewed-by: Ankit Nautiyal Signed-off-by: Animesh Manna Link: https://patchwork.freedesktop.org/patch/msgid/20230505041512.585486-1-suraj.kandpal@intel.com (cherry picked from commit 6986f05b557bf1efea5bac8dbdffb7ee89d0cf77) Signed-off-by: Joonas Lahtinen commit c83b49383b595be50647f0c764a48c78b5f3c4f8 Author: Dong Chenchen Date: Thu May 11 20:54:40 2023 +0800 net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment(): invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1 RIP: 0010:skb_panic+0xda/0xe0 call Trace: skb_push+0x91/0xa0 nsh_gso_segment+0x4f3/0x570 skb_mac_gso_segment+0x19e/0x270 __skb_gso_segment+0x1e8/0x3c0 validate_xmit_skb+0x452/0x890 validate_xmit_skb_list+0x99/0xd0 sch_direct_xmit+0x294/0x7c0 __dev_queue_xmit+0x16f0/0x1d70 packet_xmit+0x185/0x210 packet_snd+0xc15/0x1170 packet_sendmsg+0x7b/0xa0 sock_sendmsg+0x14f/0x160 The root cause is: nsh_gso_segment() use skb->network_header - nhoff to reset mac_header in skb_gso_error_unwind() if inner-layer protocol gso fails. However, skb->network_header may be reset by inner-layer protocol gso function e.g. mpls_gso_segment. skb->mac_header reset by the inaccurate network_header will be larger than skb headroom. nsh_gso_segment nhoff = skb->network_header - skb->mac_header; __skb_pull(skb,nsh_len) skb_mac_gso_segment mpls_gso_segment skb_reset_network_header(skb);//skb->network_header+=nsh_len return -EINVAL; skb_gso_error_unwind skb_push(skb, nsh_len); skb->mac_header = skb->network_header - nhoff; // skb->mac_header > skb->headroom, cause skb_push panic Use correct mac_offset to restore mac_header and get rid of nhoff. Fixes: c411ed854584 ("nsh: add GSO support") Reported-by: syzbot+632b5d9964208bfef8c0@syzkaller.appspotmail.com Suggested-by: Eric Dumazet Signed-off-by: Dong Chenchen Signed-off-by: David S. Miller commit 436eeae0411acdfc54521ddea80ee76d4ae8a7ea Author: Rijo Thomas Date: Tue May 9 13:02:40 2023 +0530 tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta' After TEE has completed processing of TEE_CMD_ID_LOAD_TA, set proper value in 'return_origin' argument passed by open_session() call. To do so, add 'return_origin' field to the structure tee_cmd_load_ta. The Trusted OS shall update return_origin as part of TEE processing. This change to 'struct tee_cmd_load_ta' interface requires a similar update in AMD-TEE Trusted OS's TEE_CMD_ID_LOAD_TA interface. This patch has been verified on Phoenix Birman setup. On older APUs, return_origin value will be 0. Cc: stable@vger.kernel.org Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Tested-by: Sourabh Das Signed-off-by: Rijo Thomas Acked-by: Sumit Garg Signed-off-by: Jens Wiklander commit 35a4b8ce4ac00e940b46b1034916ccb22ce9bdef Author: Hari Bathini Date: Tue Apr 25 12:28:29 2023 +0530 powerpc/bpf: populate extable entries only during the last pass Since commit 85e031154c7c ("powerpc/bpf: Perform complete extra passes to update addresses"), two additional passes are performed to avoid space and CPU time wastage on powerpc. But these extra passes led to WARN_ON_ONCE() hits in bpf_add_extable_entry() as extable entries are populated again, during the extra pass, without resetting the index. Fix it by resetting entry index before repopulating extable entries, if and when there is an additional pass. Fixes: 85e031154c7c ("powerpc/bpf: Perform complete extra passes to update addresses") Cc: stable@vger.kernel.org # v6.3+ Signed-off-by: Hari Bathini Reviewed-by: Naveen N. Rao Signed-off-by: Michael Ellerman Link: https://msgid.link/20230425065829.18189-1-hbathini@linux.ibm.com commit 2ef0785b30bd6549ddbc124979f1b6596e065ae2 Author: Arnd Bergmann Date: Mon Apr 17 23:04:11 2023 +0200 drm/exynos: fix g2d_open/close helper function definitions The empty stub functions are defined as global functions, which causes a warning because of missing prototypes: drivers/gpu/drm/exynos/exynos_drm_g2d.h:37:5: error: no previous prototype for 'g2d_open' drivers/gpu/drm/exynos/exynos_drm_g2d.h:42:5: error: no previous prototype for 'g2d_close' Mark them as 'static inline' to avoid the warning and to make them behave as intended. Fixes: eb4d9796fa34 ("drm/exynos: g2d: Convert to driver component API") Signed-off-by: Arnd Bergmann Reviewed-by: Andi Shyti Signed-off-by: Inki Dae commit b8b23fbe93b34e595a7b0f31b4ed22400c47ec07 Author: Andrejs Cainikovs Date: Sun May 14 11:22:46 2023 +0200 arm64: dts: colibri-imx8x: delete adc1 and dsp i.MX8, i.MX8X, i.MX8XP and i.MX8XL SOC device trees are all based on imx8-ss-*.dtsi files. For i.MX8X and i.MX8XP these device trees should be updated with some peripherals removed or updated, similar to i.MX8XL (imx8dxl-ss-*.dtsi files). However, it looks like only i.MX8 and i.MX8XL are up to date, but for i.MX8X and i.MX8XP some of the peripherals got inherited from imx8-ss-*.dtsi files, but in reality they are not present on SOC. As a result, during resource partition ownership check U-Boot receives messages from SCU firmware about these resources not owned by boot partition. In reality, these resources are not owned by anyone, as they simply does not exist, but are defined in Linux device tree. This change removes those peripherals, which are listed during U-Boot resource partition ownership check as warnings: ## Flattened Device Tree blob at 9d400000 Booting using the fdt blob at 0x9d400000 Loading Device Tree to 00000000fd652000, end 00000000fd67efff ... OK Disable clock-controller@59580000 rsrc 512 not owned Disable clock-controller@5ac90000 rsrc 102 not owned Starting kernel ... Fixes: ba5a5615d54f ("arm64: dts: freescale: add initial support for colibri imx8x") Signed-off-by: Andrejs Cainikovs Signed-off-by: Francesco Dolcini Signed-off-by: Shawn Guo commit 34e5c0cd55af7258d819cb203da7d202bae3b97d Author: Emanuele Ghidoli Date: Sun May 14 11:22:45 2023 +0200 arm64: dts: colibri-imx8x: fix iris pinctrl configuration Remove GPIO3_IO10 from Iris carrier board pinctrl configuration, this is already defined in the SOM dtsi since this is a standard SOM functionality (wake-up button). Duplicating it leads to the following error message imx8qxp-pinctrl scu:pinctrl: pin IMX8QXP_QSPI0A_DATA1 already requested Fixes: aefb5e2d974d ("arm64: dts: colibri-imx8x: Add iris carrier board") Signed-off-by: Emanuele Ghidoli Signed-off-by: Andrejs Cainikovs Signed-off-by: Francesco Dolcini Signed-off-by: Shawn Guo commit 25acffb00899d3ac85a9701c99f7929f97a5d9af Author: Emanuele Ghidoli Date: Sun May 14 11:22:44 2023 +0200 arm64: dts: colibri-imx8x: move pinctrl property from SoM to eval board Each carrier board device tree except the eval board one already override iomuxc pinctrl property to configure unused pins as gpio. So move also the pinctrl property to eval board device tree. Leave the pin group definition in imx8x-colibri.dtsi to avoid duplication and simplify configuration of gpio. Signed-off-by: Emanuele Ghidoli Signed-off-by: Andrejs Cainikovs Signed-off-by: Francesco Dolcini Signed-off-by: Shawn Guo commit a346d4dc74d94ac3c197283d0a7ec673a59a0674 Author: Emanuele Ghidoli Date: Sun May 14 11:22:43 2023 +0200 arm64: dts: colibri-imx8x: fix eval board pin configuration Fix pinctrl groups to have SODIMM 75 only in one group. Remove configuration of the pin at SoM level because it is normally used as CSI_MCLK at camera interface connector. Without this fix it is not possible, without redefining iomuxc pinctrl, to use CSI_MCLK signal and leads to the following error messages: imx8qxp-pinctrl scu:pinctrl: pin IMX8QXP_CSI_MCLK already requested imx8qxp-pinctrl scu:pinctrl: pin-147 (16-003c) status -22 Fixes: 4d2adf738169 ("arm64: dts: colibri-imx8x: Split pinctrl_hog1") Signed-off-by: Emanuele Ghidoli Signed-off-by: Andrejs Cainikovs Signed-off-by: Francesco Dolcini Signed-off-by: Shawn Guo commit 07bb2e368820a4de9b4b586691e143976b74ea44 Author: Adam Ford Date: Thu May 11 20:04:23 2023 -0500 arm64: dts: imx8mp: Fix video clock parents There are a few clocks whose parents are set in mipi_dsi and lcdif nodes, but these clocks are used by the media_blk_ctrl power domain. This may cause an issue when re-parenting, because the media_blk_ctrl may start the clocks before the reparent is done resulting in a disp_pixel clock having the wrong parent and rate. Fix this by moving the assigned-clock-parents and rates to the media_blk_ctrl node to configure these clocks before they are enabled. After this patch, both disp1_pix_root and dixp2_pix_root clock become children of the video_pll1. video_pll1_ref_sel 24000000 video_pll1 1039500000 video_pll1_bypass 1039500000 video_pll1_out 1039500000 media_disp2_pix 1039500000 media_disp2_pix_root_clk 1039500000 media_disp1_pix 1039500000 media_disp1_pix_root_clk 1039500000 Fixes: eda09fe149df ("arm64: dts: imx8mp: Add display pipeline components") Signed-off-by: Adam Ford Signed-off-by: Shawn Guo commit ce7c014937c442be677963848c7db62eccd94eac Author: Bjorn Andersson Date: Fri May 12 08:04:25 2023 -0700 arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes The rpmh driver will cache sleep and wake votes until the cluster power-domain is about to enter idle, to avoid unnecessary writes. So associate the apps_rsc with the cluster pd, so that it can be notified about this event. Without this, only AMC votes are being commited. Signed-off-by: Bjorn Andersson Reviewed-by: Konrad Dybcio Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230512150425.3171122-1-quic_bjorande@quicinc.com commit 2d80b1e649dd74f5226484e244e57990348a9f18 Author: Krzysztof Kozlowski Date: Tue Apr 11 19:09:38 2023 +0200 arm64: dts: qcom: sc8280xp: Revert "arm64: dts: qcom: sc8280xp: remove superfluous "input-enable"" This reverts commit 87e1f7b1a041a37390bf4fa7913683fb4f8d00d8 because it removed input-enable from the LPASS TLMM, where it is still correct (both bindings and Linux driver parse it). Reported-by: Johan Hovold Closes: https://lore.kernel.org/lkml/ZDVq1b0TjXH5LTYx@hovoldconsulting.com/ Signed-off-by: Krzysztof Kozlowski Reviewed-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230411170938.1657387-1-krzysztof.kozlowski@linaro.org commit 3395d36e6805786c26d13188735bc796b9d7a7c9 Author: Krzysztof Kozlowski Date: Sat May 13 13:29:13 2023 +0200 soc: qcom: rpmh-rsc: drop redundant unsigned >=0 comparision Unsigned int "minor" is always >= 0 as reported by Smatch: drivers/soc/qcom/rpmh-rsc.c:1076 rpmh_rsc_probe() warn: always true condition '(drv->ver.minor >= 0) => (0-u32max >= 0)' Fixes: 88704a0cd719 ("soc: qcom: rpmh-rsc: Support RSC v3 minor versions") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230513112913.176009-1-krzysztof.kozlowski@linaro.org commit 3530167c6fe8001de6c026a3058eaca4c8a5329f Author: Krzysztof Kozlowski Date: Sat May 13 13:17:47 2023 +0200 soc: qcom: icc-bwmon: fix incorrect error code passed to dev_err_probe() Pass to dev_err_probe() PTR_ERR from actual dev_pm_opp_find_bw_floor() call which failed, instead of previous ret which at this point is 0. Failure of dev_pm_opp_find_bw_floor() would result in prematurely ending the probe with success. Fixes smatch warnings: drivers/soc/qcom/icc-bwmon.c:776 bwmon_probe() warn: passing zero to 'dev_err_probe' drivers/soc/qcom/icc-bwmon.c:781 bwmon_probe() warn: passing zero to 'dev_err_probe' Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202305131657.76XeHDjF-lkp@intel.com/ Cc: Fixes: b9c2ae6cac40 ("soc: qcom: icc-bwmon: Add bandwidth monitoring driver") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230513111747.132532-1-krzysztof.kozlowski@linaro.org commit dc60b67d259ea63196dcd0400dd43ba062e2e097 Author: Lucas Tanure Date: Fri May 12 16:45:03 2023 +0100 MAINTAINERS: Remove self from Cirrus Codec drivers I'm leaving Cirrus Logic, and will no longer have access to hardware and documentation necessary to be effective in a maintainership role. Signed-off-by: Lucas Tanure Date: Fri May 12 15:42:37 2023 +0100 ASoC: cs35l56: Prevent unbalanced pm_runtime in dsp_work() on SoundWire Flush the SoundWire interrupt handler work instead of cancelling it. When a SoundWire interrupt is triggered the pm_runtime is held until the work has completed. It's therefore unsafe to cancel the work, it must be flushed. Signed-off-by: Simon Trimmer Date: Sat May 13 19:36:46 2023 +0200 spi: MAINTAINERS: drop Krzysztof Kozlowski from Samsung SPI Remove Krzysztof Kozlowski from maintainers of Samsung SoC SPI drivers. Signed-off-by: Krzysztof Kozlowski Date: Tue May 9 17:41:53 2023 +0100 spi: spi-cadence: Only overlap FIFO transactions in slave mode Commit b1b90514eaa3 ("spi: spi-cadence: Add support for Slave mode") updated the code to trigger the IRQ when the FIFO was half empty, overlapping filling more data into the FIFO and sending what is left. This appears to cause regressions on the Zynq 7000, for transactions longer than the FIFO size, below that no overlapping occurs. It would appear from my testing that any attempt to put new data into the FIFO whilst data is still transmitting causes data corruption on both send and receive. If I am reading the commit message right on commit 49530e641178 ("spi: cadence: Add usleep_range() for cdns_spi_fill_tx_fifo()"), that would also seem to imply this is the case. On the assumption that this isn't an issue on the platform the original slave mode support was added for, update the cdns_transfer_one to only set the watermark to 50% of the FIFO size when in slave mode. There by retaining the new behaviour for slave mode but reverting to the older behaviour when the SPI is used a master. Fixes: b1b90514eaa3 ("spi: spi-cadence: Add support for Slave mode") Signed-off-by: Charles Keepax Date: Tue May 9 17:41:52 2023 +0100 spi: spi-cadence: Avoid read of RX FIFO before its ready Recent changes to cdns_spi_irq introduced some issues. Firstly, when writing the end of a longer transaction, the code in cdns_spi_irq will write data into the TX FIFO, then immediately fall into the if (!xspi->tx_bytes) path and attempt to read data from the RX FIFO. However this required waiting for the TX FIFO to empty before the RX data was ready. Secondly, the variable trans_cnt is now rather inaccurately named since in cases, where the watermark is set to 1, trans_cnt will be 1 but the count of bytes transferred would be much longer. Finally, when setting up the transaction we set the watermark to 50% of the FIFO if the transaction is great than 50% of the FIFO. However, there is no need to split a tranaction that is smaller than the whole FIFO, so anything up to the FIFO size can be done in a single transaction. Tidy up the code a little, to avoid repeatedly calling cdns_spi_read_rx_fifo with a count of 1, and correct the three issues noted above. Fixes: b1b90514eaa3 ("spi: spi-cadence: Add support for Slave mode") Signed-off-by: Charles Keepax Date: Fri May 12 10:19:34 2023 +0200 regulator: pca9450: Fix BUCK2 enable_mask This fixes a copy & paste error. No functional change intended, BUCK1_ENMODE_MASK equals BUCK2_ENMODE_MASK. Fixes: 0935ff5f1f0a ("regulator: pca9450: add pca9450 pmic driver") Originally-from: Robin Gong Date: Fri May 12 14:46:30 2023 +0300 ASoC: SOF: topology: Fix logic for copying tuples Topology could have more instances of the tokens being searched for than the number of sets that need to be copied. Stop copying token after the limit of number of token instances has been reached. This worked before only by chance as we had allocated more size for the tuples array than the number of actual tokens being parsed. Fixes: 7006d20e5e9d ("ASoC: SOF: Introduce IPC3 ops") Signed-off-by: Ranjani Sridharan Date: Fri May 12 13:46:38 2023 +0300 ASoC: SOF: pm: save io region state in case of errors in resume If there are failures in DSP runtime resume, the device state will not reach active and this makes it impossible e.g. to retrieve a possible DSP panic dump via "exception" debugfs node. If CONFIG_SND_SOC_SOF_DEBUG_ENABLE_DEBUGFS_CACHE=y is set, the data in cache is stale. If debugfs cache is not used, the region simply cannot be read. To allow debugging these scenarios, update the debugfs cache contents in resume error handler. User-space can then later retrieve DSP panic and other state via debugfs (requires SOF debugfs cache to be enabled in build). Reported-by: Curtis Malainey Date: Sat May 13 11:02:28 2023 +0200 ASoC: MAINTAINERS: drop Krzysztof Kozlowski from Samsung audio Remove Krzysztof Kozlowski from maintainer of Samsung SoC Audio drivers and change the status to maintenance (no one is reality being paid for looking at this). Signed-off-by: Krzysztof Kozlowski Date: Thu May 11 09:25:12 2023 -0700 ASoC: mediatek: mt8186: Fix use-after-free in driver remove path When devm runs function in the "remove" path for a device it runs them in the reverse order. That means that if you have parts of your driver that aren't using devm or are using "roll your own" devm w/ devm_add_action_or_reset() you need to keep that in mind. The mt8186 audio driver didn't quite get this right. Specifically, in mt8186_init_clock() it called mt8186_audsys_clk_register() and then went on to call a bunch of other devm function. The caller of mt8186_init_clock() used devm_add_action_or_reset() to call mt8186_deinit_clock() but, because of the intervening devm functions, the order was wrong. Specifically at probe time, the order was: 1. mt8186_audsys_clk_register() 2. afe_priv->clk = devm_kcalloc(...) 3. afe_priv->clk[i] = devm_clk_get(...) At remove time, the order (which should have been 3, 2, 1) was: 1. mt8186_audsys_clk_unregister() 3. Free all of afe_priv->clk[i] 2. Free afe_priv->clk The above seemed to be causing a use-after-free. Luckily, it's easy to fix this by simply using devm more correctly. Let's move the devm_add_action_or_reset() to the right place. In addition to fixing the use-after-free, code inspection shows that this fixes a leak (missing call to mt8186_audsys_clk_unregister()) that would have happened if any of the syscon_regmap_lookup_by_phandle() calls in mt8186_init_clock() had failed. Fixes: 55b423d5623c ("ASoC: mediatek: mt8186: support audio clock control in platform driver") Signed-off-by: Douglas Anderson Date: Fri May 12 14:03:17 2023 +0300 ASoC: SOF: ipc3-topology: Make sure that only one cmd is sent in dai_config The commands in sof_ipc_dai_config.flags are encoded as bits: 1 (bit0) - hw_params 2 (bit1) - hw_free 4 (bit2) - pause These are commands, they cannot be combined as one would assume, for example 3 (bit0 | bit1) is invalid. This can happen right at the second start of a stream as at the end of the first stream we set the hw_free command (bit1) and on the second start we would OR on top of it the hw_params (bit0). Fixes: b66bfc3a9810 ("ASoC: SOF: sof-audio: Fix broken early bclk feature for SSP") Signed-off-by: Peter Ujfalusi Date: Fri May 12 13:33:15 2023 +0300 ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling When an error occurs, we need to make sure the device can pm_runtime suspend instead of keeping it active. Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 13:33:14 2023 +0300 ASoC: SOF: pcm: fix pm_runtime imbalance in error handling When an error occurs, we need to make sure the device can pm_runtime suspend instead of keeping it active. Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 13:33:13 2023 +0300 ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions When a firmware IPC error happens during a pm_runtime suspend, we ignore the error and suspend anyways. However, the code unconditionally increases the runtime_pm counter. This results in a confusing configuration where the code will suspend, resume but never suspend again due to the use of pm_runtime_get_noresume(). The intent of the counter increase was to prevent entry in D3, but if that transition to D3 is already started it cannot be stopped. In addition, there's no point in that case in trying to prevent anything, the firmware error is handled and the next resume will re-initialize the firmware completely. This patch changes the logic to prevent suspend when the device is pm_runtime active and has a use_count > 0. Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 12:46:11 2023 -0500 ASoC: SOF: Intel: hda-mlink: add helper to program SoundWire PCMSyCM registers These registers enable the HDaudio DMA hardware to split/merge data from different PDIs, possibly on different links. This capability exists for all types of HDaudio extended links, but for now is only required for SoundWire. In the SSP/DMIC case, the IP is programmed by the DSP firmware. Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 12:46:10 2023 -0500 ASoC: SOF: Intel: hda-mlink: initialize instance_offset member We defined the values but never initialized it for SoundWire/SSP, fix this miss. A Fixes: tag is not provided as instance_offset was not used so far, so nothing was really broken. This patch is only required for the SoundWire support in the following patch. Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 12:46:09 2023 -0500 ASoC: SOF: Intel: hda-mlink: use 'ml_addr' parameter consistently We mix the use of hlink->ml_addr and the 'ml_addr' parameter. It's the same thing, let's align on using the parameter. Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 12:46:08 2023 -0500 ASoC: SOF: Intel: hda-mlink: fix base_ptr computation The base_ptr value needs to be derived from the remap_addr pointer, not the ml_addr. This base_ptr was used only in debug logs that were so far not contributed upstream so the issue was not detected. It needs to be fixed for SoundWire support on LunarLake. Fixes: 17c9b6ec35c0 ("ASoC: SOF: Intel: hda-mlink: add structures to parse ALT links") Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 12:46:07 2023 -0500 ASoC: SOF: Intel: hda-mlink: add helper to get SoundWire hlink Same functionality as for DMIC/SSP with different ID. Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 12:46:06 2023 -0500 ASoC: SOF: Intel: hda-mlink: fix sublink refcounting In hindsight it was a very bad idea to use the same refcount for Extended and 'legacy' HDaudio multi-links. The existing solution only powers-up the first sublink, which causes SoundWire and SSP tests to fail when more than one DAI is used concurrently. Solving this problem requires per-sublink refcounting, as suggested in this patch. The existing refcounting remains for 'legacy' HdAudio links, mainly to avoid changing the obscure programming sequence in snd_hdac_ext_bus_link_put(). Signed-off-by: Pierre-Louis Bossart Date: Fri May 12 13:44:23 2023 +0800 power: supply: rt9467: Fix passing zero to 'dev_err_probe' Fix passing zero to 'dev_err_probe()' in 'rt9467_request_interrupt()' Fixes: 6f7f70e3a8dd ("power: supply: rt9467: Add Richtek RT9467 charger driver") Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202305111228.bHLWU6bq-lkp@intel.com/ Signed-off-by: ChiaEn Wu Signed-off-by: Sebastian Reichel commit a7844528722619d2f97740ae5ec747afff18c4be Author: Michal Simek Date: Fri May 12 13:52:04 2023 +0200 dt-bindings: ata: ahci-ceva: Cover all 4 iommus entries Current only one entry is enabled but IP itself is using 4 different IDs which are already listed in zynqmp.dtsi. sata: ahci@fd0c0000 { compatible = "ceva,ahci-1v84"; ... iommus = <&smmu 0x4c0>, <&smmu 0x4c1>, <&smmu 0x4c2>, <&smmu 0x4c3>; }; Fixes: 8ac47837f0e0 ("arm64: dts: zynqmp: Add missing iommu IDs") Cc: stable@vger.kernel.org # v5.12+ Signed-off-by: Michal Simek Acked-by: Krzysztof Kozlowski Signed-off-by: Damien Le Moal commit 5f5486b620cd43b16a1787ef92b9bc21bd72ef2e Author: Jeremy Sowden Date: Wed Apr 26 22:50:32 2023 +0100 selftests/bpf: Fix pkg-config call building sign-file When building sign-file, the call to get the CFLAGS for libcrypto is missing white-space between `pkg-config` and `--cflags`: $(shell $(HOSTPKG_CONFIG)--cflags libcrypto 2> /dev/null) Removing the redirection of stderr, we see: $ make -C tools/testing/selftests/bpf sign-file make: Entering directory '[...]/tools/testing/selftests/bpf' make: pkg-config--cflags: No such file or directory SIGN-FILE sign-file make: Leaving directory '[...]/tools/testing/selftests/bpf' Add the missing space. Fixes: fc97590668ae ("selftests/bpf: Add test for bpf_verify_pkcs7_signature() kfunc") Signed-off-by: Jeremy Sowden Signed-off-by: Daniel Borkmann Reviewed-by: Roberto Sassu Link: https://lore.kernel.org/bpf/20230426215032.415792-1-jeremy@azazel.net Signed-off-by: Alexei Starovoitov commit 07a27305938559fb35f7a46fb90a5e37728bdee6 Author: Chuck Lever Date: Sun May 14 15:51:48 2023 -0400 SUNRPC: Fix trace_svc_register() call site The trace event recorded incorrect values for the registered family, protocol, and port because the arguments are in the wrong order. Fixes: b4af59328c25 ("SUNRPC: Trace server-side rpcbind registration events") Signed-off-by: Chuck Lever commit 948f072ada23e0a504c5e4d7d71d4c83bd0785ec Author: NeilBrown Date: Tue May 9 09:42:47 2023 +1000 SUNRPC: always free ctxt when freeing deferred request Since the ->xprt_ctxt pointer was added to svc_deferred_req, it has not been sufficient to use kfree() to free a deferred request. We may need to free the ctxt as well. As freeing the ctxt is all that ->xpo_release_rqst() does, we repurpose it to explicit do that even when the ctxt is not stored in an rqst. So we now have ->xpo_release_ctxt() which is given an xprt and a ctxt, which may have been taken either from an rqst or from a dreq. The caller is now responsible for clearing that pointer after the call to ->xpo_release_ctxt. We also clear dr->xprt_ctxt when the ctxt is moved into a new rqst when revisiting a deferred request. This ensures there is only one pointer to the ctxt, so the risk of double freeing in future is reduced. The new code in svc_xprt_release which releases both the ctxt and any rq_deferred depends on this. Fixes: 773f91b2cf3f ("SUNRPC: Fix NFSD's request deferral on RDMA transports") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1 Author: NeilBrown Date: Tue May 9 09:41:49 2023 +1000 SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - and also remains in the svc_deferred_req. In the (rare?) case that the request is deferred a second time, the old svc_deferred_req is reused - it still has all the correct content. However in that case the rq_xprt_ctxt pointer is NOT cleared so that when xpo_release_xprt is called, the ctxt is freed (UDP) or possible added to a free list (RDMA). When the deferred request is revisited for a second time, it will reference this ctxt which may be invalid, and the free the object a second time which is likely to oops. So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that the value is now stored in the svc_deferred_req. Fixes: 773f91b2cf3f ("SUNRPC: Fix NFSD's request deferral on RDMA transports") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f1fcbaa18b28dec10281551dfe6ed3a3ed80e3d6 Author: Linus Torvalds Date: Sun May 14 12:51:40 2023 -0700 Linux 6.4-rc2 commit 533c54547153d46c0bf99ac0e396bed71f760c03 Merge: 838a854820eea 764d102ef94e8 Author: Linus Torvalds Date: Sun May 14 12:32:34 2023 -0700 Merge tag 'cxl-fixes-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull compute express link fixes from Dan Williams: - Fix a compilation issue with DEFINE_STATIC_SRCU() in the unit tests - Fix leaking kernel memory to a root-only sysfs attribute * tag 'cxl-fixes-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl: Add missing return to cdat read error path tools/testing/cxl: Use DEFINE_STATIC_SRCU() commit 838a854820eea0d21c6910cc3ab23b78d16aa1dd Merge: 01bc932561438 6f9e98849edaa Author: Linus Torvalds Date: Sun May 14 09:54:38 2023 -0700 Merge tag 'parisc-for-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: - Fix encoding of swp_entry due to added SWP_EXCLUSIVE flag - Include reboot.h to avoid gcc-12 compiler warning * tag 'parisc-for-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix encoding of swp_entry due to added SWP_EXCLUSIVE flag parisc: kexec: include reboot.h commit 01bc932561438be3a33d7c7c89be45f866168c5f Merge: 31f4104e392a1 2b951b0efbaa6 Author: Linus Torvalds Date: Sun May 14 09:17:32 2023 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: - fix unwinder for uleb128 case - fix kernel-doc warnings for HP Jornada 7xx - fix unbalanced stack on vfp success path * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9297/1: vfp: avoid unbalanced stack on 'success' return path ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings ARM: 9295/1: unwind:fix unwind abort for uleb128 case commit 280a8ab81733da8bc442253c700a52c4c0886ffd Author: Hyunwoo Kim Date: Mon Nov 21 06:33:08 2022 +0000 media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab commit 31f4104e392a10327f90006a61fcf1d4e7a79472 Merge: ef21831c2e4e6 92cc5d00a431e Author: Linus Torvalds Date: Sun May 14 08:00:46 2023 -0700 Merge tag 'locking_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Borislav Petkov: - Make sure __down_read_common() is always inlined so that the callers' names land in traceevents output and thus the blocked function can be identified * tag 'locking_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers commit ef21831c2e4e66cb948d5107f47c1aa0a5711a56 Merge: f3b9e8e4c8484 b752ea0c28e3f Author: Linus Torvalds Date: Sun May 14 07:56:51 2023 -0700 Merge tag 'perf_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Make sure the PEBS buffer is flushed before reprogramming the hardware so that the correct record sizes are used - Update the sample size for AMD BRS events - Fix a confusion with using the same on-stack struct with different events in the event processing path * tag 'perf_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG perf/x86: Fix missing sample size update on AMD BRS perf/core: Fix perf_sample_data not properly initialized for different swevents in perf_tp_event() commit f3b9e8e4c84845d09dbba49f664fc8407f18a3dc Merge: 011e33ee48849 0019a2d4b7e37 Author: Linus Torvalds Date: Sun May 14 07:50:34 2023 -0700 Merge tag 'sched_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: - Fix a couple of kernel-doc warnings * tag 'sched_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: fix cid_lock kernel-doc warnings commit 011e33ee48849739aab1d25b9e41c824fb5383a9 Merge: 491459b5ec375 7d8accfaa0ab6 Author: Linus Torvalds Date: Sun May 14 07:44:48 2023 -0700 Merge tag 'x86_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: - Add the required PCI IDs so that the generic SMN accesses provided by amd_nb.c work for drivers which switch to them. Add a PCI device ID to k10temp's table so that latter is loaded on such systems too * tag 'x86_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: hwmon: (k10temp) Add PCI ID for family 19, model 78h x86/amd_nb: Add PCI ID for family 19h model 78h commit 491459b5ec3751a3a58129db4fb9f832e474bb95 Merge: bb7c241fae622 f9d36cf445fff Author: Linus Torvalds Date: Sun May 14 07:39:15 2023 -0700 Merge tag 'timers_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Borislav Petkov: - Prevent CPU state corruption when an active clockevent broadcast device is replaced while the system is already in oneshot mode * tag 'timers_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tick/broadcast: Make broadcast device replacement work correctly commit 91aa4b3782448a7a13baa8cbcdfd5fd19defcbd9 Author: Alexander Stein Date: Wed May 3 13:31:10 2023 +0200 ARM: dts: imx6qdl-mba6: Add missing pvcie-supply regulator This worked before by coincidence, as the regulator was probed and enabled before PCI RC probe. But probe order changed since commit 259b93b21a9f ("regulator: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in 4.14") and PCIe supply is enabled after RC. Fix this by adding the regulator to RC node. The PCIe vaux regulator still needs to be enabled unconditionally for Mini-PCIe USB-only devices. Fixes: ef3846247b41 ("ARM: dts: imx6qdl: add TQ-Systems MBa6x device trees") Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 892943d7729bbfb2edeed9e323eba9a5cec21c49 Author: Christoph Niedermaier Date: Tue May 2 13:14:24 2023 +0200 ARM: dts: imx6ull-dhcor: Set and limit the mode for PMIC buck 1, 2 and 3 According to Renesas Electronics (formerly Dialog Semiconductor), the standard AUTO mode of the PMIC DA9061 can lead to stability problems depending on the hardware revision. It is recommended to set a defined mode such as PFM or PWM permanently. So set and limit the mode for buck 1, 2 and 3 to a fixed one. Fixes: 611b6c891e40 ("ARM: dts: imx6ull-dhcom: Add DH electronics DHCOM i.MX6ULL SoM and PDK2 board") Signed-off-by: Christoph Niedermaier Reviewed-by: Marek Vasut Signed-off-by: Shawn Guo commit f161cea5a20f3aeeb637a88ad1705fc2720b4d58 Author: Hugo Villeneuve Date: Mon May 1 13:05:32 2023 -0400 arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay While testing the ethernet interface on a Variscite symphony carrier board using an imx8mn SOM with an onboard ADIN1300 PHY (EC hardware configuration), the ethernet PHY is not detected. The ADIN1300 datasheet indicate that the "Management interface active (t4)" state is reached at most 5ms after the reset signal is deasserted. The device tree in Variscite custom git repository uses the following property: phy-reset-post-delay = <20>; Add a new MDIO property 'reset-deassert-us' of 20ms to have the same delay inside the ethphy node. Adding this property fixes the problem with the PHY detection. Note that this SOM can also have an Atheros AR8033 PHY. In this case, a 1ms deassert delay is sufficient. Add a comment to that effect. Fixes: ade0176dd8a0 ("arm64: dts: imx8mn-var-som: Add Variscite VAR-SOM-MX8MN System on Module") Signed-off-by: Hugo Villeneuve Signed-off-by: Shawn Guo commit 2ac6c4a637132b79863426223242e680cc4f8e27 Author: Adam Ford Date: Sun Apr 23 07:35:13 2023 -0500 arm64: dts: imx8mn: Fix video clock parents There are a few clocks whose parents are set in mipi_dsi and mxsfb nodes, but these clocks are used by the disp_blk_ctrl power domain which may cause an issue when re-parenting, resuling in a disp_pixel clock having the wrong parent and wrong rate. Fix this by moving the assigned-clock-parents as associate clock assignments to the power-domain node to setup these clocks before they are enabled. Fixes: d825fb6455d5 ("arm64: dts: imx8mn: Add display pipeline components") Signed-off-by: Adam Ford Signed-off-by: Shawn Guo commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 Author: Takashi Iwai Date: Fri May 12 16:18:00 2023 +0100 media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() Using a semaphore in the wait_event*() condition is no good idea. It hits a kernel WARN_ON() at prepare_to_wait_event() like: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait_event+0x6d/0x690 For avoiding the potential deadlock, rewrite to an open-coded loop instead. Unlike the loop in wait_event*(), this uses wait_woken() after the condition check, hence the task state stays consistent. CVE-2023-31084 was assigned to this bug. Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de Reported-by: Yu Hao Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084 Signed-off-by: Takashi Iwai Signed-off-by: Mauro Carvalho Chehab commit 627bb528b086b4136315c25d6a447a98ea9448d3 Author: Hyunwoo Kim Date: Thu Nov 17 04:59:24 2022 +0000 media: dvb-core: Fix use-after-free due to race at dvb_register_device() dvb_register_device() dynamically allocates fops with kmemdup() to set the fops->owner. And these fops are registered in 'file->f_ops' using replace_fops() in the dvb_device_open() process, and kfree()d in dvb_free_device(). However, it is not common to use dynamically allocated fops instead of 'static const' fops as an argument of replace_fops(), and UAF may occur. These UAFs can occur on any dvb type using dvb_register_device(), such as dvb_dvr, dvb_demux, dvb_frontend, dvb_net, etc. So, instead of kfree() the fops dynamically allocated in dvb_register_device() in dvb_free_device() called during the .disconnect() process, kfree() it collectively in exit_dvbdev() called when the dvbdev.c module is removed. Link: https://lore.kernel.org/linux-media/20221117045925.14297-4-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab commit 4172385b0c9ac366dcab78eda48c26814b87ed1a Author: Hyunwoo Kim Date: Thu Nov 17 04:59:23 2022 +0000 media: dvb-core: Fix use-after-free due on race condition at dvb_net A race condition may occur between the .disconnect function, which is called when the device is disconnected, and the dvb_device_open() function, which is called when the device node is open()ed. This results in several types of UAFs. The root cause of this is that you use the dvb_device_open() function, which does not implement a conditional statement that checks 'dvbnet->exit'. So, add 'remove_mutex` to protect 'dvbnet->exit' and use locked_dvb_net_open() function to check 'dvbnet->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f Author: Hyunwoo Kim Date: Thu Nov 17 04:59:22 2022 +0000 media: dvb-core: Fix use-after-free on race condition at dvb_frontend If the device node of dvb_frontend is open() and the device is disconnected, many kinds of UAFs may occur when calling close() on the device node. The root cause of this is that wake_up() for dvbdev->wait_queue is implemented in the dvb_frontend_release() function, but wait_event() is not implemented in the dvb_frontend_stop() function. So, implement wait_event() function in dvb_frontend_stop() and add 'remove_mutex' which prevents race condition for 'fe->exit'. [mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic] Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab commit ae11c0efaec32fb45130ee9886689f467232eebc Author: Krzysztof Kozlowski Date: Sun Mar 12 13:13:18 2023 +0000 media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table The driver will match mostly by DT table (even thought there is regular ID table) so there is little benefit in of_match_ptr (this also allows ACPI matching via PRP0001, even though it might not be relevant here). This also fixes !CONFIG_OF error: drivers/media/dvb-frontends/mn88443x.c:782:34: error: ‘mn88443x_of_match’ defined but not used [-Werror=unused-const-variable=] Link: https://lore.kernel.org/linux-media/20230312131318.351173-28-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Mauro Carvalho Chehab commit 517a281338322ff8293f988771c98aaa7205e457 Author: Hyunwoo Kim Date: Thu Nov 17 04:59:25 2022 +0000 media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() Since dvb_frontend_detach() is not called in ttusb_dec_exit_dvb(), which is called when the device is disconnected, dvb_frontend_free() is not finally called. This causes a memory leak just by repeatedly plugging and unplugging the device. Fix this issue by adding dvb_frontend_detach() to ttusb_dec_exit_dvb(). Link: https://lore.kernel.org/linux-media/20221117045925.14297-5-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab commit a4315e5be7020aac9b24a8151caf4bb85224cd0e Author: YongSu Yoo Date: Thu Aug 18 13:50:27 2022 +0100 media: dvb_ca_en50221: fix a size write bug The function of "dvb_ca_en50221_write_data" at source/drivers/media /dvb-core/dvb_ca_en50221.c is used for two cases. The first case is for writing APDU data in the function of "dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/ dvb_ca_en50221.c. The second case is for writing the host link buf size on the Command Register in the function of "dvb_ca_en50221_link_init" at source/drivers/media/dvb-core/dvb_ca_en50221.c. In the second case, there exists a bug like following. In the function of the "dvb_ca_en50221_link_init", after a TV host calculates the host link buf_size, the TV host writes the calculated host link buf_size on the Size Register. Accroding to the en50221 Spec (the page 60 of https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf), before this writing operation, the "SW(CMDREG_SW)" flag in the Command Register should be set. We can see this setting operation in the function of the "dvb_ca_en50221_link_init" like below. ... if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0) return ret; ... But, after that, the real writing operation is implemented using the function of the "dvb_ca_en50221_write_data" in the function of "dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data" includes the function of "ca->pub->write_cam_control", and the function of the "ca->pub->write_cam_control" in the function of the "dvb_ca_en50221_wrte_data" does not include "CMDREG_SW" flag like below. ... if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_HC)) != 0) ... In the above source code, we can see only the "IRQEN | CMDREG_HC", but we cannot see the "CMDREG_SW". The "CMDREG_SW" flag which was set in the function of the "dvb_ca_en50221_link_init" was rollbacked by the follwoing function of the "dvb_ca_en50221_write_data". This is a bug. and this bug causes that the calculated host link buf_size is not properly written in the CI module. Through this patch, we fix this bug. Link: https://lore.kernel.org/linux-media/20220818125027.1131-1-yongsuyoo0215@gmail.com Signed-off-by: YongSu Yoo Signed-off-by: Mauro Carvalho Chehab commit e6ad6233592593079db5c8fa592c298e51bc1356 Author: Wei Chen Date: Wed Mar 15 13:45:18 2023 +0000 media: netup_unidvb: fix irq init by register it at the end of probe IRQ handler netup_spi_interrupt() takes spinlock spi->lock. The lock is initialized in netup_spi_init(). However, irq handler is registered before initializing the lock. Spinlock dma->lock and i2c->lock suffer from the same problem. Fix this by registering the irq at the end of probe. Link: https://lore.kernel.org/linux-media/20230315134518.1074497-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab commit a3fd1ef27aa686d871cefe207bd6168c4b0cd29e Author: Wei Chen Date: Tue Mar 28 13:44:16 2023 +0100 media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address In su3000_read_mac_address, if i2c_transfer fails to execute two messages, array mac address will not be initialized. Without handling such error, later in function dvb_usb_adapter_dvb_init, proposed_mac is accessed before initialization. Fix this error by returning a negative value if message execution fails. Link: https://lore.kernel.org/linux-media/20230328124416.560889-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab commit 9ded5bd2a49ce3015b7c936743eec0a0e6e11f0c Author: Wei Chen Date: Mon Mar 13 09:50:08 2023 +0000 media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() In digitv_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach digitv_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/20230313095008.1039689-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab commit aa4a447b81b84f69c1a89ad899df157f386d7636 Author: Zhang Shurong Date: Sun May 7 15:52:47 2023 +0100 media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer In rtl28xxu_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach rtl28xxu_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/tencent_3623572106754AC2F266B316798B0F6CCA05@qq.com Signed-off-by: Zhang Shurong Signed-off-by: Mauro Carvalho Chehab commit dff919090155fb22679869e8469168f270dcd97f Author: Wei Chen Date: Mon Mar 13 09:27:51 2023 +0000 media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() In ce6230_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach ce6230_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/20230313092751.209496-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab commit a6dcefcc08eca1bf4e3d213c97c3cfb75f377935 Author: Wei Chen Date: Mon Mar 13 08:58:53 2023 +0000 media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() In ec168_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. If accessing msg[i].buf[0] without sanity check, null pointer deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/20230313085853.3252349-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab commit 858e97d7956d17a2cb56a9413468704a4d5abfe1 Author: Wei Chen Date: Fri Mar 10 16:56:04 2023 +0000 media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() In az6027_i2c_xfer, msg is controlled by user. When msg[i].buf is null, commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") fix the null-ptr-deref bug when msg[i].addr is 0x99. However, null-ptr-deref also happens when msg[i].addr is 0xd0 and 0xc0. We add check on msg[i].len to prevent null-ptr-deref. Link: https://lore.kernel.org/linux-media/20230310165604.3093483-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab commit 0f5bb36bf9b39a2a96e730bf4455095b50713f63 Author: Duoming Zhou Date: Wed Mar 8 12:55:14 2023 +0000 media: netup_unidvb: fix use-after-free at del_timer() When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below: (cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE Fix by changing del_timer() to del_timer_sync(). Link: https://lore.kernel.org/linux-media/20230308125514.4208-1-duoming@zju.edu.cn Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver") Signed-off-by: Duoming Zhou Signed-off-by: Mauro Carvalho Chehab commit bb7c241fae6228e89c0286ffd6f249b3b0dea225 Merge: adfbf653a3ba6 2a534e1d0d159 Author: Linus Torvalds Date: Sat May 13 17:45:39 2023 -0700 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Some ext4 bug fixes (mostly to address Syzbot reports)" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: bail out of ext4_xattr_ibody_get() fails for any reason ext4: add bounds checking in get_max_inline_xattr_value_size() ext4: add indication of ro vs r/w mounts in the mount message ext4: fix deadlock when converting an inline directory in nojournal mode ext4: improve error recovery code paths in __ext4_remount() ext4: improve error handling from ext4_dirhash() ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled ext4: check iomap type only if ext4_iomap_begin() does not fail ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum ext4: fix data races when using cached status extents ext4: avoid deadlock in fs reclaim with page writeback ext4: fix invalid free tracking in ext4_xattr_move_to_block() ext4: remove a BUG_ON in ext4_mb_release_group_pa() ext4: allow ext4_get_group_info() to fail ext4: fix lockdep warning when enabling MMP ext4: fix WARNING in mb_find_extent commit adfbf653a3ba6bb8bbb84ed90bf4f1533db545d3 Merge: 046206bad0f6a 0bdf1ad8d10bd Author: Linus Torvalds Date: Sat May 13 17:41:58 2023 -0700 Merge tag 'fbdev-for-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - use after free fix in imsttfb (Zheng Wang) - fix error handling in arcfb (Zongjie Li) - lots of whitespace cleanups (Thomas Zimmermann) - add 1920x1080 modedb entry (me) * tag 'fbdev-for-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: stifb: Fix info entry in sti_struct on error path fbdev: modedb: Add 1920x1080 at 60 Hz video mode fbdev: imsttfb: Fix use after free bug in imsttfb_probe fbdev: vfb: Remove trailing whitespaces fbdev: valkyriefb: Remove trailing whitespaces fbdev: stifb: Remove trailing whitespaces fbdev: sa1100fb: Remove trailing whitespaces fbdev: platinumfb: Remove trailing whitespaces fbdev: p9100: Remove trailing whitespaces fbdev: maxinefb: Remove trailing whitespaces fbdev: macfb: Remove trailing whitespaces fbdev: hpfb: Remove trailing whitespaces fbdev: hgafb: Remove trailing whitespaces fbdev: g364fb: Remove trailing whitespaces fbdev: controlfb: Remove trailing whitespaces fbdev: cg14: Remove trailing whitespaces fbdev: atmel_lcdfb: Remove trailing whitespaces fbdev: 68328fb: Remove trailing whitespaces fbdev: arcfb: Fix error handling in arcfb_probe() commit 046206bad0f6a886e1f890c5fcb106d596971c95 Merge: d4d58949a6eac 1a7edd041f2d2 Author: Linus Torvalds Date: Sat May 13 17:37:32 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "A single small fix for the UFS driver to fix a power management failure" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend commit 6f9e98849edaa8aefc4030ff3500e41556e83ff7 Author: Helge Deller Date: Sat May 13 22:30:06 2023 +0200 parisc: Fix encoding of swp_entry due to added SWP_EXCLUSIVE flag Fix the __swp_offset() and __swp_entry() macros due to commit 6d239fc78c0b ("parisc/mm: support __HAVE_ARCH_PTE_SWP_EXCLUSIVE") which introduced the SWP_EXCLUSIVE flag by reusing the _PAGE_ACCESSED flag. Reported-by: Christoph Biedl Tested-by: Christoph Biedl Reviewed-by: David Hildenbrand Signed-off-by: Helge Deller Fixes: 6d239fc78c0b ("parisc/mm: support __HAVE_ARCH_PTE_SWP_EXCLUSIVE") Cc: # v6.3+ commit 2a534e1d0d1591e951f9ece2fb460b2ff92edabd Author: Theodore Ts'o Date: Fri May 12 15:16:27 2023 -0400 ext4: bail out of ext4_xattr_ibody_get() fails for any reason In ext4_update_inline_data(), if ext4_xattr_ibody_get() fails for any reason, it's best if we just fail as opposed to stumbling on, especially if the failure is EFSCORRUPTED. Cc: stable@kernel.org Signed-off-by: Theodore Ts'o commit 2220eaf90992c11d888fe771055d4de330385f01 Author: Theodore Ts'o Date: Fri May 12 15:11:02 2023 -0400 ext4: add bounds checking in get_max_inline_xattr_value_size() Normally the extended attributes in the inode body would have been checked when the inode is first opened, but if someone is writing to the block device while the file system is mounted, it's possible for the inode table to get corrupted. Add bounds checking to avoid reading beyond the end of allocated memory if this happens. Reported-by: syzbot+1966db24521e5f6e23f7@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=1966db24521e5f6e23f7 Cc: stable@kernel.org Signed-off-by: Theodore Ts'o commit 6dcc98fbc46511f7a6650946f198df6951a5a88c Author: Theodore Ts'o Date: Fri May 12 14:49:57 2023 -0400 ext4: add indication of ro vs r/w mounts in the mount message Whether the file system is mounted read-only or read/write is more important than the quota mode, which we are already printing. Add the ro vs r/w indication since this can be helpful in debugging problems from the console log. Signed-off-by: Theodore Ts'o commit f4ce24f54d9cca4f09a395f3eecce20d6bec4663 Author: Theodore Ts'o Date: Sat May 6 21:04:01 2023 -0400 ext4: fix deadlock when converting an inline directory in nojournal mode In no journal mode, ext4_finish_convert_inline_dir() can self-deadlock by calling ext4_handle_dirty_dirblock() when it already has taken the directory lock. There is a similar self-deadlock in ext4_incvert_inline_data_nolock() for data files which we'll fix at the same time. A simple reproducer demonstrating the problem: mke2fs -Fq -t ext2 -O inline_data -b 4k /dev/vdc 64 mount -t ext4 -o dirsync /dev/vdc /vdc cd /vdc mkdir file0 cd file0 touch file0 touch file1 attr -s BurnSpaceInEA -V abcde . touch supercalifragilisticexpialidocious Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230507021608.1290720-1-tytso@mit.edu Reported-by: syzbot+91dccab7c64e2850a4e5@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=ba84cc80a9491d65416bc7877e1650c87530fe8a Signed-off-by: Theodore Ts'o commit 4c0b4818b1f636bc96359f7817a2d8bab6370162 Author: Theodore Ts'o Date: Fri May 5 22:20:29 2023 -0400 ext4: improve error recovery code paths in __ext4_remount() If there are failures while changing the mount options in __ext4_remount(), we need to restore the old mount options. This commit fixes two problem. The first is there is a chance that we will free the old quota file names before a potential failure leading to a use-after-free. The second problem addressed in this commit is if there is a failed read/write to read-only transition, if the quota has already been suspended, we need to renable quota handling. Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230506142419.984260-2-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 4b3cb1d108bfc2aebb0d7c8a52261a53cf7f5786 Author: Theodore Ts'o Date: Sat May 6 11:59:13 2023 -0400 ext4: improve error handling from ext4_dirhash() The ext4_dirhash() will *almost* never fail, especially when the hash tree feature was first introduced. However, with the addition of support of encrypted, casefolded file names, that function can most certainly fail today. So make sure the callers of ext4_dirhash() properly check for failures, and reflect the errors back up to their callers. Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230506142419.984260-1-tytso@mit.edu Reported-by: syzbot+394aa8a792cb99dbc837@syzkaller.appspotmail.com Reported-by: syzbot+344aaa8697ebd232bfc8@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=db56459ea4ac4a676ae4b4678f633e55da005a9b Signed-off-by: Theodore Ts'o commit a44be64bbecb15a452496f60db6eacfee2b59c79 Author: Theodore Ts'o Date: Fri May 5 21:02:30 2023 -0400 ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled When a file system currently mounted read/only is remounted read/write, if we clear the SB_RDONLY flag too early, before the quota is initialized, and there is another process/thread constantly attempting to create a directory, it's possible to trigger the WARN_ON_ONCE(dquot_initialize_needed(inode)); in ext4_xattr_block_set(), with the following stack trace: WARNING: CPU: 0 PID: 5338 at fs/ext4/xattr.c:2141 ext4_xattr_block_set+0x2ef2/0x3680 RIP: 0010:ext4_xattr_block_set+0x2ef2/0x3680 fs/ext4/xattr.c:2141 Call Trace: ext4_xattr_set_handle+0xcd4/0x15c0 fs/ext4/xattr.c:2458 ext4_initxattrs+0xa3/0x110 fs/ext4/xattr_security.c:44 security_inode_init_security+0x2df/0x3f0 security/security.c:1147 __ext4_new_inode+0x347e/0x43d0 fs/ext4/ialloc.c:1324 ext4_mkdir+0x425/0xce0 fs/ext4/namei.c:2992 vfs_mkdir+0x29d/0x450 fs/namei.c:4038 do_mkdirat+0x264/0x520 fs/namei.c:4061 __do_sys_mkdirat fs/namei.c:4076 [inline] __se_sys_mkdirat fs/namei.c:4074 [inline] __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4074 Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230506142419.984260-1-tytso@mit.edu Reported-by: syzbot+6385d7d3065524c5ca6d@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=6513f6cb5cd6b5fc9f37e3bb70d273b94be9c34c Signed-off-by: Theodore Ts'o commit fa83c34e3e56b3c672af38059e066242655271b1 Author: Baokun Li Date: Fri May 5 21:24:29 2023 +0800 ext4: check iomap type only if ext4_iomap_begin() does not fail When ext4_iomap_overwrite_begin() calls ext4_iomap_begin() map blocks may fail for some reason (e.g. memory allocation failure, bare disk write), and later because "iomap->type ! = IOMAP_MAPPED" triggers WARN_ON(). When ext4 iomap_begin() returns an error, it is normal that the type of iomap->type may not match the expectation. Therefore, we only determine if iomap->type is as expected when ext4_iomap_begin() is executed successfully. Cc: stable@kernel.org Reported-by: syzbot+08106c4b7d60702dbc14@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/00000000000015760b05f9b4eee9@google.com Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230505132429.714648-1-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 4f04351888a83e595571de672e0a4a8b74f4fb31 Author: Tudor Ambarus Date: Thu May 4 12:15:25 2023 +0000 ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum When modifying the block device while it is mounted by the filesystem, syzbot reported the following: BUG: KASAN: slab-out-of-bounds in crc16+0x206/0x280 lib/crc16.c:58 Read of size 1 at addr ffff888075f5c0a8 by task syz-executor.2/15586 CPU: 1 PID: 15586 Comm: syz-executor.2 Not tainted 6.2.0-rc5-syzkaller-00205-gc96618275234 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 crc16+0x206/0x280 lib/crc16.c:58 ext4_group_desc_csum+0x81b/0xb20 fs/ext4/super.c:3187 ext4_group_desc_csum_set+0x195/0x230 fs/ext4/super.c:3210 ext4_mb_clear_bb fs/ext4/mballoc.c:6027 [inline] ext4_free_blocks+0x191a/0x2810 fs/ext4/mballoc.c:6173 ext4_remove_blocks fs/ext4/extents.c:2527 [inline] ext4_ext_rm_leaf fs/ext4/extents.c:2710 [inline] ext4_ext_remove_space+0x24ef/0x46a0 fs/ext4/extents.c:2958 ext4_ext_truncate+0x177/0x220 fs/ext4/extents.c:4416 ext4_truncate+0xa6a/0xea0 fs/ext4/inode.c:4342 ext4_setattr+0x10c8/0x1930 fs/ext4/inode.c:5622 notify_change+0xe50/0x1100 fs/attr.c:482 do_truncate+0x200/0x2f0 fs/open.c:65 handle_truncate fs/namei.c:3216 [inline] do_open fs/namei.c:3561 [inline] path_openat+0x272b/0x2dd0 fs/namei.c:3714 do_filp_open+0x264/0x4f0 fs/namei.c:3741 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f72f8a8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f72f97e3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f72f8bac050 RCX: 00007f72f8a8c0c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000280 RBP: 00007f72f8ae7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd165348bf R14: 00007f72f97e3300 R15: 0000000000022000 Replace le16_to_cpu(sbi->s_es->s_desc_size) with sbi->s_desc_size It reduces ext4's compiled text size, and makes the code more efficient (we remove an extra indirect reference and a potential byte swap on big endian systems), and there is no downside. It also avoids the potential KASAN / syzkaller failure, as a bonus. Reported-by: syzbot+fc51227e7100c9294894@syzkaller.appspotmail.com Reported-by: syzbot+8785e41224a3afd04321@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=70d28d11ab14bd7938f3e088365252aa923cff42 Link: https://syzkaller.appspot.com/bug?id=b85721b38583ecc6b5e72ff524c67302abbc30f3 Link: https://lore.kernel.org/all/000000000000ece18705f3b20934@google.com/ Fixes: 717d50e4971b ("Ext4: Uninitialized Block Groups") Cc: stable@vger.kernel.org Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20230504121525.3275886-1-tudor.ambarus@linaro.org Signed-off-by: Theodore Ts'o commit 492888df0c7b42fc0843631168b0021bc4caee84 Author: Jan Kara Date: Thu May 4 14:55:24 2023 +0200 ext4: fix data races when using cached status extents When using cached extent stored in extent status tree in tree->cache_es another process holding ei->i_es_lock for reading can be racing with us setting new value of tree->cache_es. If the compiler would decide to refetch tree->cache_es at an unfortunate moment, it could result in a bogus in_range() check. Fix the possible race by using READ_ONCE() when using tree->cache_es only under ei->i_es_lock for reading. Cc: stable@kernel.org Reported-by: syzbot+4a03518df1e31b537066@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000d3b33905fa0fd4a6@google.com Suggested-by: Dmitry Vyukov Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230504125524.10802-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit 00d873c17e29cc32d90ca852b82685f1673acaa5 Author: Jan Kara Date: Thu May 4 14:47:23 2023 +0200 ext4: avoid deadlock in fs reclaim with page writeback Ext4 has a filesystem wide lock protecting ext4_writepages() calls to avoid races with switching of journalled data flag or inode format. This lock can however cause a deadlock like: CPU0 CPU1 ext4_writepages() percpu_down_read(sbi->s_writepages_rwsem); ext4_change_inode_journal_flag() percpu_down_write(sbi->s_writepages_rwsem); - blocks, all readers block from now on ext4_do_writepages() ext4_init_io_end() kmem_cache_zalloc(io_end_cachep, GFP_KERNEL) fs_reclaim frees dentry... dentry_unlink_inode() iput() - last ref => iput_final() - inode dirty => write_inode_now()... ext4_writepages() tries to acquire sbi->s_writepages_rwsem and blocks forever Make sure we cannot recurse into filesystem reclaim from writeback code to avoid the deadlock. Reported-by: syzbot+6898da502aef574c5f8a@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/0000000000004c66b405fa108e27@google.com Fixes: c8585c6fcaf2 ("ext4: fix races between changing inode journal mode and ext4_writepages") CC: stable@vger.kernel.org Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230504124723.20205-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit b87c7cdf2bed4928b899e1ce91ef0d147017ba45 Author: Theodore Ts'o Date: Sun Apr 30 03:04:13 2023 -0400 ext4: fix invalid free tracking in ext4_xattr_move_to_block() In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by kvmalloc() if the value is stored in an external inode. So at the end of the function the code tried to check if this was the case by testing entry->e_value_inum. However, at this point, the pointer to the xattr entry is no longer valid, because it was removed from the original location where it had been stored. So we could end up calling kvfree() on a pointer which was not allocated by kvmalloc(); or we could also potentially leak memory by not freeing the buffer when it should be freed. Fix this by storing whether it should be freed in a separate variable. Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230430160426.581366-1-tytso@mit.edu Link: https://syzkaller.appspot.com/bug?id=5c2aee8256e30b55ccf57312c16d88417adbd5e1 Link: https://syzkaller.appspot.com/bug?id=41a6b5d4917c0412eb3b3c3c604965bed7d7420b Reported-by: syzbot+64b645917ce07d89bde5@syzkaller.appspotmail.com Reported-by: syzbot+0d042627c4f2ad332195@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o commit 463808f237cf73e98a1a45ff7460c2406a150a0b Author: Theodore Ts'o Date: Sat Apr 29 16:14:46 2023 -0400 ext4: remove a BUG_ON in ext4_mb_release_group_pa() If a malicious fuzzer overwrites the ext4 superblock while it is mounted such that the s_first_data_block is set to a very large number, the calculation of the block group can underflow, and trigger a BUG_ON check. Change this to be an ext4_warning so that we don't crash the kernel. Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230430154311.579720-3-tytso@mit.edu Reported-by: syzbot+e2efa3efc15a1c9e95c3@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=69b28112e098b070f639efb356393af3ffec4220 Signed-off-by: Theodore Ts'o commit 5354b2af34064a4579be8bc0e2f15a7b70f14b5f Author: Theodore Ts'o Date: Sat Apr 29 00:06:28 2023 -0400 ext4: allow ext4_get_group_info() to fail Previously, ext4_get_group_info() would treat an invalid group number as BUG(), since in theory it should never happen. However, if a malicious attaker (or fuzzer) modifies the superblock via the block device while it is the file system is mounted, it is possible for s_first_data_block to get set to a very large number. In that case, when calculating the block group of some block number (such as the starting block of a preallocation region), could result in an underflow and very large block group number. Then the BUG_ON check in ext4_get_group_info() would fire, resutling in a denial of service attack that can be triggered by root or someone with write access to the block device. For a quality of implementation perspective, it's best that even if the system administrator does something that they shouldn't, that it will not trigger a BUG. So instead of BUG'ing, ext4_get_group_info() will call ext4_error and return NULL. We also add fallback code in all of the callers of ext4_get_group_info() that it might NULL. Also, since ext4_get_group_info() was already borderline to be an inline function, un-inline it. The results in a next reduction of the compiled text size of ext4 by roughly 2k. Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230430154311.579720-2-tytso@mit.edu Reported-by: syzbot+e2efa3efc15a1c9e95c3@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=69b28112e098b070f639efb356393af3ffec4220 Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara commit 55720d242052e860b9fde445e302e0425722e7f1 Author: Geert Uytterhoeven Date: Tue May 9 14:34:22 2023 +0200 dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value The conversion to json-schema accidentally dropped the "ad" part prefix from the compatible value. Fixes: 8c41245872e2 ("dt-bindings:iio:adc:renesas,rcar-gyroadc: txt to yaml conversion.") Signed-off-by: Geert Uytterhoeven Reviewed-by: Marek Vasut Reviewed-by: Krzysztof Kozlowski Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/6b328a3f52657c20759f3a5bb2fe033d47644ba8.1683635404.git.geert+renesas@glider.be Cc: Signed-off-by: Jonathan Cameron commit 09d3bec7009186bdba77039df01e5834788b3f95 Author: Marek Vasut Date: Thu May 11 02:43:30 2023 +0200 iio: dac: mcp4725: Fix i2c_master_send() return value handling The i2c_master_send() returns number of sent bytes on success, or negative on error. The suspend/resume callbacks expect zero on success and non-zero on error. Adapt the return value of the i2c_master_send() to the expectation of the suspend and resume callbacks, including proper validation of the return value. Fixes: cf35ad61aca2 ("iio: add mcp4725 I2C DAC driver") Signed-off-by: Marek Vasut Reviewed-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230511004330.206942-1-marex@denx.de Cc: Signed-off-by: Jonathan Cameron commit 56cd3d1c5c5b073a1a444eafdcf97d4d866d351a Author: Matti Vaittinen Date: Fri May 12 10:53:41 2023 +0300 iio: accel: kx022a fix irq getting The fwnode_irq_get_byname() was returning 0 at device-tree mapping error. If this occurred, the KX022A driver did abort the probe but errorneously directly returned the return value from fwnode_irq_get_byname() from probe. In case of a device-tree mapping error this indicated success. The fwnode_irq_get_byname() has since been fixed to not return zero on error so the check for fwnode_irq_get_byname() can be relaxed to only treat negative values as errors. This will also do decent fix even when backported to branches where fwnode_irq_get_byname() can still return zero on error because KX022A probe should later fail at IRQ requesting and a prober error handling should follow. Relax the return value check for fwnode_irq_get_byname() to only treat negative values as errors. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202305110245.MFxC9bUj-lkp@intel.com/ Link: https://lore.kernel.org/r/202305110245.MFxC9bUj-lkp@intel.com/ Signed-off-by: Matti Vaittinen Fixes: 7c1d1677b322 ("iio: accel: Support Kionix/ROHM KX022A accelerometer") Link: https://lore.kernel.org/r/b45b4b638db109c6078d243252df3a7b0485f7d5.1683875389.git.mazziesaccount@gmail.com Cc: Signed-off-by: Jonathan Cameron commit d049151adde4ec17392592d145e94f0086f8ee80 Author: Matti Vaittinen Date: Mon May 8 14:01:25 2023 +0300 iio: bu27034: Ensure reset is written The reset bit must be always written to the hardware no matter what value is in a cache or register. Ensure this by using regmap_write_bits() instead of the regmap_update_bits(). Furthermore, the SWRESET bit may be self-clearing, so mark the SYSTEM_CONTROL register volatile to guarantee we do also read the right state - should we ever need to read it. Finally, writing the SWRESET bit will restore the default register values. This can cause register cache to be outdated if there are any register values cached. Rebuild register cache after SWRESET and use regmap_update_bits() when performing the reset. Signed-off-by: Matti Vaittinen Fixes: e52afbd61039 ("iio: light: ROHM BU27034 Ambient Light Sensor") Link: https://lore.kernel.org/r/ZFjWhbfuN5XcKty+@fedora Signed-off-by: Jonathan Cameron commit a146eccb68be161ae9eab5f3f68bb0ed7c0fbaa8 Author: Lukas Bulwahn Date: Mon May 8 06:02:08 2023 +0200 iio: dac: build ad5758 driver when AD5758 is selected Commit 28d1a7ac2a0d ("iio: dac: Add AD5758 support") adds the config AD5758 and the corresponding driver ad5758.c. In the Makefile, the ad5758 driver is however included when AD5755 is selected, not when AD5758 is selected. Probably, this was simply a mistake that happened by copy-and-paste and forgetting to adjust the actual line. Surprisingly, no one has ever noticed that this driver is actually only included when AD5755 is selected and that the config AD5758 has actually no effect on the build. Fixes: 28d1a7ac2a0d ("iio: dac: Add AD5758 support") Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20230508040208.12033-1-lukas.bulwahn@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 24febc99ca725dcf42d57168a2f4e8a75a5ade92 Author: Rasmus Villemoes Date: Wed May 3 11:58:17 2023 +0200 iio: addac: ad74413: fix resistance input processing On success, ad74413r_get_single_adc_result() returns IIO_VAL_INT aka 1. So currently, the IIO_CHAN_INFO_PROCESSED case is effectively equivalent to the IIO_CHAN_INFO_RAW case, and we never call ad74413r_adc_to_resistance_result() to convert the adc measurement to ohms. Check ret for being negative rather than non-zero. Fixes: fea251b6a5dbd (iio: addac: add AD74413R driver) Signed-off-by: Rasmus Villemoes Reviewed-by: Nuno Sa Link: https://lore.kernel.org/r/20230503095817.452551-1-linux@rasmusvillemoes.dk Cc: Signed-off-by: Jonathan Cameron commit a551c26e8e568fad42120843521529241b9bceec Author: Frank Li Date: Mon May 1 10:36:04 2023 -0400 iio: light: vcnl4035: fixed chip ID check VCNL4035 register(0xE) ID_L and ID_M define as: ID_L: 0x80 ID_H: 7:6 (0:0) 5:4 (0:0) slave address = 0x60 (7-bit) (0:1) slave address = 0x51 (7-bit) (1:0) slave address = 0x40 (7-bit) (1:0) slave address = 0x41 (7-bit) 3:0 Version code default (0:0:0:0) So just check ID_L. Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035") Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20230501143605.1615549-1-Frank.Li@nxp.com Cc: Signed-off-by: Jonathan Cameron commit 72c1d11074d6160f19760d57fc78b2a7f52bcb1a Author: Alexander Stein Date: Mon Apr 24 11:23:12 2023 +0200 dt-bindings: iio: imx8qxp-adc: add missing vref-supply Although this property is used right now for IIO_CHAN_INFO_SCALE, this ADC has two internal reference voltages, which the driver currently doesn't make use of. Fixes: db73419d8c06 ("dt-bindings: iio: adc: Add binding documentation for NXP IMX8QXP ADC") Signed-off-by: Alexander Stein Reviewed-by: Haibo Chen Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230424092312.61746-1-alexander.stein@ew.tq-group.com Signed-off-by: Jonathan Cameron commit 3e27ef0ced49f8ae7883c25fadf76a2086e99025 Author: Sean Nyekjaer Date: Wed May 3 18:20:29 2023 +0200 iio: adc: stm32-adc: skip adc-channels setup if none is present If only adc differential channels are defined driver will fail with stm32-adc: probe of 48003000.adc:adc@0 failed with error -22 Fix this by skipping the initialization if no channels are defined. This applies only to the legacy way of initializing adc channels. Fixes: d7705f35448a ("iio: adc: stm32-adc: convert to device properties") Signed-off-by: Sean Nyekjaer Reviewed-by: Olivier Moysan Link: https://lore.kernel.org/r/20230503162029.3654093-2-sean@geanix.com Cc: Signed-off-by: Jonathan Cameron commit 9c0d6ccd7d6bbd275e390b55a3390b4274291d95 Author: Sean Nyekjaer Date: Wed May 3 18:20:28 2023 +0200 iio: adc: stm32-adc: skip adc-diff-channels setup if none is present If no adc differential channels are defined driver will fail with EINVAL: stm32-adc: probe of 48003000.adc:adc@0 failed with error -22 Fix this by skipping the initialization if no channels are defined. This applies only to the legacy way of initializing adc channels. Fixes: d7705f35448a ("iio: adc: stm32-adc: convert to device properties") Signed-off-by: Sean Nyekjaer Link: https://lore.kernel.org/r/20230503162029.3654093-1-sean@geanix.com Cc: Signed-off-by: Jonathan Cameron commit e55245d115bb9054cb72cdd5dda5660f4484873a Author: Paul Cercueil Date: Thu Mar 30 12:21:00 2023 +0200 iio: adc: ad7192: Change "shorted" channels to differential The AD7192 provides a specific channel configuration where both negative and positive inputs are connected to AIN2. This was represented in the ad7192 driver as a IIO channel with .channel = 2 and .extended_name set to "shorted". The problem with this approach, is that the driver provided two IIO channels with the identifier .channel = 2; one "shorted" and the other not. This goes against the IIO ABI, as a channel identifier should be unique. Address this issue by changing "shorted" channels to being differential instead, with channel 2 vs. itself, as we're actually measuring AIN2 vs. itself. Note that the fix tag is for the commit that moved the driver out of staging. The bug existed before that, but backporting would become very complex further down and unlikely to happen. Fixes: b581f748cce0 ("staging: iio: adc: ad7192: move out of staging") Signed-off-by: Paul Cercueil Co-developed-by: Alisa Roman Signed-off-by: Alisa Roman Reviewed-by: Nuno Sa Link: https://lore.kernel.org/r/20230330102100.17590-1-paul@crapouillou.net Cc: Signed-off-by: Jonathan Cameron commit 79b8ded9d9c595db9bd5b2f62f5f738b36de1e22 Author: Hans de Goede Date: Sun Apr 16 23:24:09 2023 +0200 iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method When apply_acpi_orientation() fails, st_accel_common_probe() will fall back to iio_read_mount_matrix(), which checks for a mount-matrix device property and if that is not set falls back to the identity matrix. But when a sensor has no ACPI companion fwnode, or when the ACPI fwnode does not have a "_ONT" method apply_acpi_orientation() was returning 0, causing iio_read_mount_matrix() to never get called resulting in an invalid mount_matrix: [root@fedora ~]# cat /sys/bus/iio/devices/iio\:device0/mount_matrix (null), (null), (null); (null), (null), (null); (null), (null), (null) Fix this by making apply_acpi_orientation() always return an error when it did not set the mount_matrix. Fixes: 3d8ad94bb175 ("iio: accel: st_sensors: Support generic mounting matrix") Signed-off-by: Hans de Goede Reviewed-by: Linus Walleij Tested-by: Marius Hoch Link: https://lore.kernel.org/r/20230416212409.310936-1-hdegoede@redhat.com Cc: Signed-off-by: Jonathan Cameron commit e65065132fa6d9e1fd3b7418eae5215e3b7bf6c7 Author: Matti Vaittinen Date: Mon Apr 17 12:20:18 2023 +0300 iio: gts-helpers: fix integration time units The IIO ABI mandates expressing integration times in seconds. The GTS helper errorneously uses micro seconds in integration_times_available. Fix this by converting the lists to IIO_VAL_INT_PLUS_MICRO. Fixes: 38416c28e168 ("iio: light: Add gain-time-scale helpers") Signed-off-by: Matti Vaittinen Link: https://lore.kernel.org/r/eeacd192c259e885850b5a2dd8b776bccfc44fa8.1681722914.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit b7b04f393ffa1530213f522115e7d77761eb5c4f Author: Matti Vaittinen Date: Mon Apr 17 12:19:57 2023 +0300 iio: bu27034: Fix integration time The bu27034 uses micro seconds for integration time configuration. This is incorrect as the ABI mandates use of seconds. Change BU27034 driver to use seconds for integration time. Fixes: e52afbd61039 ("iio: light: ROHM BU27034 Ambient Light Sensor") Signed-off-by: Matti Vaittinen Link: https://lore.kernel.org/r/a05647669af22ba919c7c87dccb43975e3235a87.1681722914.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 672cde9ef80ffde9e76d38f7aa2b287c4a18de9a Author: Matti Vaittinen Date: Fri Apr 21 08:46:11 2023 +0300 iio: fix doc for iio_gts_find_sel_by_int_time The kerneldoc for iio_gts_find_sel_by_int_time() has an error. Documentation states that function is searching a selector for a HW-gain while it is searching a selector for an integration time. Fix the documentation by saying the function is looking for a selector for an integration time. Fixes: 38416c28e168 ("iio: light: Add gain-time-scale helpers") Signed-off-by: Matti Vaittinen Link: https://lore.kernel.org/r/ZEIjI4YUzqPZk/9X@fedora Signed-off-by: Jonathan Cameron commit 279c3a2a5eb2c1054fbe38e5c33be08584229047 Author: Dan Carpenter Date: Fri Apr 21 13:41:56 2023 +0300 iio: adc: palmas: fix off by one bugs Valid values for "adc_chan" are zero to (PALMAS_ADC_CH_MAX - 1). Smatch detects some buffer overflows caused by this: drivers/iio/adc/palmas_gpadc.c:721 palmas_gpadc_read_event_value() error: buffer overflow 'adc->thresholds' 16 <= 16 drivers/iio/adc/palmas_gpadc.c:758 palmas_gpadc_write_event_value() error: buffer overflow 'adc->thresholds' 16 <= 16 The effect of this bug in other functions is more complicated but obviously we should fix all of them. Fixes: a99544c6c883 ("iio: adc: palmas: add support for iio threshold events") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/14fee94a-7db7-4371-b7d6-e94d86b9561e@kili.mountain Signed-off-by: Jonathan Cameron commit 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 Author: Jiakai Luo Date: Sat Apr 22 06:34:06 2023 -0700 iio: adc: mxs-lradc: fix the order of two cleanup operations Smatch reports: drivers/iio/adc/mxs-lradc-adc.c:766 mxs_lradc_adc_probe() warn: missing unwind goto? the order of three init operation: 1.mxs_lradc_adc_trigger_init 2.iio_triggered_buffer_setup 3.mxs_lradc_adc_hw_init thus, the order of three cleanup operation should be: 1.mxs_lradc_adc_hw_stop 2.iio_triggered_buffer_cleanup 3.mxs_lradc_adc_trigger_remove we exchange the order of two cleanup operations, introducing the following differences: 1.if mxs_lradc_adc_trigger_init fails, returns directly; 2.if trigger_init succeeds but iio_triggered_buffer_setup fails, goto err_trig and remove the trigger. In addition, we also reorder the unwind that goes on in the remove() callback to match the new ordering. Fixes: 6dd112b9f85e ("iio: adc: mxs-lradc: Add support for ADC driver") Signed-off-by: Jiakai Luo Reviewed-by: Dongliang Mu Link: https://lore.kernel.org/r/20230422133407.72908-1-jkluo@hust.edu.cn Cc: Signed-off-by: Jonathan Cameron commit 28f73ded19d403697f87473c9b85a27eb8ed9cf2 Author: Lars-Peter Clausen Date: Fri Apr 14 08:07:02 2023 -0700 iio: ad4130: Make sure clock provider gets removed The ad4130 driver registers a clock provider, but never removes it. This leaves a stale clock provider behind that references freed clocks when the device is unbound. Register a managed action to remove the clock provider when the device is removed. Fixes: 62094060cf3a ("iio: adc: ad4130: add AD4130 driver") Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20230414150702.518441-1-lars@metafoo.de Cc: Signed-off-by: Jonathan Cameron commit 265c82ea8b172129cb6d4eff41af856c3aff6168 Author: Lars-Peter Clausen Date: Thu Apr 13 18:37:52 2023 -0700 iio: tmag5273: Fix runtime PM leak on measurement error The tmag5273 gets a runtime PM reference before reading a measurement and releases it when done. But if the measurement fails the tmag5273_read_raw() function exits before releasing the reference. Make sure that this error path also releases the runtime PM reference. Fixes: 866a1389174b ("iio: magnetometer: add ti tmag5273 driver") Signed-off-by: Lars-Peter Clausen Acked-by: Gerald Loacker Reviewed-by: Nuno Sa Link: https://lore.kernel.org/r/20230414013752.498767-1-lars@metafoo.de Cc: Signed-off-by: Jonathan Cameron commit 00ffdd6fa90298522d45ca0c348b23485584dcdc Author: ChiaEn Wu Date: Mon Apr 10 18:34:22 2023 +0800 iio: adc: mt6370: Fix ibus and ibat scaling value of some specific vendor ID chips The scale value of ibus and ibat on the datasheet is incorrect due to the customer report after the experimentation with some specific vendor ID chips. Fixes: c1404d1b659f ("iio: adc: mt6370: Add MediaTek MT6370 support") Signed-off-by: ChiaEn Wu Reviewed-by: Alexandre Mergnat Link: https://lore.kernel.org/r/1681122862-1994-1-git-send-email-chiaen_wu@richtek.com Cc: Signed-off-by: Jonathan Cameron commit 20f291b88ecf23f674ee2ed980a4d93b7f16a06f Author: Dan Carpenter Date: Tue Feb 14 18:47:30 2023 +0300 iio: adc: imx93: fix a signedness bug in imx93_adc_read_raw() The problem is these lines: ret = vref_uv = regulator_get_voltage(adc->vref); if (ret < 0) The "ret" variable is type long and "vref_uv" is u32 so that means the condition can never be true on a 64bit system. A negative error code from regulator_get_voltage() would be cast to a high positive u32 value and then remain a high positive value when cast to a long. The "ret" variable only ever stores ints so it should be declared as an int. We can delete the "vref_uv" variable and use "ret" directly. Fixes: 7d02296ac8b8 ("iio: adc: add imx93 adc support") Signed-off-by: Dan Carpenter Reviewed-by: Haibo Chen Link: https://lore.kernel.org/r/Y+utEvjfjQRQo2QB@kili Signed-off-by: Jonathan Cameron commit 5325593377f07de31f7e473a9677a28a04c891f3 Author: Tianling Shen Date: Thu May 11 00:18:50 2023 +0800 arm64: dts: rockchip: fix button reset pin for nanopi r5c The reset pin was wrongly assigned due to a copy/paste error, fix it to match actual gpio pin. While at it, remove a blank line from nanopi r5s dts. Fixes: 05620031408a ("arm64: dts: rockchip: Add FriendlyARM NanoPi R5C") Signed-off-by: Tianling Shen Link: https://lore.kernel.org/r/20230510161850.4866-1-cnsztl@gmail.com Signed-off-by: Heiko Stuebner commit b41caaded077aa8e7617c15e87d0503df8e7739e Merge: 843eb679d8311 6b45d5ff8c2c6 Author: David S. Miller Date: Sat May 13 17:12:24 2023 +0100 Merge branch 'hns3-fixes' Hao Lan says: ==================== net: hns3: fix some bug for hns3 There are some bugfixes for the HNS3 ethernet driver. patch#1 fix miss checking for rx packet. patch#2 fixes VF promisc mode not update when mac table full bug, and patch#3 fixes a nterrupts not initialization in VF FLR bug. ==================== Signed-off-by: David S. Miller commit 6b45d5ff8c2c61baddd67d7510075ae121c5e704 Author: Jijie Shao Date: Fri May 12 18:00:14 2023 +0800 net: hns3: fix reset timeout when enable full VF The timeout of the cmdq reset command has been increased to resolve the reset timeout issue in the full VF scenario. The timeout of other cmdq commands remains unchanged. Fixes: 8d307f8e8cf1 ("net: hns3: create new set of unified hclge_comm_cmd_send APIs") Signed-off-by: Jijie Shao Signed-off-by: Hao Lan Signed-off-by: David S. Miller commit 814d0c786068e858d889ada3153bff82f64223ad Author: Jie Wang Date: Fri May 12 18:00:13 2023 +0800 net: hns3: fix reset delay time to avoid configuration timeout Currently the hns3 vf function reset delays 5000ms before vf rebuild process. In product applications, this delay is too long for application configurations and causes configuration timeout. According to the tests, 500ms delay is enough for reset process except PF FLR. So this patch modifies delay to 500ms in these scenarios. Fixes: 6988eb2a9b77 ("net: hns3: Add support to reset the enet/ring mgmt layer") Signed-off-by: Jie Wang Signed-off-by: Hao Lan Signed-off-by: David S. Miller commit f14db07064727dd3bc0906c77a6d2759c1bbb395 Author: Jijie Shao Date: Fri May 12 18:00:12 2023 +0800 net: hns3: fix sending pfc frames after reset issue To prevent the system from abnormally sending PFC frames after an abnormal reset. The hns3 driver notifies the firmware to disable pfc before reset. Fixes: 35d93a30040c ("net: hns3: adjust the process of PF reset") Signed-off-by: Jijie Shao Signed-off-by: Hao Lan Signed-off-by: David S. Miller commit 89f6bfb071182f05d7188c255b0e7251c3806f16 Author: Jie Wang Date: Fri May 12 18:00:11 2023 +0800 net: hns3: fix output information incomplete for dumping tx queue info with debugfs In function hns3_dump_tx_queue_info, The print buffer is not enough when the tx BD number is configured to 32760. As a result several BD information wouldn't be displayed. So fix it by increasing the tx queue print buffer length. Fixes: 630a6738da82 ("net: hns3: adjust string spaces of some parameters of tx bd info in debugfs") Signed-off-by: Jie Wang Signed-off-by: Hao Lan Signed-off-by: David S. Miller commit 843eb679d831130c381aaf1ec3bfb9206921cc62 Merge: d80fc101d2eb9 ec52b69c046a6 Author: David S. Miller Date: Sat May 13 17:06:38 2023 +0100 Merge branch 'dsa-rzn1-a5psw-stp' Alexis Lothoré says: ==================== net: dsa: rzn1-a5psw: fix STP states handling This small series fixes STP support and while adding a new function to enable/disable learning, use that to disable learning on standalone ports at switch setup as reported by Vladimir Oltean. This series was initially submitted on net-next by Clement Leger, but some career evolutions has made him hand me over those topics. Also, this new revision is submitted on net instead of net-next for V1 based on Vladimir Oltean's suggestion Changes since v2: - fix commit split by moving A5PSW_MGMT_CFG_ENABLE in relevant commit - fix reverse christmas tree ordering in a5psw_port_stp_state_set Changes since v1: - fix typos in commit messages and doc - re-split STP states handling commit - add Fixes: tag and new Signed-off-by - submit series as fix on net instead of net-next - split learning and blocking setting functions - remove unused define A5PSW_PORT_ENA_TX_SHIFT - add boolean for tx/rx enabled for clarity ==================== Signed-off-by: David S. Miller commit ec52b69c046a6219011af780aca155a96719637b Author: Clément Léger Date: Fri May 12 09:27:12 2023 +0200 net: dsa: rzn1-a5psw: disable learning for standalone ports When ports are in standalone mode, they should have learning disabled to avoid adding new entries in the MAC lookup table which might be used by other bridge ports to forward packets. While adding that, also make sure learning is enabled for CPU port. Fixes: 888cdb892b61 ("net: dsa: rzn1-a5psw: add Renesas RZ/N1 advanced 5 port switch driver") Signed-off-by: Clément Léger Signed-off-by: Alexis Lothoré Reviewed-by: Piotr Raczynski Signed-off-by: David S. Miller commit ebe9bc50952757b4b25eaf514da7c464196c9606 Author: Alexis Lothoré Date: Fri May 12 09:27:11 2023 +0200 net: dsa: rzn1-a5psw: fix STP states handling stp_set_state() should actually allow receiving BPDU while in LEARNING mode which is not the case. Additionally, the BLOCKEN bit does not actually forbid sending forwarded frames from that port. To fix this, add a5psw_port_tx_enable() function which allows to disable TX. However, while its name suggest that TX is totally disabled, it is not and can still allow to send BPDUs even if disabled. This can be done by using forced forwarding with the switch tagging mechanism but keeping "filtering" disabled (which is already the case in the rzn1-a5sw tag driver). With these fixes, STP support is now functional. Fixes: 888cdb892b61 ("net: dsa: rzn1-a5psw: add Renesas RZ/N1 advanced 5 port switch driver") Signed-off-by: Clément Léger Signed-off-by: Alexis Lothoré Signed-off-by: David S. Miller commit 9e4b45f20c5aac786c728619e5ee746bffce1798 Author: Clément Léger Date: Fri May 12 09:27:10 2023 +0200 net: dsa: rzn1-a5psw: enable management frames for CPU port Currently, management frame were discarded before reaching the CPU port due to a misconfiguration of the MGMT_CONFIG register. Enable them by setting the correct value in this register in order to correctly receive management frame and handle STP. Fixes: 888cdb892b61 ("net: dsa: rzn1-a5psw: add Renesas RZ/N1 advanced 5 port switch driver") Signed-off-by: Clément Léger Signed-off-by: Alexis Lothoré Reviewed-by: Piotr Raczynski Signed-off-by: David S. Miller commit d80fc101d2eb9b3188c228d61223890aeea480a4 Author: Xin Long Date: Thu May 11 19:22:11 2023 -0400 erspan: get the proto with the md version for collect_md In commit 20704bd1633d ("erspan: build the header with the right proto according to erspan_ver"), it gets the proto with t->parms.erspan_ver, but t->parms.erspan_ver is not used by collect_md branch, and instead it should get the proto with md->version for collect_md. Thanks to Kevin for pointing this out. Fixes: 20704bd1633d ("erspan: build the header with the right proto according to erspan_ver") Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support") Reported-by: Kevin Traynor Signed-off-by: Xin Long Reviewed-by: Simon Horman Reviewed-by: William Tu Signed-off-by: David S. Miller commit d4d58949a6eac1c45ab022562c8494725e1ac094 Merge: 9a48d60467222 56cdea92ed915 Author: Linus Torvalds Date: Sat May 13 09:51:03 2023 -0500 Merge tag 'block-6.4-2023-05-13' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Just a few minor fixes for drivers, and a deletion of a file that is woefully out-of-date these days" * tag 'block-6.4-2023-05-13' of git://git.kernel.dk/linux: Documentation/block: drop the request.rst file ublk: fix command op code check block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE nbd: Fix debugfs_create_dir error checking commit 0fa53349c3acba0239369ba4cd133740a408d246 Author: Carlos Llamas Date: Tue May 2 20:12:19 2023 +0000 binder: add lockless binder_alloc_(set|get)_vma() Bring back the original lockless design in binder_alloc to determine whether the buffer setup has been completed by the ->mmap() handler. However, this time use smp_load_acquire() and smp_store_release() to wrap all the ordering in a single macro call. Also, add comments to make it evident that binder uses alloc->vma to determine when the binder_alloc has been fully initialized. In these scenarios acquiring the mmap_lock is not required. Fixes: a43cfc87caaf ("android: binder: stop saving a pointer to the VMA") Cc: Liam Howlett Cc: Suren Baghdasaryan Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20230502201220.1756319-3-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit c0fd2101781ef761b636769b2f445351f71c3626 Author: Carlos Llamas Date: Tue May 2 20:12:18 2023 +0000 Revert "android: binder: stop saving a pointer to the VMA" This reverts commit a43cfc87caaf46710c8027a8c23b8a55f1078f19. This patch fixed an issue reported by syzkaller in [1]. However, this turned out to be only a band-aid in binder. The root cause, as bisected by syzkaller, was fixed by commit 5789151e48ac ("mm/mmap: undo ->mmap() when mas_preallocate() fails"). We no longer need the patch for binder. Reverting such patch allows us to have a lockless access to alloc->vma in specific cases where the mmap_lock is not required. This approach avoids the contention that caused a performance regression. [1] https://lore.kernel.org/all/0000000000004a0dbe05e1d749e0@google.com [cmllamas: resolved conflicts with rework of alloc->mm and removal of binder_alloc_set_vma() also fixed comment section] Fixes: a43cfc87caaf ("android: binder: stop saving a pointer to the VMA") Cc: Liam Howlett Cc: Suren Baghdasaryan Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20230502201220.1756319-2-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit b15655b12ddca7ade09807f790bafb6fab61b50a Author: Carlos Llamas Date: Tue May 2 20:12:17 2023 +0000 Revert "binder_alloc: add missing mmap_lock calls when using the VMA" This reverts commit 44e602b4e52f70f04620bbbf4fe46ecb40170bde. This caused a performance regression particularly when pages are getting reclaimed. We don't need to acquire the mmap_lock to determine when the binder buffer has been fully initialized. A subsequent patch will bring back the lockless approach for this. [cmllamas: resolved trivial conflicts with renaming of alloc->mm] Fixes: 44e602b4e52f ("binder_alloc: add missing mmap_lock calls when using the VMA") Cc: Liam Howlett Cc: Suren Baghdasaryan Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20230502201220.1756319-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit bdc1c5fac982845a58d28690cdb56db8c88a530d Author: Carlos Llamas Date: Fri May 5 20:30:20 2023 +0000 binder: fix UAF caused by faulty buffer cleanup In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas Acked-by: Todd Kjos Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 000dcaa5c0a0fc5fb621a50a46cb74264ad115d6 Merge: ac9a78681b921 04ac7f98b9218 Author: Greg Kroah-Hartman Date: Sat May 13 20:16:46 2023 +0900 Merge tag 'coresight-fixes-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-linus Suzuki writes: coresight: Fixes for v6.4 Couple of fixes for coresight self-hosted tracing subsystem for v6.4. These include : - Fix signedness bug in tmc_etr_buf_insert_barrier_packet() - Fix memory leak with failing to release the path if trace-id allocation fails Signed-off-by: Suzuki K Poulose * tag 'coresight-fixes-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux: coresight: perf: Release Coresight path when alloc trace id failed coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() commit 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 Author: George Kennedy Date: Fri May 12 06:08:48 2023 -0500 vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of that, the struct vc_data pointer must be reloaded in the while loop in vcs_write() after console_lock() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119 Call Trace: __asan_report_load4_noabort (mm/kasan/report_generic.c:380) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_write (drivers/tty/vt/vc_screen.c:664) vfs_write (fs/read_write.c:582 fs/read_write.c:564) ... Allocated by task 1213: kmalloc_trace (mm/slab_common.c:1064) vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680 drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt.c:1058) con_install (drivers/tty/vt/vt.c:3334) tty_init_dev (drivers/tty/tty_io.c:1303 drivers/tty/tty_io.c:1415 drivers/tty/tty_io.c:1392) tty_open (drivers/tty/tty_io.c:2082 drivers/tty/tty_io.c:2128) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:921) vfs_open (fs/open.c:1052) ... Freed by task 4116: kfree (mm/slab_common.c:1016) vc_port_destruct (drivers/tty/vt/vt.c:1044) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2778) ... The buggy address belongs to the object at ffff8880beab8800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of freed 1024-byte region [ffff8880beab8800, ffff8880beab8c00) The buggy address belongs to the physical page: page:00000000afc77580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbeab8 head:00000000afc77580 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 000fffffc0010200 ffff888100042dc0 ffffea000426de00 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880beab8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880beab8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880beab8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Fixes: ac751efa6a0d ("console: rename acquire/release_console_sem() to console_lock/unlock()") Cc: stable Reported-by: syzkaller Signed-off-by: George Kennedy Reviewed-by: Thomas Weißschuh Link: https://lore.kernel.org/r/1683889728-10411-1-git-send-email-george.kennedy@oracle.com Signed-off-by: Greg Kroah-Hartman commit 5f949f140f73696f64acb89a1f16ff9153d017e0 Author: Krzysztof Kozlowski Date: Fri May 5 17:23:01 2023 +0200 serial: qcom-geni: fix enabling deactivated interrupt The driver have a race, experienced only with PREEMPT_RT patchset: CPU0 | CPU1 ================================================================== qcom_geni_serial_probe | uart_add_one_port | | serdev_drv_probe | qca_serdev_probe | serdev_device_open | uart_open | uart_startup | qcom_geni_serial_startup | enable_irq | __irq_startup | WARN_ON() | IRQ not activated request_threaded_irq | irq_domain_activate_irq | The warning: 894000.serial: ttyHS1 at MMIO 0x894000 (irq = 144, base_baud = 0) is a MSM serial serial0: tty port ttyHS1 registered WARNING: CPU: 7 PID: 107 at kernel/irq/chip.c:241 __irq_startup+0x78/0xd8 ... qcom_geni_serial 894000.serial: serial engine reports 0 RX bytes in! Adding UART port triggers probe of child serial devices - serdev and eventually Qualcomm Bluetooth hci_qca driver. This opens UART port which enables the interrupt before it got activated in request_threaded_irq(). The issue originates in commit f3974413cf02 ("tty: serial: qcom_geni_serial: Wakeup IRQ cleanup") and discussion on mailing list [1]. However the above commit does not explain why the uart_add_one_port() is moved above requesting interrupt. [1] https://lore.kernel.org/all/5d9f3dfa.1c69fb81.84c4b.30bf@mx.google.com/ Fixes: f3974413cf02 ("tty: serial: qcom_geni_serial: Wakeup IRQ cleanup") Cc: Cc: Stephen Boyd Signed-off-by: Krzysztof Kozlowski Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20230505152301.2181270-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit f264f2f6f4788dc031cef60a0cf2881902736709 Author: Doug Berger Date: Thu Apr 27 11:19:16 2023 -0700 serial: 8250_bcm7271: fix leak in `brcmuart_probe` Smatch reports: drivers/tty/serial/8250/8250_bcm7271.c:1120 brcmuart_probe() warn: 'baud_mux_clk' from clk_prepare_enable() not released on lines: 1032. The issue is fixed by using a managed clock. Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver") Reported-by: XuDong Liu Link: https://lore.kernel.org/lkml/20230424125100.4783-1-m202071377@hust.edu.cn/ Signed-off-by: Doug Berger Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20230427181916.2983697-3-opendmb@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8a3b5477256a54ae4a470dcebbcf8cdc18e4696d Author: Doug Berger Date: Thu Apr 27 11:19:15 2023 -0700 serial: 8250_bcm7271: balance clk_enable calls The sw_baud clock must be disabled when the device driver is not connected to the device. This now occurs when probe fails and upon remove. Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver") Reported-by: XuDong Liu Link: https://lore.kernel.org/lkml/20230424125100.4783-1-m202071377@hust.edu.cn/ Signed-off-by: Doug Berger Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20230427181916.2983697-2-opendmb@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8ab5fc55d7f65d58a3c3aeadf11bdf60267cd2bd Author: Ke Zhang Date: Fri Apr 28 11:16:36 2023 +0800 serial: arc_uart: fix of_iomap leak in `arc_serial_probe` Smatch reports: drivers/tty/serial/arc_uart.c:631 arc_serial_probe() warn: 'port->membase' from of_iomap() not released on lines: 631. In arc_serial_probe(), if uart_add_one_port() fails, port->membase is not released, which would cause a resource leak. To fix this, I replace of_iomap with devm_platform_ioremap_resource. Fixes: 8dbe1d5e09a7 ("serial/arc: inline the probe helper") Signed-off-by: Ke Zhang Reviewed-by: Dongliang Mu Link: https://lore.kernel.org/r/20230428031636.44642-1-m202171830@hust.edu.cn Signed-off-by: Greg Kroah-Hartman commit f16182ed9d8430adfab77f5929c23756c94b0230 Author: Geert Uytterhoeven Date: Fri Apr 21 11:58:06 2023 +0200 serial: 8250: Document termios parameter of serial8250_em485_config() With W=1: drivers/tty/serial/8250/8250_port.c:679: warning: Function parameter or member 'termios' not described in 'serial8250_em485_config' Fix this by documenting the parameter. Fixes: ae50bb2752836277 ("serial: take termios_rwsem for ->rs485_config() & pass termios as param") Signed-off-by: Geert Uytterhoeven Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/2bd1e62be1d5d33333002910372feecc6d52e78f.1682071013.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit d2b00516de0e1d696724247098f6733a6ea53908 Author: Vitaliy Tomin Date: Sun Apr 23 11:45:12 2023 +0800 serial: Add support for Advantech PCI-1611U card Add support for Advantech PCI-1611U card Advantech provides opensource drivers for this and many others card based on legacy copy of 8250_pci driver called adv950 https://www.advantech.com/emt/support/details/driver?id=1-TDOIMJ It is hard to maintain to run as out of tree module on newer kernels. Just adding PCI ID to kernel 8250_pci works perfect. Signed-off-by: Vitaliy Tomin Cc: stable Link: https://lore.kernel.org/r/20230423034512.2671157-1-tomin@iszf.irk.ru Signed-off-by: Greg Kroah-Hartman commit 95d698869b404772cc8b72560df71548491c10bc Author: Andrew Davis Date: Thu Apr 20 11:02:09 2023 -0500 serial: 8250_exar: Add support for USR298x PCI Modems Possibly the last PCI controller-based (i.e. not a soft/winmodem) dial-up modem one can still buy. Looks to have a stock XR17C154 PCI UART chip for communication, but for some reason when provisioning the PCI IDs they swapped the vendor and subvendor IDs. Otherwise this card would have worked out of the box. Searching online, some folks seem to not have this issue and others do, so it is possible only some batches of cards have this error. Create a new macro to handle the switched IDs and add support here. Signed-off-by: Andrew Davis Cc: stable Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230420160209.28221-1-afd@ti.com Signed-off-by: Greg Kroah-Hartman commit a398d5eac6984316e71474e25b975688f282379b Author: Maxime Bizon Date: Fri May 5 13:47:59 2023 +0200 usb-storage: fix deadlock when a scsi command timeouts more than once With faulty usb-storage devices, read/write can timeout, in that case the SCSI layer will abort and re-issue the command. USB storage has no internal timeout, it relies on SCSI layer aborting commands via .eh_abort_handler() for non those responsive devices. After two consecutive timeouts of the same command, SCSI layer calls .eh_device_reset_handler(), without calling .eh_abort_handler() first. With usb-storage, this causes a deadlock: -> .eh_device_reset_handler -> device_reset -> mutex_lock(&(us->dev_mutex)); mutex already by usb_stor_control_thread(), which is waiting for command completion: -> usb_stor_control_thread (mutex taken here) -> usb_stor_invoke_transport -> usb_stor_Bulk_transport -> usb_stor_bulk_srb -> usb_stor_bulk_transfer_sglist -> usb_sg_wait Make sure we cancel any pending command in .eh_device_reset_handler() to avoid this. Signed-off-by: Maxime Bizon Cc: linux-usb@vger.kernel.org Cc: stable Link: https://lore.kernel.org/all/ZEllnjMKT8ulZbJh@sakura/ Reviewed-by: Alan Stern Acked-by: Alan Stern Link: https://lore.kernel.org/r/20230505114759.1189741-1-mbizon@freebox.fr Signed-off-by: Greg Kroah-Hartman commit 8018018d9c56473067e5358986ce0ee9ce56949f Author: Dan Carpenter Date: Thu May 4 17:59:24 2023 +0300 usb: dwc3: fix a test for error in dwc3_core_init() This was refactored recently and the "ret = " was accidentally deleted so the errors aren't checked. Fixes: 1d72fab47656 ("USB: dwc3: refactor phy handling") Signed-off-by: Dan Carpenter Reviewed-by: Johan Hovold Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/d0c5a04f-deee-4ebe-9b0b-dc5492564519@kili.mountain Signed-off-by: Greg Kroah-Hartman commit 94ea04ec790887b5b0e43429a92c18a1e692ec08 Author: Roger Quadros Date: Fri Apr 21 13:17:20 2023 +0300 usb: typec: tps6598x: Fix fault at module removal We need to cancel the delayed workqueue if it is being used else it will cause paging request fault during module removal. Fixes: 0d6a119cecd7 ("usb: typec: tps6598x: Add support for polling interrupts status") Signed-off-by: Roger Quadros Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230421101720.34318-1-rogerq@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3c0f4f09c063e143822393d99cb2b19a85451c07 Author: Konrad Gräfe Date: Fri May 5 16:36:40 2023 +0200 usb: gadget: u_ether: Fix host MAC address case The CDC-ECM specification [1] requires to send the host MAC address as an uppercase hexadecimal string in chapter "5.4 Ethernet Networking Functional Descriptor": The Unicode character is chosen from the set of values 30h through 39h and 41h through 46h (0-9 and A-F). However, snprintf(.., "%pm", ..) generates a lowercase MAC address string. While most host drivers are tolerant to this, UsbNcm.sys on Windows 10 is not. Instead it uses a different MAC address with all bytes set to zero including and after the first byte containing a lowercase letter. On Windows 11 Microsoft fixed it, but apparently they did not backport the fix. This change fixes the issue by upper-casing the MAC to comply with the specification. [1]: https://www.usb.org/document-library/class-definitions-communication-devices-12, file ECM120.pdf Fixes: bcd4a1c40bee ("usb: gadget: u_ether: construct with default values and add setters/getters") Cc: stable@vger.kernel.org Signed-off-by: Konrad Gräfe Link: https://lore.kernel.org/r/20230505143640.443014-1-k.graefe@gateware.de Signed-off-by: Greg Kroah-Hartman commit d8f28269dd4bf9b55c3fb376ae31512730a96fce Author: Badhri Jagan Sridharan Date: Mon May 8 21:44:43 2023 +0000 usb: typec: altmodes/displayport: fix pin_assignment_show This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0 Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable@vger.kernel.org Signed-off-by: Badhri Jagan Sridharan Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230508214443.893436-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman commit f22e9b67f19ccc73de1ae04375d4b30684e261f8 Author: Francesco Dolcini Date: Fri May 12 15:14:35 2023 +0200 Revert "usb: gadget: udc: core: Invoke usb_gadget_connect only when started" This reverts commit 0db213ea8eed5534a5169e807f28103cbc9d23df. It introduces an issues with configuring the USB gadget hangs forever on multiple Qualcomm and NXP i.MX SoC at least. Cc: stable@vger.kernel.org Fixes: 0db213ea8eed ("usb: gadget: udc: core: Invoke usb_gadget_connect only when started") Reported-by: Stephan Gerhold Reported-by: Francesco Dolcini Link: https://lore.kernel.org/all/ZF4BvgsOyoKxdPFF@francesco-nb.int.toradex.com/ Signed-off-by: Francesco Dolcini Link: https://lore.kernel.org/r/20230512131435.205464-3-francesco@dolcini.it Signed-off-by: Greg Kroah-Hartman commit 5e1617210aede9f1b91bb9819c93097b6da481f9 Author: Francesco Dolcini Date: Fri May 12 15:14:34 2023 +0200 Revert "usb: gadget: udc: core: Prevent redundant calls to pullup" This reverts commit a3afbf5cc887fc3401f012fe629810998ed61859. This depends on commit 0db213ea8eed ("usb: gadget: udc: core: Invoke usb_gadget_connect only when started") that introduces a regression, revert it till the issue is fixed. Cc: stable@vger.kernel.org Reported-by: Stephan Gerhold Reported-by: Francesco Dolcini Link: https://lore.kernel.org/all/ZF4BvgsOyoKxdPFF@francesco-nb.int.toradex.com/ Signed-off-by: Francesco Dolcini Link: https://lore.kernel.org/r/20230512131435.205464-2-francesco@dolcini.it Signed-off-by: Greg Kroah-Hartman commit 8432a15cd810c99db464b7e7858d559f3e1920e3 Author: Jó Ágila Bitsch Date: Sat Apr 22 18:05:32 2023 +0200 usb: gadget: drop superfluous ':' in doc string There was one superfluous ':' that kernel-doc complained about. Reported-by: Randy Dunlap Closes: https://lore.kernel.org/all/c718a490-028d-2682-9ad7-8256d16504bf@infradead.org/ Fixes: fb6211f1584a ("usb: gadget: add doc to struct usb_composite_dev") Signed-off-by: Jó Ágila Bitsch Reviewed-by: Randy Dunlap Link: https://lore.kernel.org/r/ZEQFzMntIrwvZl4+@jo-einhundert Signed-off-by: Greg Kroah-Hartman commit 614ce6a2ea50068b45339257891e51e639ac9001 Author: Udipto Goswami Date: Tue May 9 20:18:36 2023 +0530 usb: dwc3: debugfs: Resume dwc3 before accessing registers When the dwc3 device is runtime suspended, various required clocks are in disabled state and it is not guaranteed that access to any registers would work. Depending on the SoC glue, a register read could be as benign as returning 0 or be fatal enough to hang the system. In order to prevent such scenarios of fatal errors, make sure to resume dwc3 then allow the function to proceed. Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") Cc: stable@vger.kernel.org #3.2: 30332eeefec8: debugfs: regset32: Add Runtime PM support Signed-off-by: Udipto Goswami Reviewed-by: Johan Hovold Tested-by: Johan Hovold Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20230509144836.6803-1-quic_ugoswami@quicinc.com Signed-off-by: Greg Kroah-Hartman commit dddb342b5b9e482bb213aecc08cbdb201ea4f8da Author: Weitao Wang Date: Sun Apr 23 18:59:52 2023 +0800 USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value OverCurrent condition is not standardized in the UHCI spec. Zhaoxin UHCI controllers report OverCurrent bit active off. In order to handle OverCurrent condition correctly, the uhci-hcd driver needs to be told to expect the active-off behavior. Suggested-by: Alan Stern Cc: stable@vger.kernel.org Signed-off-by: Weitao Wang Acked-by: Alan Stern Link: https://lore.kernel.org/r/20230423105952.4526-1-WeitaoWang-oc@zhaoxin.com Signed-off-by: Greg Kroah-Hartman commit 4e8ef34e36f2839ef8c8da521ab7035956436818 Author: Linyu Yuan Date: Fri May 12 08:45:24 2023 +0800 usb: dwc3: fix gadget mode suspend interrupt handler issue When work in gadget mode, currently driver doesn't update software level link_state correctly as link state change event is not enabled for most devices, in function dwc3_gadget_suspend_interrupt(), it will only pass suspend event to UDC core when software level link state changes, so when interrupt generated in sequences of suspend -> reset -> conndone -> suspend, link state is not updated during reset and conndone, so second suspend interrupt event will not pass to UDC core. Remove link_state compare in dwc3_gadget_suspend_interrupt() and add a suspended flag to replace the compare function. Fixes: 799e9dc82968 ("usb: dwc3: gadget: conditionally disable Link State change events") Cc: stable Acked-by: Thinh Nguyen Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/20230512004524.31950-1-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman commit c8540870af4ce6ddeb27a7bb5498b75fb29b643c Author: Roger Quadros Date: Wed May 3 14:00:48 2023 +0300 usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume() Prevent -ETIMEDOUT error on .suspend(). e.g. If gadget driver is loaded and we are connected to a USB host, all transfers must be stopped before stopping the controller else we will not get a clean stop i.e. dwc3_gadget_run_stop() will take several seconds to complete and will return -ETIMEDOUT. Handle error cases properly in dwc3_gadget_suspend(). Simplify dwc3_gadget_resume() by using the introduced helper function. Fixes: 9f8a67b65a49 ("usb: dwc3: gadget: fix gadget suspend/resume") Cc: stable@vger.kernel.org Suggested-by: Thinh Nguyen Signed-off-by: Roger Quadros Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20230503110048.30617-1-rogerq@kernel.org Signed-off-by: Greg Kroah-Hartman commit 94d25e9128988c6a1fc9070f6e98215a95795bd8 Author: Alan Stern Date: Mon May 1 14:22:35 2023 -0400 USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver does not check that the direction is set to OUT: ------------[ cut here ]------------ usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41 RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000 RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001 RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528 R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100 FS: 0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline] usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097 To fix this, we must override the direction in the bRequestType field of the control request structure when the length is 0. Reported-and-tested-by: syzbot+ce77725b89b7bd52425c@syzkaller.appspotmail.com Signed-off-by: Alan Stern Link: https://lore.kernel.org/linux-usb/000000000000716a3705f9adb8ee@google.com/ CC: Link: https://lore.kernel.org/r/ede1ee02-b718-49e7-a44c-51339fec706b@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 764d102ef94e880ca834a7fe3968a00a05b1fb12 Author: Dave Jiang Date: Sat May 13 00:20:06 2023 -0700 cxl: Add missing return to cdat read error path Add a return to the error path when cxl_cdat_read_table() fails. Current code continues with the table pointer points to freed memory. Fixes: 7a877c923995 ("cxl/pci: Simplify CDAT retrieval error path") Signed-off-by: Dave Jiang Reviewed-by: Davidlohr Bueso Link: https://lore.kernel.org/r/168382793506.3510737.4792518576623749076.stgit@djiang5-mobl3 Signed-off-by: Dan Williams commit 7efb10d8dc70ea3000cc70dca53407c52488acd1 Author: YongSu Yoo Date: Sun Mar 5 21:25:19 2023 +0000 media: dvb_demux: fix a bug for the continuity counter In dvb_demux.c, some logics exist which compare the expected continuity counter and the real continuity counter. If they are not matched each other, both of the expected continuity counter and the real continuity counter should be printed. But there exists a bug that the expected continuity counter is not correctly printed. The expected continuity counter is replaced with the real countinuity counter + 1 so that the epected continuity counter is not correclty printed. This is wrong. This bug is fixed. Link: https://lore.kernel.org/linux-media/20230305212519.499-1-yongsuyoo0215@gmail.com Signed-off-by: YongSu Yoo Signed-off-by: Mauro Carvalho Chehab commit 53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5 Author: Arnd Bergmann Date: Tue Jan 17 17:10:16 2023 +0000 media: pvrusb2: fix DVB_CORE dependency Now that DVB_CORE can be a loadable module, pvrusb2 can run into a link error: ld.lld: error: undefined symbol: dvb_module_probe >>> referenced by pvrusb2-devattr.c >>> drivers/media/usb/pvrusb2/pvrusb2-devattr.o:(pvr2_lgdt3306a_attach) in archive vmlinux.a ld.lld: error: undefined symbol: dvb_module_release >>> referenced by pvrusb2-devattr.c >>> drivers/media/usb/pvrusb2/pvrusb2-devattr.o:(pvr2_dual_fe_attach) in archive vmlinux.a Refine the Kconfig dependencies to avoid this case. Link: https://lore.kernel.org/linux-media/20230117171055.2714621-1-arnd@kernel.org Fixes: 7655c342dbc4 ("media: Kconfig: Make DVB_CORE=m possible when MEDIA_SUPPORT=y") Signed-off-by: Arnd Bergmann Signed-off-by: Mauro Carvalho Chehab commit 270205be711056534d1f86d275d4ec922fb62102 Author: Dan Williams Date: Fri May 12 14:31:35 2023 -0700 tools/testing/cxl: Use DEFINE_STATIC_SRCU() Starting with commit: 95433f726301 ("srcu: Begin offloading srcu_struct fields to srcu_update") ...it is no longer possible to do: static DEFINE_SRCU(x) Switch to DEFINE_STATIC_SRCU(x) to fix: tools/testing/cxl/test/mock.c:22:1: error: duplicate ‘static’ 22 | static DEFINE_SRCU(cxl_mock_srcu); | ^~~~~~ Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168392709546.1135523.10424917245934547117.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 9a48d604672220545d209e9996c2a1edbb5637f6 Author: Borislav Petkov (AMD) Date: Fri May 12 23:12:26 2023 +0200 x86/retbleed: Fix return thunk alignment SYM_FUNC_START_LOCAL_NOALIGN() adds an endbr leading to this layout (leaving only the last 2 bytes of the address): 3bff : 3bff: f3 0f 1e fa endbr64 3c03: f6 test $0xcc,%bl 3c04 <__x86_return_thunk>: 3c04: c3 ret 3c05: cc int3 3c06: 0f ae e8 lfence However, "the RET at __x86_return_thunk must be on a 64 byte boundary, for alignment within the BTB." Use SYM_START instead. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Thomas Gleixner Cc: Signed-off-by: Linus Torvalds commit 76c7f8873a7696dbd8f9cd844e30e5c84cbaba1a Merge: fd88f147cb121 1d6a4fc857176 Author: Linus Torvalds Date: Fri May 12 17:10:32 2023 -0500 Merge tag 'for-6.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull more btrfs fixes from David Sterba: - fix incorrect number of bitmap entries for space cache if loading is interrupted by some error - fix backref walking, this breaks a mode of LOGICAL_INO_V2 ioctl that is used in deduplication tools - zoned mode fixes: - properly finish zone reserved for relocation - correctly calculate super block zone end on ZNS - properly initialize new extent buffer for redirty - make mount option clear_cache work with block-group-tree, to rebuild free-space-tree instead of temporarily disabling it that would lead to a forced read-only mount - fix alignment check for offset when printing extent item * tag 'for-6.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: make clear_cache mount option to rebuild FST without disabling it btrfs: zero the buffer before marking it dirty in btrfs_redirty_list_add btrfs: zoned: fix full zone super block reading on ZNS btrfs: zoned: zone finish data relocation BG with last IO btrfs: fix backref walking not returning all inode refs btrfs: fix space cache inconsistency after error loading it from disk btrfs: print-tree: parent bytenr must be aligned to sector size commit fd88f147cb121c9c748ca0d4c5155a96e9d81e58 Merge: df8c2d13e227e d39fc592ef8ae Author: Linus Torvalds Date: Fri May 12 17:01:36 2023 -0500 Merge tag '6.4-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: - fix for copy_file_range bug for very large files that are multiples of rsize - do not ignore "isolated transport" flag if set on share - set rasize default better - three fixes related to shutdown and freezing (fixes 4 xfstests, and closes deferred handles faster in some places that were missed) * tag '6.4-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: release leases for deferred close handles when freezing smb3: fix problem remounting a share after shutdown SMB3: force unmount was failing to close deferred close files smb3: improve parallel reads of large files do not reuse connection if share marked as isolated cifs: fix pcchunk length type in smb2_copychunk_range commit df8c2d13e227e4670ebe777970f89db7802b1f56 Merge: 584dc5dbcbcca c04fe8e32f907 Author: Linus Torvalds Date: Fri May 12 16:56:09 2023 -0500 Merge tag 'vfs/v6.4-rc1/pipe' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs fix from Christian Brauner: "During the pipe nonblock rework the check for both O_NONBLOCK and IOCB_NOWAIT was dropped. Both checks need to be performed to ensure that files without O_NONBLOCK but IOCB_NOWAIT don't block when writing to or reading from a pipe. This just contains the fix adding the check for IOCB_NOWAIT back in" * tag 'vfs/v6.4-rc1/pipe' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: pipe: check for IOCB_NOWAIT alongside O_NONBLOCK commit 584dc5dbcbcca71cc7ccce9077a1456842c26179 Merge: ed6a75e3133bc 293007b033418 Author: Linus Torvalds Date: Fri May 12 16:39:05 2023 -0500 Merge tag 'io_uring-6.4-2023-05-12' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a single fix making io_uring_sqe_cmd() available regardless of CONFIG_IO_URING, fixing a regression introduced during the merge window if nvme was selected but io_uring was not" * tag 'io_uring-6.4-2023-05-12' of git://git.kernel.dk/linux: io_uring: make io_uring_sqe_cmd() unconditionally available commit ed6a75e3133bca544849b967f7f3233cddb66090 Merge: 47a2ee5d4a0bd 3b90b09af5be4 Author: Linus Torvalds Date: Fri May 12 16:31:55 2023 -0500 Merge tag 'riscv-for-linus-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fix from Palmer Dabbelt: "Just a single fix this week for a build issue. That'd usually be a good sign, but we've started to get some reports of boot failures on some hardware/bootloader configurations. Nothing concrete yet, but I've got a funny feeling that's where much of the bug hunting is going right now. Nothing's reproducing on my end, though, and this fixes some pretty concrete issues so I figured there's no reason to delay it: - a fix to the linker script to avoid orpahaned sections in kernel/pi" * tag 'riscv-for-linus-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix orphan section warnings caused by kernel/pi commit 78b6a9a3f445e121ca08195084206cb8faa6999f Author: Haoyue Xu Date: Sat May 6 15:06:04 2023 +0800 MAINTAINERS: Update maintainers of HiSilicon RoCE Wenpeng has moved to other technical areas, and Junxian will take over his responsibilities in maintaining this module. Link: https://lore.kernel.org/r/20230506070604.2982542-1-xuhaoyue1@hisilicon.com Signed-off-by: Haoyue Xu Signed-off-by: Jason Gunthorpe commit 08c7f09356e45d093d1867c7a3c6ac6526e2f98b Author: Selvin Xavier Date: Sun May 7 11:29:29 2023 -0700 RDMA/bnxt_re: Fix the page_size used during the MR creation Driver populates the list of pages used for Memory region wrongly when page size is more than system page size. This is causing a failure when some of the applications that creates MR with page size as 2M. Since HW can support multiple page sizes, pass the correct page size while creating the MR. Also, driver need not adjust the number of pages when HW Queues are created with user memory. It should work with the number of dma blocks returned by ib_umem_num_dma_blocks. Fix this calculation also. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Fixes: f6919d56388c ("RDMA/bnxt_re: Code refactor while populating user MRs") Link: https://lore.kernel.org/r/1683484169-9539-1-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Kalesh AP Signed-off-by: Kashyap Desai Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 56cdea92ed915f8eb37575331fb4a269991e8026 Author: Randy Dunlap Date: Sun May 7 11:26:06 2023 -0700 Documentation/block: drop the request.rst file Documentation/block/request.rst is outdated and should be removed. Also delete its entry in the block/index.rst file. Signed-off-by: Randy Dunlap Cc: Jens Axboe Cc: linux-block@vger.kernel.org Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/20230507182606.12647-1-rdunlap@infradead.org Signed-off-by: Jens Axboe commit 034f4a7877c32a8efd6beee4d71ed14e424499a9 Author: Max Filippov Date: Sat May 6 17:10:36 2023 -0700 xtensa: add __bswap{si,di}2 helpers gcc-13 may generate calls for __bswap{si,di}2. This breaks the kernel build when optimization for size is selected. Add __bswap{si,di}2 helpers to fix that. Cc: stable@vger.kernel.org Fixes: 19c5699f9aff ("xtensa: don't link with libgcc") Signed-off-by: Max Filippov commit 9c2cc74fb31ec76b8b118c97041a6a154a3ff219 Author: Max Filippov Date: Tue May 2 03:20:47 2023 -0700 xtensa: fix signal delivery to FDPIC process Fetch function descriptor pointed to by the signal handler pointer from userspace on signal delivery and function pointer pointed to by the sa_restorer on return from the signal handler. Cc: stable@vger.kernel.org Fixes: e3ddb8bbe0f8 ("xtensa: add FDPIC and static PIE support for noMMU") Signed-off-by: Max Filippov commit c04fe8e32f907ea668f3f802387c1148fdb0e6c9 Author: Jens Axboe Date: Tue May 9 09:12:24 2023 -0600 pipe: check for IOCB_NOWAIT alongside O_NONBLOCK Pipe reads or writes need to enable nonblocking attempts, if either O_NONBLOCK is set on the file, or IOCB_NOWAIT is set in the iocb being passed in. The latter isn't currently true, ensure we check for both before waiting on data or space. Fixes: afed6271f5b0 ("pipe: set FMODE_NOWAIT on pipes") Signed-off-by: Jens Axboe Message-Id: Signed-off-by: Christian Brauner commit e485bd9e2c419142430ae6fe3e8f64e3059aef50 Author: Ming Lei Date: Fri May 5 23:31:42 2023 +0800 ublk: fix command op code check In case of CONFIG_BLKDEV_UBLK_LEGACY_OPCODES, type of cmd opcode could be 0 or 'u'; and type can only be 'u' if CONFIG_BLKDEV_UBLK_LEGACY_OPCODES isn't set. So fix the wrong check. Fixes: 2d786e66c966 ("block: ublk: switch to ioctl command encoding") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230505153142.1258336-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 5e6e08087a4acb4ee3574cea32dbff0f63c7f608 Author: Guoqing Jiang Date: Fri May 12 11:46:31 2023 +0800 block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE Since flush bios are implemented as writes with no data and the preflush flag per Christoph's comment [1]. And we need to change it in rnbd accordingly. Otherwise, I got splatting when create fs from rnbd client. [ 464.028545] ------------[ cut here ]------------ [ 464.028553] WARNING: CPU: 0 PID: 65 at block/blk-core.c:751 submit_bio_noacct+0x32c/0x5d0 [ ... ] [ 464.028668] CPU: 0 PID: 65 Comm: kworker/0:1H Tainted: G OE 6.4.0-rc1 #9 [ 464.028671] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 464.028673] Workqueue: ib-comp-wq ib_cq_poll_work [ib_core] [ 464.028717] RIP: 0010:submit_bio_noacct+0x32c/0x5d0 [ 464.028720] Code: 03 0f 85 51 fe ff ff 48 8b 43 18 8b 88 04 03 00 00 85 c9 0f 85 3f fe ff ff e9 be fd ff ff 0f b6 d0 3c 0d 74 26 83 fa 01 74 21 <0f> 0b b8 0a 00 00 00 e9 56 fd ff ff 4c 89 e7 e8 70 a1 03 00 84 c0 [ 464.028722] RSP: 0018:ffffaf3680b57c68 EFLAGS: 00010202 [ 464.028724] RAX: 0000000000060802 RBX: ffffa09dcc18bf00 RCX: 0000000000000000 [ 464.028726] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffffa09dde081d00 [ 464.028727] RBP: ffffaf3680b57c98 R08: ffffa09dde081d00 R09: ffffa09e38327200 [ 464.028729] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa09dde081d00 [ 464.028730] R13: ffffa09dcb06e1e8 R14: 0000000000000000 R15: 0000000000200000 [ 464.028733] FS: 0000000000000000(0000) GS:ffffa09e3bc00000(0000) knlGS:0000000000000000 [ 464.028735] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 464.028736] CR2: 000055a4e8206c40 CR3: 0000000119f06000 CR4: 00000000003506f0 [ 464.028738] Call Trace: [ 464.028740] [ 464.028746] submit_bio+0x1b/0x80 [ 464.028748] rnbd_srv_rdma_ev+0x50d/0x10c0 [rnbd_server] [ 464.028754] ? percpu_ref_get_many.constprop.0+0x55/0x140 [rtrs_server] [ 464.028760] ? __this_cpu_preempt_check+0x13/0x20 [ 464.028769] process_io_req+0x1dc/0x450 [rtrs_server] [ 464.028775] rtrs_srv_inv_rkey_done+0x67/0xb0 [rtrs_server] [ 464.028780] __ib_process_cq+0xbc/0x1f0 [ib_core] [ 464.028793] ib_cq_poll_work+0x2b/0xa0 [ib_core] [ 464.028804] process_one_work+0x2a9/0x580 [1]. https://lore.kernel.org/all/ZFHgefWofVt24tRl@infradead.org/ Signed-off-by: Guoqing Jiang Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20230512034631.28686-1-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit 4913cfcf014c95f0437db2df1734472fd3e15098 Author: Ivan Orlov Date: Fri May 12 17:05:32 2023 +0400 nbd: Fix debugfs_create_dir error checking The debugfs_create_dir function returns ERR_PTR in case of error, and the only correct way to check if an error occurred is 'IS_ERR' inline function. This patch will replace the null-comparison with IS_ERR. Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230512130533.98709-1-ivan.orlov0322@gmail.com Signed-off-by: Jens Axboe commit 47a2ee5d4a0bda05decdda7be0a77e792cdb09a3 Merge: cc3c44c9fda26 f7dcc5e33c1e4 Author: Linus Torvalds Date: Fri May 12 07:59:08 2023 -0500 Merge tag 'firewire-fixes-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: - fix early release of request packet * tag 'firewire-fixes-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: net: fix unexpected release of object for asynchronous request packet commit 0bdf1ad8d10bd4e50a8b1a2c53d15984165f7fea Author: Helge Deller Date: Fri May 12 11:50:33 2023 +0200 fbdev: stifb: Fix info entry in sti_struct on error path Minor fix to reset the info field to NULL in case of error. Signed-off-by: Helge Deller commit 1e306ec49a1f206fd2cc89a42fac6e6f592a8cc1 Author: Eric Dumazet Date: Thu May 11 11:47:49 2023 +0000 tcp: fix possible sk_priority leak in tcp_v4_send_reset() When tcp_v4_send_reset() is called with @sk == NULL, we do not change ctl_sk->sk_priority, which could have been set from a prior invocation. Change tcp_v4_send_reset() to set sk_priority and sk_mark fields before calling ip_send_unicast_reply(). This means tcp_v4_send_reset() and tcp_v4_send_ack() no longer have to clear ctl_sk->sk_mark after their call to ip_send_unicast_reply(). Fixes: f6c0f5d209fa ("tcp: honor SO_PRIORITY in TIME_WAIT state") Signed-off-by: Eric Dumazet Cc: Antoine Tenart Signed-off-by: David S. Miller commit 9dc68a4fe70893b000fb3c92c68b9f72369cf448 Author: Kai-Heng Feng Date: Fri May 12 16:34:16 2023 +0800 ALSA: hda/realtek: Fix mute and micmute LEDs for yet another HP laptop There's yet another laptop that needs the fixup to enable mute and micmute LEDs. So do it accordingly. Signed-off-by: Kai-Heng Feng Cc: Link: https://lore.kernel.org/r/20230512083417.157127-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai commit 6d4486efe9c69626cab423456169e250a5cd3af5 Author: Zhuang Shengen Date: Thu May 11 19:34:30 2023 +0800 vsock: avoid to close connected socket after the timeout When client and server establish a connection through vsock, the client send a request to the server to initiate the connection, then start a timer to wait for the server's response. When the server's RESPONSE message arrives, the timer also times out and exits. The server's RESPONSE message is processed first, and the connection is established. However, the client's timer also times out, the original processing logic of the client is to directly set the state of this vsock to CLOSE and return ETIMEDOUT. It will not notify the server when the port is released, causing the server port remain. when client's vsock_connect timeout，it should check sk state is ESTABLISHED or not. if sk state is ESTABLISHED, it means the connection is established, the client should not set the sk state to CLOSE Note: I encountered this issue on kernel-4.18, which can be fixed by this patch. Then I checked the latest code in the community and found similar issue. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Signed-off-by: Zhuang Shengen Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller commit 134120b066044399ef59564ff3ba66ab344cfc5b Author: Pieter Jansen van Vuuren Date: Thu May 11 10:43:33 2023 +0100 sfc: disable RXFCS and RXALL features by default By default we would not want RXFCS and RXALL features enabled as they are mainly intended for debugging purposes. This does not stop users from enabling them later on as needed. Fixes: 8e57daf70671 ("sfc_ef100: RX path for EF100") Signed-off-by: Pieter Jansen van Vuuren Co-developed-by: Edward Cree Signed-off-by: Edward Cree Reviewed-by: Martin Habets Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit c8902258b2b8ecaa1b8d88c312853c5b14c2553d Author: Helge Deller Date: Sat Apr 22 23:24:26 2023 +0200 fbdev: modedb: Add 1920x1080 at 60 Hz video mode Add typical resolution for Full-HD monitors. Signed-off-by: Helge Deller commit 9113302bb43cf7a6d5a414d49b29478e57451c86 Author: Jan Sokolowski Date: Thu May 11 08:53:19 2023 -0700 ice: Fix undersized tx_flags variable As not all ICE_TX_FLAGS_* fit in current 16-bit limited tx_flags field that was introduced in the Fixes commit, VLAN-related information would be discarded completely. As such, creating a vlan and trying to run ping through would result in no traffic passing. Fix that by refactoring tx_flags variable into flags only and a separate variable that holds VLAN ID. As there is some space left, type variable can fit between those two. Pahole reports no size change to ice_tx_buf struct. Fixes: aa1d3faf71a6 ("ice: Robustify cleaning/completing XDP Tx buffers") Signed-off-by: Jan Sokolowski Reviewed-by: Alexander Lobakin Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit 92553ee03166ef8fa978e7683f9f4af30c9c4e6b Author: Ryan C. Underwood Date: Thu May 11 12:32:21 2023 -0500 ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 The Pavilion 15 line has B&O top speakers similar to the x360 and applying the same profile produces good sound. Without this, the sound would be tinny and underpowered without either applying model=alc295-hp-x360 or booting another OS first. Signed-off-by: Ryan Underwood Fixes: 563785edfcef ("ALSA: hda/realtek - Add quirk entry for HP Pavilion 15") Link: https://lore.kernel.org/r/ZF0mpcMz3ezP9KQw@icequake.net Signed-off-by: Takashi Iwai commit bcafcb959a57a6890e900199690c5fc47da1a304 Author: Ping-Ke Shih Date: Mon May 8 16:54:29 2023 +0800 wifi: rtw88: use work to update rate to avoid RCU warning The ieee80211_ops::sta_rc_update must be atomic, because ieee80211_chan_bw_change() holds rcu_read lock while calling drv_sta_rc_update(), so create a work to do original things. Voluntary context switch within RCU read-side critical section! WARNING: CPU: 0 PID: 4621 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x571/0x5d0 CPU: 0 PID: 4621 Comm: kworker/u16:2 Tainted: G W OE Workqueue: phy3 ieee80211_chswitch_work [mac80211] RIP: 0010:rcu_note_context_switch+0x571/0x5d0 Call Trace: __schedule+0xb0/0x1460 ? __mod_timer+0x116/0x360 schedule+0x5a/0xc0 schedule_timeout+0x87/0x150 ? trace_raw_output_tick_stop+0x60/0x60 wait_for_completion_timeout+0x7b/0x140 usb_start_wait_urb+0x82/0x160 [usbcore usb_control_msg+0xe3/0x140 [usbcore rtw_usb_read+0x88/0xe0 [rtw_usb rtw_usb_read8+0xf/0x10 [rtw_usb rtw_fw_send_h2c_command+0xa0/0x170 [rtw_core rtw_fw_send_ra_info+0xc9/0xf0 [rtw_core drv_sta_rc_update+0x7c/0x160 [mac80211 ieee80211_chan_bw_change+0xfb/0x110 [mac80211 ieee80211_change_chanctx+0x38/0x130 [mac80211 ieee80211_vif_use_reserved_switch+0x34e/0x900 [mac80211 ieee80211_link_use_reserved_context+0x88/0xe0 [mac80211 ieee80211_chswitch_work+0x95/0x170 [mac80211 process_one_work+0x201/0x410 worker_thread+0x4a/0x3b0 ? process_one_work+0x410/0x410 kthread+0xe1/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Cc: stable@vger.kernel.org Fixes: c1edc86472fc ("rtw88: add ieee80211:sta_rc_update ops") Reported-by: Larry Finger Link: https://lore.kernel.org/linux-wireless/f1e31e8e-f84e-3791-50fb-663a83c5c6e9@lwfinger.net/T/#t Signed-off-by: Ping-Ke Shih Tested-by: Larry Finger Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230508085429.46653-1-pkshih@realtek.com commit c0426c446d92023d344131d01d929bc25db7a24e Author: Ping-Ke Shih Date: Wed Apr 26 11:47:37 2023 +0800 wifi: rtw89: 8852b: adjust quota to avoid SER L1 caused by access null page Though SER can recover this case, traffic can get stuck for a while. Fix it by adjusting page quota to avoid hardware access null page of CMAC/DMAC. Fixes: a1cb097168fa ("wifi: rtw89: 8852b: configure DLE mem") Fixes: 3e870b481733 ("wifi: rtw89: 8852b: add HFC quota arrays") Cc: stable@vger.kernel.org Tested-by: Larry Finger Link: https://github.com/lwfinger/rtw89/issues/226#issuecomment-1520776761 Link: https://github.com/lwfinger/rtw89/issues/240 Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230426034737.24870-1-pkshih@realtek.com commit c7ab7a29ef5c0779574120d922256ce4651555d3 Author: Ryder Lee Date: Mon Apr 24 05:39:06 2023 +0800 wifi: mt76: connac: fix stats->tx_bytes calculation The stats->tx_bytes shall subtract retry byte from tx byte. Fixes: 43eaa3689507 ("wifi: mt76: add PPDU based TxS support for WED device") Signed-off-by: Ryder Lee Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/b3cd45596943cf5a06b2e08e2fe732ab0b51311b.1682285873.git.ryder.lee@mediatek.com commit cdc26ee89bddb9b6b2ae026a46d97855d5ba6694 Author: Ryder Lee Date: Mon Apr 24 05:39:05 2023 +0800 wifi: mt76: mt7996: fix endianness of MT_TXD6_TX_RATE To avoid sparse warning: sparse: warning: invalid assignment: |= sparse: left side has type restricted __le32 sparse: right side has type unsigned lon Fixes: 15ee62e73705 ("wifi: mt76: mt7996: enable BSS_CHANGED_BASIC_RATES support") Signed-off-by: Ryder Lee Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/16fa938373e3b145cb07a2c98d2428fea2abadba.1682285873.git.ryder.lee@mediatek.com commit 359b4315471181f108723c61612d96e383e56179 Author: Takashi Iwai Date: Fri May 12 09:58:58 2023 +0200 ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go Line6 Pod Go (0e41:424b) requires the similar workaround for the fixed 48k sample rate like other Line6 models. This patch adds the corresponding entry to line6_parse_audio_format_rate_quirk(). Reported-by: John Humlick Cc: Link: https://lore.kernel.org/r/20230512075858.22813-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit c0e72058d5e21982e61a29de6b098f7c1f0db498 Author: Dan Carpenter Date: Tue May 9 12:07:11 2023 +0300 ALSA: firewire-digi00x: prevent potential use after free This code was supposed to return an error code if init_stream() failed, but it instead freed dg00x->rx_stream and returned success. This potentially leads to a use after free. Fixes: 9a08067ec318 ("ALSA: firewire-digi00x: support AMDTP domain") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/c224cbd5-d9e2-4cd4-9bcf-2138eb1d35c6@kili.mountain Signed-off-by: Takashi Iwai commit 47af4291711f21e1282dbc1002baebba30595aa2 Author: Jakub Kicinski Date: Thu May 11 09:03:10 2023 -0700 MAINTAINERS: exclude wireless drivers from netdev It seems that we mostly get netdev CCed on wireless patches which are written by people who don't know any better and CC everything that get_maintainers spits out. Rather than patches which indeed could benefit from general networking review. Marking them down in patchwork as Awaiting Upstream is a bit tedious. Signed-off-by: Jakub Kicinski Acked-by: Johannes Berg Acked-by: Kalle Valo Signed-off-by: David S. Miller commit de9c1a23add9e7842ce63ce6f498a05c66344311 Author: Huayu Chen Date: Thu May 11 08:50:56 2023 +0200 nfp: fix NFP_NET_MAX_DSCP definition error The patch corrects the NFP_NET_MAX_DSCP definition in the main.h file. The incorrect definition result DSCP bits not being mapped properly when DCB is set. When NFP_NET_MAX_DSCP was defined as 4, the next 60 DSCP bits failed to be set. Fixes: 9b7fe8046d74 ("nfp: add DCB IEEE support") Cc: stable@vger.kernel.org Signed-off-by: Huayu Chen Acked-by: Simon Horman Signed-off-by: Louis Peens Signed-off-by: David S. Miller commit 01e8f6cd108b8702d206c6352d919c045b842b82 Author: Jakub Kicinski Date: Wed May 10 18:43:39 2023 -0700 MAINTAINERS: don't CC docs@ for netlink spec changes Documentation/netlink/ contains machine-readable protocol specs in YAML. Those are much like device tree bindings, no point CCing docs@ for the changes. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman commit d03a2f17627e8f94ce8c4790fede3ef7efe9be53 Author: Marcelo Ricardo Leitner Date: Wed May 10 19:42:43 2023 -0300 MAINTAINERS: sctp: move Neil to CREDITS Neil moved away from SCTP related duties. Move him to CREDITS then and while at it, update SCTP project website. Signed-off-by: Marcelo Ricardo Leitner Acked-by: Xin Long Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 50282fd57bcd3525c9d81eef58df8718e4337c6d Merge: ad81e23426a65 ac9a78681b921 Author: Maxime Ripard Date: Fri May 12 09:47:12 2023 +0200 Merge drm/drm-fixes into drm-misc-fixes Let's bring 6.4-rc1 in drm-misc-fixes to start the new fix cycle. Signed-off-by: Maxime Ripard commit 0b01db274028f5acd207332686ffc92ac77491ac Author: Grygorii Strashko Date: Wed May 10 18:21:39 2023 +0530 net: phy: dp83867: add w/a for packet errors seen with short cables Introduce the W/A for packet errors seen with short cables (<1m) between two DP83867 PHYs. The W/A recommended by DM requires FFE Equalizer Configuration tuning by writing value 0x0E81 to DSP_FFE_CFG register (0x012C), surrounded by hard and soft resets as follows: write_reg(0x001F, 0x8000); //hard reset write_reg(DSP_FFE_CFG, 0x0E81); write_reg(0x001F, 0x4000); //soft reset Since DP83867 PHY DM says "Changing this register to 0x0E81, will not affect Long Cable performance.", enable the W/A by default. Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy") Signed-off-by: Grygorii Strashko Signed-off-by: Siddharth Vadapalli Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2b694fc96fe33a7c042e3a142d27d945c8c668b0 Author: Nathan Chancellor Date: Thu Apr 27 12:34:53 2023 -0700 powerpc/boot: Disable power10 features after BOOTAFLAGS assignment When building the boot wrapper assembly files with clang after commit 648a1783fe25 ("powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU"), the following warnings appear for each file built: '-prefixed' is not a recognized feature for this target (ignoring feature) '-pcrel' is not a recognized feature for this target (ignoring feature) While it is questionable whether or not LLVM should be emitting a warning when passed negative versions of code generation flags when building assembly files (since it does not emit a warning for the altivec and vsx flags), it is easy enough to work around this by just moving the disabled flags to BOOTCFLAGS after the assignment of BOOTAFLAGS, so that they are not added when building assembly files. Do so to silence the warnings. Fixes: 648a1783fe25 ("powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU") Link: https://github.com/ClangBuiltLinux/linux/issues/1839 Reviewed-by: Nicholas Piggin Signed-off-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://msgid.link/20230427-remove-power10-args-from-boot-aflags-clang-v1-1-9107f7c943bc@kernel.org commit f63550e2b165208a2f382afcaf5551df9569e1d4 Author: Paweł Anikiel Date: Mon May 8 13:30:37 2023 +0200 ASoC: ssm2602: Add workaround for playback distortions Apply a workaround for what appears to be a hardware quirk. The problem seems to happen when enabling "whole chip power" (bit D7 register R6) for the very first time after the chip receives power. If either "output" (D4) or "DAC" (D3) aren't powered on at that time, playback becomes very distorted later on. This happens on the Google Chameleon v3, as well as on a ZYBO Z7-10: https://ez.analog.com/audio/f/q-a/543726/solved-ssm2603-right-output-offset-issue/480229 I suspect this happens only when using an external MCLK signal (which is the case for both of these boards). Here are some experiments run on a Google Chameleon v3. These were run in userspace using a wrapper around the i2cset utility: ssmset() { i2cset -y 0 0x1a $(($1*2)) $2 } For each of the following sequences, we apply power to the ssm2603 chip, set the configuration registers R0-R5 and R7-R8, run the selected sequence, and check for distortions on playback. ssmset 0x09 0x01 # core ssmset 0x06 0x07 # chip, out, dac OK ssmset 0x09 0x01 # core ssmset 0x06 0x87 # out, dac ssmset 0x06 0x07 # chip OK (disable MCLK) ssmset 0x09 0x01 # core ssmset 0x06 0x1f # chip ssmset 0x06 0x07 # out, dac (enable MCLK) OK ssmset 0x09 0x01 # core ssmset 0x06 0x1f # chip ssmset 0x06 0x07 # out, dac NOT OK ssmset 0x06 0x1f # chip ssmset 0x09 0x01 # core ssmset 0x06 0x07 # out, dac NOT OK ssmset 0x09 0x01 # core ssmset 0x06 0x0f # chip, out ssmset 0x06 0x07 # dac NOT OK ssmset 0x09 0x01 # core ssmset 0x06 0x17 # chip, dac ssmset 0x06 0x07 # out NOT OK For each of the following sequences, we apply power to the ssm2603 chip, run the selected sequence, issue a reset with R15, configure R0-R5 and R7-R8, run one of the NOT OK sequences from above, and check for distortions. ssmset 0x09 0x01 # core ssmset 0x06 0x07 # chip, out, dac OK (disable MCLK) ssmset 0x09 0x01 # core ssmset 0x06 0x07 # chip, out, dac (enable MCLK after reset) NOT OK ssmset 0x09 0x01 # core ssmset 0x06 0x17 # chip, dac NOT OK ssmset 0x09 0x01 # core ssmset 0x06 0x0f # chip, out NOT OK ssmset 0x06 0x07 # chip, out, dac NOT OK Signed-off-by: Paweł Anikiel Date: Wed May 10 22:00:20 2023 +0200 net: fec: Better handle pm_runtime_get() failing in .remove() In the (unlikely) event that pm_runtime_get() (disguised as pm_runtime_resume_and_get()) fails, the remove callback returned an error early. The problem with this is that the driver core ignores the error value and continues removing the device. This results in a resource leak. Worse the devm allocated resources are freed and so if a callback of the driver is called later the register mapping is already gone which probably results in a crash. Fixes: a31eda65ba21 ("net: fec: fix clock count mis-match") Signed-off-by: Uwe Kleine-König Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230510200020.1534610-1-u.kleine-koenig@pengutronix.de Signed-off-by: Jakub Kicinski commit ef1148d4487438a3408d6face2a8360d91b4af70 Author: Eric Dumazet Date: Wed May 10 15:46:46 2023 +0000 ipv6: remove nexthop_fib6_nh_bh() After blamed commit, nexthop_fib6_nh_bh() and nexthop_fib6_nh() are the same. Delete nexthop_fib6_nh_bh(), and convert /proc/net/ipv6_route to standard rcu to avoid this splat: [ 5723.180080] WARNING: suspicious RCU usage [ 5723.180083] ----------------------------- [ 5723.180084] include/net/nexthop.h:516 suspicious rcu_dereference_check() usage! [ 5723.180086] other info that might help us debug this: [ 5723.180087] rcu_scheduler_active = 2, debug_locks = 1 [ 5723.180089] 2 locks held by cat/55856: [ 5723.180091] #0: ffff9440a582afa8 (&p->lock){+.+.}-{3:3}, at: seq_read_iter (fs/seq_file.c:188) [ 5723.180100] #1: ffffffffaac07040 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire (include/linux/rcupdate.h:326) [ 5723.180109] stack backtrace: [ 5723.180111] CPU: 14 PID: 55856 Comm: cat Tainted: G S I 6.3.0-dbx-DEV #528 [ 5723.180115] Call Trace: [ 5723.180117] [ 5723.180119] dump_stack_lvl (lib/dump_stack.c:107) [ 5723.180124] dump_stack (lib/dump_stack.c:114) [ 5723.180126] lockdep_rcu_suspicious (include/linux/context_tracking.h:122) [ 5723.180132] ipv6_route_seq_show (include/net/nexthop.h:?) [ 5723.180135] ? ipv6_route_seq_next (net/ipv6/ip6_fib.c:2605) [ 5723.180140] seq_read_iter (fs/seq_file.c:272) [ 5723.180145] seq_read (fs/seq_file.c:163) [ 5723.180151] proc_reg_read (fs/proc/inode.c:316 fs/proc/inode.c:328) [ 5723.180155] vfs_read (fs/read_write.c:468) [ 5723.180160] ? up_read (kernel/locking/rwsem.c:1617) [ 5723.180164] ksys_read (fs/read_write.c:613) [ 5723.180168] __x64_sys_read (fs/read_write.c:621) [ 5723.180170] do_syscall_64 (arch/x86/entry/common.c:?) [ 5723.180174] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) [ 5723.180177] RIP: 0033:0x7fa455677d2a Fixes: 09eed1192cec ("neighbour: switch to standard rcu, instead of rcu_bh") Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230510154646.370659-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e93c9378e33f68b61ea9318580d841caa22fb9ea Author: Jiri Pirko Date: Wed May 10 16:46:21 2023 +0200 devlink: change per-devlink netdev notifier to static one The commit 565b4824c39f ("devlink: change port event netdev notifier from per-net to global") changed original per-net notifier to be per-devlink instance. That fixed the issue of non-receiving events of netdev uninit if that moved to a different namespace. That worked fine in -net tree. However, later on when commit ee75f1fc44dd ("net/mlx5e: Create separate devlink instance for ethernet auxiliary device") and commit 72ed5d5624af ("net/mlx5: Suspend auxiliary devices only in case of PCI device suspend") were merged, a deadlock was introduced when removing a namespace with devlink instance with another nested instance. Here there is the bad flow example resulting in deadlock with mlx5: net_cleanup_work -> cleanup_net (takes down_read(&pernet_ops_rwsem) -> devlink_pernet_pre_exit() -> devlink_reload() -> mlx5_devlink_reload_down() -> mlx5_unload_one_devl_locked() -> mlx5_detach_device() -> del_adev() -> mlx5e_remove() -> mlx5e_destroy_devlink() -> devlink_free() -> unregister_netdevice_notifier() (takes down_write(&pernet_ops_rwsem) Steps to reproduce: $ modprobe mlx5_core $ ip netns add ns1 $ devlink dev reload pci/0000:08:00.0 netns ns1 $ ip netns del ns1 Resolve this by converting the notifier from per-devlink instance to a static one registered during init phase and leaving it registered forever. Use this notifier for all devlink port instances created later on. Note what a tree needs this fix only in case all of the cited fixes commits are present. Reported-by: Moshe Shemesh Fixes: 565b4824c39f ("devlink: change port event netdev notifier from per-net to global") Fixes: ee75f1fc44dd ("net/mlx5e: Create separate devlink instance for ethernet auxiliary device") Fixes: 72ed5d5624af ("net/mlx5: Suspend auxiliary devices only in case of PCI device suspend") Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230510144621.932017-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 7ce93d6f91d8871a609f55bce91a507c392805e6 Merge: 6e27831b91a0b f97b8401e0deb Author: Jakub Kicinski Date: Thu May 11 18:01:40 2023 -0700 Merge branch 'selftests-seg6-make-srv6_end_dt4_l3vpn_test-more-robust' Andrea Mayer says: ==================== selftests: seg6: make srv6_end_dt4_l3vpn_test more robust This pachset aims to improve and make more robust the selftests performed to check whether SRv6 End.DT4 beahvior works as expected under different system configurations. Some Linux distributions enable Deduplication Address Detection and Reverse Path Filtering mechanisms by default which can interfere with SRv6 End.DT4 behavior and cause selftests to fail. The following patches improve selftests for End.DT4 by taking these two mechanisms into account. Specifically: - patch 1/2: selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test - patch 2/2: selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test ==================== Link: https://lore.kernel.org/r/20230510111638.12408-1-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit f97b8401e0deb46ad1e4245c21f651f64f55aaa6 Author: Andrea Mayer Date: Wed May 10 13:16:38 2023 +0200 selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test On some distributions, the rp_filter is automatically set (=1) by default on a netdev basis (also on VRFs). In an SRv6 End.DT4 behavior, decapsulated IPv4 packets are routed using the table associated with the VRF bound to that tunnel. During lookup operations, the rp_filter can lead to packet loss when activated on the VRF. Therefore, we chose to make this selftest more robust by explicitly disabling the rp_filter during tests (as it is automatically set by some Linux distributions). Fixes: 2195444e09b4 ("selftests: add selftest for the SRv6 End.DT4 behavior") Reported-by: Hangbin Liu Signed-off-by: Andrea Mayer Tested-by: Hangbin Liu Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 21a933c79a33add3612808f3be4ad65dd4dc026b Author: Andrea Mayer Date: Wed May 10 13:16:37 2023 +0200 selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test The srv6_end_dt4_l3vpn_test instantiates a virtual network consisting of several routers (rt-1, rt-2) and hosts. When the IPv6 addresses of rt-{1,2} routers are configured, the Deduplicate Address Detection (DAD) kicks in when enabled in the Linux distros running the selftests. DAD is used to check whether an IPv6 address is already assigned in a network. Such a mechanism consists of sending an ICMPv6 Echo Request and waiting for a reply. As the DAD process could take too long to complete, it may cause the failing of some tests carried out by the srv6_end_dt4_l3vpn_test script. To make the srv6_end_dt4_l3vpn_test more robust, we disable DAD on routers since we configure the virtual network manually and do not need any address deduplication mechanism at all. Fixes: 2195444e09b4 ("selftests: add selftest for the SRv6 End.DT4 behavior") Signed-off-by: Andrea Mayer Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 3b8803494a0612acdeee714cb72aa142b1e05ce5 Author: Mika Westerberg Date: Thu May 11 15:19:05 2023 +0300 PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports Commit 5459c0b70467 ("PCI/DPC: Quirk PIO log size for certain Intel Root Ports") added quirks for Tiger and Alder Lake Root Ports but missed that the same issue exists also in the previous generation, Ice Lake. Apply the quirk for Ice Lake Root Ports as well. This prevents kernel complaints like: DPC: RP PIO log size 0 is invalid and also enables the DPC driver to dump the RP PIO Log registers when DPC is triggered. [bhelgaas: add dmesg warning and RP PIO Log dump info] Closes: https://bugzilla.kernel.org/show_bug.cgi?id=209943 Link: https://lore.kernel.org/r/20230511121905.73949-1-mika.westerberg@linux.intel.com Reported-by: Mark Blakeney Signed-off-by: Mika Westerberg Signed-off-by: Bjorn Helgaas commit cc3c44c9fda264c6d401be04e95449a57c1231c6 Merge: 849a4f09730ba d8843eebbbd15 Author: Linus Torvalds Date: Thu May 11 16:56:58 2023 -0500 Merge tag 'drm-fixes-2023-05-12' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "About the usual for this stage, bunch of amdgpu, a few i915 and a scattering of fixes across the board" dsc: - macro fixes simplefb: - fix VESA format scheduler: - timeout handling fix fbdev: - avoid potential out-of-bounds access in generic fbdev emulation ast: - improve AST2500+ compat on ARM mipi-dsi: - small mipi-dsi fix amdgpu: - VCN3 fixes - APUs always support PCI atomics - legacy power management fixes - DCN 3.1.4 fix - DCFCLK fix - fix several RAS irq refcount mismatches - GPU Reset fix - GFX 11.0.4 fix i915: - taint kernel when force_probe is used - NULL deref and div-by-zero fixes for display - GuC error capture fix for Xe devices" * tag 'drm-fixes-2023-05-12' of git://anongit.freedesktop.org/drm/drm: (24 commits) drm/amdgpu: change gfx 11.0.4 external_id range drm/amdgpu/jpeg: Remove harvest checking for JPEG3 drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras drm/amd/pm: avoid potential UBSAN issue on legacy asics drm/i915: taint kernel when force probing unsupported devices drm/i915/dp: prevent potential div-by-zero drm/i915: Fix NULL ptr deref by checking new_crtc_state drm/i915/guc: Don't capture Gen8 regs on Xe devices drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend drm/amdgpu: Fix vram recover doesn't work after whole GPU reset (v2) drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs drm/amd/display: Enforce 60us prefetch for 200Mhz DCFCLK modes drm/amd/display: Add symclk workaround during disable link output drm/amd/pm: parse pp_handle under appropriate conditions drm/amdgpu: set gfx9 onwards APU atomics support to be true drm/amdgpu/nv: update VCN 3 max HEVC encoding resolution drm/sched: Check scheduler work queue before calling timeout handling drm/mipi-dsi: Set the fwnode for mipi_dsi_device drm/nouveau/disp: More DP_RECEIVER_CAP_SIZE array fixes drm/dsc: fix DP_DSC_MAX_BPP_DELTA_* macro values ... commit 849a4f09730ba3c02da01924c7a6e7a000a4d27c Merge: 105131df9c3b2 2254a7396a0ca Author: Linus Torvalds Date: Thu May 11 16:51:11 2023 -0500 Merge tag 'xfs-6.4-rc1-fixes' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs bug fixes from Dave Chinner: "Largely minor bug fixes and cleanups, th emost important of which are probably the fixes for regressions in the extent allocation code: - fixes for inode garbage collection shutdown racing with work queue updates - ensure inodegc workers run on the CPU they are supposed to - disable counter scrubbing until we can exclusively freeze the filesystem from the kernel - regression fixes for new allocation related bugs - a couple of minor cleanups" * tag 'xfs-6.4-rc1-fixes' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix xfs_inodegc_stop racing with mod_delayed_work xfs: disable reaping in fscounters scrub xfs: check that per-cpu inodegc workers actually run on that cpu xfs: explicitly specify cpu when forcing inodegc delayed work to run immediately xfs: fix negative array access in xfs_getbmap xfs: don't allocate into the data fork for an unshare request xfs: flush dirty data and drain directios before scrubbing cow fork xfs: set bnobt/cntbt numrecs correctly when formatting new AGs xfs: don't unconditionally null args->pag in xfs_bmap_btalloc_at_eof commit c75f5a55061091030a13fef71b9995b89bc86213 Author: Zheng Wang Date: Thu Apr 27 11:08:41 2023 +0800 fbdev: imsttfb: Fix use after free bug in imsttfb_probe A use-after-free bug may occur if init_imstt invokes framebuffer_release and free the info ptr. The caller, imsttfb_probe didn't notice that and still keep the ptr as private data in pdev. If we remove the driver which will call imsttfb_remove to make cleanup, UAF happens. Fix it by return error code if bad case happens in init_imstt. Signed-off-by: Zheng Wang Signed-off-by: Helge Deller commit d8843eebbbd15b78c6a7745717b3705eca923b0f Merge: 9235c21c37fac 996e93a3fe74d Author: Dave Airlie Date: Fri May 12 06:46:33 2023 +1000 Merge tag 'amd-drm-fixes-6.4-2023-05-11' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amdgpu: - VCN3 fixes - APUs always support PCI atomics - Legacy power management fixes - DCN 3.1.4 fix - DCFCLK fix - Fix several RAS irq refcount mismatches - GPU Reset fix - GFX 11.0.4 fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230511141755.7896-1-alexander.deucher@amd.com commit 9235c21c37facd131b4d126ce7535ca573f850e3 Merge: dc49c3b1d463a 79c901c93562b Author: Dave Airlie Date: Fri May 12 06:45:54 2023 +1000 Merge tag 'drm-intel-fixes-2023-05-11-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix to taint kernel when force_probe is used - Null deref and div-by-zero fixes for display - GuC error capture fix for Xe devices Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZFzdYV3O8lvVJ1DQ@jlahtine-mobl.ger.corp.intel.com commit dc49c3b1d463a99fb529d2a69cc0e2270d6cb27e Merge: ac9a78681b921 2da5bffe9eaa5 Author: Dave Airlie Date: Fri May 12 05:32:36 2023 +1000 Merge tag 'drm-misc-fixes-2023-05-11' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v6.4-rc2: - More DSC macro fixes. - Small mipi-dsi fix. - Scheduler timeout handling fix. --- drm-misc-fixes for v6.4-rc1: - Fix DSC macros. - Fix VESA format for simplefb. - Prohibit potential out-of-bounds access in generic fbdev emulation. - Improve AST2500+ compat on ARM. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/b34135e3-2651-4e0a-a776-9b047882b1b2@linux.intel.com commit 7b63a88bb62ba2ddf5fcd956be85fe46624628b9 Author: Dmitry Torokhov Date: Thu May 11 12:08:37 2023 -0700 Input: psmouse - fix OOB access in Elantech protocol The kernel only allocate 5 MT slots; check that transmitted slot ID falls within the acceptable range. Link: https://lore.kernel.org/r/ZFnEL91nrT789dbG@google.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 20a99a291d564a559cc2fd013b4824a3bb3f1db7 Author: Hans de Goede Date: Thu May 11 11:57:04 2023 -0700 Input: soc_button_array - add invalid acpi_index DMI quirk handling Some devices have a wrong entry in their button array which points to a GPIO which is required in another driver, so soc_button_array must not claim it. A specific example of this is the Lenovo Yoga Book X90F / X90L, where the PNP0C40 home button entry points to a GPIO which is not a home button and which is required by the lenovo-yogabook driver. Add a DMI quirk table which can specify an ACPI GPIO resource index which should be skipped; and add an entry for the Lenovo Yoga Book X90F / X90L to this new DMI quirk table. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230414072116.4497-1-hdegoede@redhat.com Signed-off-by: Dmitry Torokhov commit 155c45a25679f571c2ae57d10db843a9dfc63430 Author: Marek Vasut Date: Sun Mar 5 21:52:26 2023 +0100 power: supply: Ratelimit no data debug output Reduce the amount of output this dev_dbg() statement emits into logs, otherwise if system software polls the sysfs entry for data and keeps getting -ENODATA, it could end up filling the logs up. This does in fact make systemd journald choke, since during boot the sysfs power supply entries are polled and if journald starts at the same time, the journal is just being repeatedly filled up, and the system stops on trying to start journald without booting any further. Signed-off-by: Marek Vasut Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 4b963ae1df6426f0e51de64133d379d9bde50c48 Author: Alexandru Sorodoc Date: Thu May 11 19:15:10 2023 +0300 ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V These models use 2 CS35L41 amplifiers using SPI for down-facing speakers. alc285_fixup_speaker2_to_dac1 is needed to fix volume control of the down-facing speakers. Pin configs are needed to enable headset mic detection. Note that these models lack the ACPI _DSD properties needed to initialize the amplifiers. They can be added during boot to get working sound out of the speakers: https://gist.github.com/lamperez/862763881c0e1c812392b5574727f6ff Signed-off-by: Alexandru Sorodoc Link: https://lore.kernel.org/r/20230511161510.315170-1-ealex95@gmail.com Signed-off-by: Takashi Iwai commit 3e10f6ca76c4d00019badebd235c9d7f0068261e Author: Vitaly Rodionov Date: Wed May 10 15:22:27 2023 +0100 ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops Add support for HP EliteBook 835/845/845W/865 G10 laptops with CS35L41 amplifiers on I2C/SPI bus connected to Realtek codec. Signed-off-by: Vitaly Rodionov Cc: Link: https://lore.kernel.org/r/20230510142227.32945-1-vitalyr@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 68dc6c2d5eec45515855cce99256162f45651a0b Author: Rob Clark Date: Tue May 9 13:30:41 2023 -0700 drm/msm: Fix submit error-path leaks For errors after msm_submitqueue_get(), we need to drop the submitqueue reference. Additionally after get_unused_fd() we need to drop the fd. The ordering for dropping the queue lock and put_unused_fd() is not important, so just move this all into out_post_unlock. v2: Only drop queue ref if submit doesn't take it v3: Fix unitialized submit ref in error path v4: IS_ERR_OR_NULL() Reported-by: pinkperfect2021@gmail.com Fixes: f0de40a131d9 drm/msm: ("Reorder lock vs submit alloc") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/536073/ Link: https://lore.kernel.org/r/20230509203041.440619-1-robdclark@gmail.com commit db40d2928d245f3a6cba9a6a2547ec955b00f0fc Author: Luca Weiss Date: Mon May 8 22:26:45 2023 +0200 drm/msm/iommu: Fix null pointer dereference in no-IOMMU case In the case that no IOMMU is available, msm_iommu_new can return NULL which should be handled. Without we will get a NULL pointer dereference in the next statement when we try to use the mmu variable. Fixes: 8cceb773f565 ("drm/msm/adreno: stall translation on fault for all GPU families") Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/535915/ Link: https://lore.kernel.org/r/20230508-6-4-drm-msm-iommu-fixup-v1-1-a7a21ec94f5b@z3ntu.xyz Signed-off-by: Rob Clark commit c3a62df457ff9ac8c77efe6d1eca2855d399355d Merge: 9a48c597d60de 1ea244158a4a2 Author: Marc Zyngier Date: Thu May 11 15:26:01 2023 +0100 Merge branch kvm-arm64/pgtable-fixes-6.4 into kvmarm-master/fixes * kvm-arm64/pgtable-fixes-6.4: : . : Fixes for concurrent S2 mapping race from Oliver: : : "So it appears that there is a race between two parallel stage-2 map : walkers that could lead to mapping the incorrect PA for a given IPA, as : the IPA -> PA relationship picks up an unintended offset. This series : eliminates the problem by using the current IPA of the walk as the : source-of-truth regarding where we are in a map operation." : . KVM: arm64: Constify start/end/phys fields of the pgtable walker data KVM: arm64: Infer PA offset from VA in hyp map walker KVM: arm64: Infer the PA offset from IPA in stage-2 map walker Signed-off-by: Marc Zyngier commit 9a48c597d60decb1c1f982a9eac19519dbf02875 Merge: ac9a78681b921 e910baa9c1efd Author: Marc Zyngier Date: Thu May 11 15:25:58 2023 +0100 Merge branch kvm-arm64/misc-6.4 into kvmarm-master/fixes * kvm-arm64/misc-6.4: : . : Minor changes for 6.4: : : - Make better use of the bitmap API (bitmap_zero, bitmap_zalloc...) : : - FP/SVE/SME documentation update, in the hope that this field : becomes clearer... : : - Add workaround for the usual Apple SEIS brokenness : : - Random comment fixes : . KVM: arm64: vgic: Add Apple M2 PRO/MAX cpus to the list of broken SEIS implementations KVM: arm64: Clarify host SME state management KVM: arm64: Restructure check for SVE support in FP trap handler KVM: arm64: Document check for TIF_FOREIGN_FPSTATE KVM: arm64: Fix repeated words in comments KVM: arm64: Use the bitmap API to allocate bitmaps KVM: arm64: Slightly optimize flush_context() Signed-off-by: Marc Zyngier commit e910baa9c1efdf7634519c135c6723b0fd499683 Author: Marc Zyngier Date: Mon May 1 19:21:41 2023 +0100 KVM: arm64: vgic: Add Apple M2 PRO/MAX cpus to the list of broken SEIS implementations Unsurprisingly, the M2 PRO is also affected by the SEIS bug, so add it to the naughty list. And since M2 MAX is likely to be of the same ilk, flag it as well. Tested on a M2 PRO mini machine. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20230501182141.39770-1-maz@kernel.org commit 105131df9c3b27673392a6b7ff356360188dc869 Merge: 6e27831b91a0b 8bbec86ce6d66 Author: Linus Torvalds Date: Thu May 11 09:01:40 2023 -0500 Merge tag 'dt-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt Pull devicetree binding fixes from Krzysztof Kozlowski: "A few fixes for Devicetree bindings and related docs, all for issues introduced in v6.4-rc1 commits: - media/ov2685: fix number of possible data lanes, as old binding explicitly mentioned one data lane. This fixes dt_binding_check warnings like: Documentation/devicetree/bindings/media/rockchip-isp1.example.dtb: camera@3c: port:endpoint:data-lanes: [[1]] is too short From schema: Documentation/devicetree/bindings/media/i2c/ovti,ov2685.yaml - PCI/fsl,imx6q: correct parsing of assigned-clocks and related properties and make the clocks more specific per PCI device (host or endpoint). This fixes dtschema limitation and dt_binding_check warnings like: Documentation/devicetree/bindings/pci/fsl,imx6q-pcie-ep.example.dtb: pcie-ep@33800000: Unevaluated properties are not allowed From schema: Documentation/devicetree/bindings/pci/fsl,imx6q-pcie-ep.yaml - Maintainers: correct path of Apple PWM binding. This fixes refcheckdocs warning" * tag 'dt-fixes-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt: dt-bindings: PCI: fsl,imx6q: fix assigned-clocks warning MAINTAINERS: adjust file entry for ARM/APPLE MACHINE SUPPORT media: dt-bindings: ov2685: Correct data-lanes attribute commit 6e27831b91a0bc572902eb065b374991c1ef452a Merge: 691e1eee1b4e5 cceac92678877 Author: Linus Torvalds Date: Thu May 11 08:42:47 2023 -0500 Merge tag 'net-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter. Current release - regressions: - mtk_eth_soc: fix NULL pointer dereference Previous releases - regressions: - core: - skb_partial_csum_set() fix against transport header magic value - fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). - annotate sk->sk_err write from do_recvmmsg() - add vlan_get_protocol_and_depth() helper - netlink: annotate accesses to nlk->cb_running - netfilter: always release netdev hooks from notifier Previous releases - always broken: - core: deal with most data-races in sk_wait_event() - netfilter: fix possible bug_on with enable_hooks=1 - eth: bonding: fix send_peer_notif overflow - eth: xpcs: fix incorrect number of interfaces - eth: ipvlan: fix out-of-bounds caused by unclear skb->cb - eth: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register" * tag 'net-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (31 commits) af_unix: Fix data races around sk->sk_shutdown. af_unix: Fix a data race of sk->sk_receive_queue->qlen. net: datagram: fix data-races in datagram_poll() net: mscc: ocelot: fix stat counter register values ipvlan:Fix out-of-bounds caused by unclear skb->cb docs: networking: fix x25-iface.rst heading & index order gve: Remove the code of clearing PBA bit tcp: add annotations around sk->sk_shutdown accesses net: add vlan_get_protocol_and_depth() helper net: pcs: xpcs: fix incorrect number of interfaces net: deal with most data-races in sk_wait_event() net: annotate sk->sk_err write from do_recvmmsg() netlink: annotate accesses to nlk->cb_running kselftest: bonding: add num_grat_arp test selftests: forwarding: lib: add netns support for tc rule handle stats get Documentation: bonding: fix the doc of peer_notif_delay bonding: fix send_peer_notif overflow net: ethernet: mtk_eth_soc: fix NULL pointer dereference selftests: nft_flowtable.sh: check ingress/egress chain too selftests: nft_flowtable.sh: monitor result file sizes ... commit 691e1eee1b4e5203fa5152a4603c11fbd5448528 Merge: 80e62bc8487b0 ae3c253f595b3 Author: Linus Torvalds Date: Thu May 11 08:35:52 2023 -0500 Merge tag 'media/v6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - fix some unused-variable warning in mtk-mdp3 - ignore unused suspend operations in nxp - some driver fixes in rcar-vin * tag 'media/v6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: platform: mtk-mdp3: work around unused-variable warning media: nxp: ignore unused suspend operations media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE media: rcar-vin: Fix NV12 size alignment media: rcar-vin: Gen3 can not scale NV12 commit 6208890495ded5429424b0335c7fd2d47fdffb83 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:14 2023 +0200 fbdev: vfb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: Helge Deller Signed-off-by: Helge Deller commit 2fce6899b110f117edb6c27c7ad18a29e7c622db Author: Thomas Zimmermann Date: Fri Mar 31 11:23:13 2023 +0200 fbdev: valkyriefb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: Helge Deller Signed-off-by: Helge Deller commit 8000425739dc49beceecdcd6f76c7b3bf40093fb Author: Thomas Zimmermann Date: Fri Mar 31 11:23:12 2023 +0200 fbdev: stifb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: Helge Deller Signed-off-by: Helge Deller commit 6a7be526157940a71f363f24badccf545ff40541 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:11 2023 +0200 fbdev: sa1100fb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit a124ee3271ccd498689e4dc8ccd610e41e1579c9 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:10 2023 +0200 fbdev: platinumfb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: Helge Deller Signed-off-by: Helge Deller commit 58b0aca735ff008ff32e494d87869556d299f0c4 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:09 2023 +0200 fbdev: p9100: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 8c13c9de80b516d2a168e18744c9b7f586135ea4 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:08 2023 +0200 fbdev: maxinefb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 41aaa2ecfca87afaebc40f00100a5d19ba381e4b Author: Thomas Zimmermann Date: Fri Mar 31 11:23:07 2023 +0200 fbdev: macfb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: Helge Deller Signed-off-by: Helge Deller commit 4311776fd8f789c3fa15e051cf9ec94df6ca5a46 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:06 2023 +0200 fbdev: hpfb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit f15d296317a73a81394600050702264bbe99fa37 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:05 2023 +0200 fbdev: hgafb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 353e4441199b4106e5a5148bcff5c6b8ea268134 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:04 2023 +0200 fbdev: g364fb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 56fd9558357bdfa5c187dbd59990b62d358ed66e Author: Thomas Zimmermann Date: Fri Mar 31 11:23:03 2023 +0200 fbdev: controlfb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: Helge Deller Signed-off-by: Helge Deller commit ca047de0e00e9cf55775f1f6b90461ed1f76c424 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:02 2023 +0200 fbdev: cg14: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 486357bbdafb43bcc99fcf943ea76fcd69aae7b7 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:01 2023 +0200 fbdev: atmel_lcdfb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Reviewed-by: Sui Jingfeng commit 3f6cb84839dcdd53cc002a198b5f92705bd793b3 Author: Thomas Zimmermann Date: Fri Mar 31 11:23:00 2023 +0200 fbdev: 68328fb: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: Helge Deller Signed-off-by: Helge Deller commit 5a6bef734247c7a8c19511664ff77634ab86f45b Author: Zongjie Li Date: Tue May 9 19:27:26 2023 +0800 fbdev: arcfb: Fix error handling in arcfb_probe() Smatch complains that: arcfb_probe() warn: 'irq' from request_irq() not released on lines: 587. Fix error handling in the arcfb_probe() function. If IO addresses are not provided or framebuffer registration fails, the code will jump to the err_addr or err_register_fb label to release resources. If IRQ request fails, previously allocated resources will be freed. Fixes: 1154ea7dcd8e ("[PATCH] Framebuffer driver for Arc LCD board") Signed-off-by: Zongjie Li Reviewed-by: Dongliang Mu Signed-off-by: Helge Deller commit ad81e23426a651eb89a4b306e1c4169e6308c124 Author: Jocelyn Falempe Date: Wed May 10 15:10:34 2023 +0200 drm/mgag200: Fix gamma lut not initialized. When mgag200 switched from simple KMS to regular atomic helpers, the initialization of the gamma settings was lost. This leads to a black screen, if the bios/uefi doesn't use the same pixel color depth. v2: rebase on top of drm-misc-fixes, and add Cc stable tag. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2171155 Fixes: 1baf9127c482 ("drm/mgag200: Replace simple-KMS with regular atomic helpers") Cc: Tested-by: Phil Oester Reviewed-by: Thomas Zimmermann Signed-off-by: Jocelyn Falempe Link: https://patchwork.freedesktop.org/patch/msgid/20230510131034.284078-1-jfalempe@redhat.com commit 996e93a3fe74dcf9d467ae3020aea42cc3ff65e3 Author: Yifan Zhang Date: Wed May 10 16:13:48 2023 +0800 drm/amdgpu: change gfx 11.0.4 external_id range gfx 11.0.4 range starts from 0x80. Fixes: 311d52367d0a ("drm/amdgpu: add soc21 common ip block support for GC 11.0.4") Cc: stable@vger.kernel.org Signed-off-by: Yifan Zhang Reported-by: Yogesh Mohan Marimuthu Acked-by: Alex Deucher Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit 5b94db73e45e2e6c2840f39c022fd71dfa47fc58 Author: Saleemkhan Jamadar Date: Tue May 9 12:37:50 2023 +0530 drm/amdgpu/jpeg: Remove harvest checking for JPEG3 Register CC_UVD_HARVESTING is obsolete for JPEG 3.1.2 Signed-off-by: Saleemkhan Jamadar Reviewed-by: Veerabadhran Gopalakrishnan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 4a76680311330aefe5074bed8f06afa354b85c48 Author: Guchun Chen Date: Sat May 6 20:06:45 2023 +0800 drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras gfx9 cp_ecc_error_irq is only enabled when legacy gfx ras is assert. So in gfx_v9_0_hw_fini, interrupt disablement for cp_ecc_error_irq should be executed under such condition, otherwise, an amdgpu_irq_put calltrace will occur. [ 7283.170322] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu] [ 7283.170964] RSP: 0018:ffff9a5fc3967d00 EFLAGS: 00010246 [ 7283.170967] RAX: ffff98d88afd3040 RBX: ffff98d89da20000 RCX: 0000000000000000 [ 7283.170969] RDX: 0000000000000000 RSI: ffff98d89da2bef8 RDI: ffff98d89da20000 [ 7283.170971] RBP: ffff98d89da20000 R08: ffff98d89da2ca18 R09: 0000000000000006 [ 7283.170973] R10: ffffd5764243c008 R11: 0000000000000000 R12: 0000000000001050 [ 7283.170975] R13: ffff98d89da38978 R14: ffffffff999ae15a R15: ffff98d880130105 [ 7283.170978] FS: 0000000000000000(0000) GS:ffff98d996f00000(0000) knlGS:0000000000000000 [ 7283.170981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7283.170983] CR2: 00000000f7a9d178 CR3: 00000001c42ea000 CR4: 00000000003506e0 [ 7283.170986] Call Trace: [ 7283.170988] [ 7283.170989] gfx_v9_0_hw_fini+0x1c/0x6d0 [amdgpu] [ 7283.171655] amdgpu_device_ip_suspend_phase2+0x101/0x1a0 [amdgpu] [ 7283.172245] amdgpu_device_suspend+0x103/0x180 [amdgpu] [ 7283.172823] amdgpu_pmops_freeze+0x21/0x60 [amdgpu] [ 7283.173412] pci_pm_freeze+0x54/0xc0 [ 7283.173419] ? __pfx_pci_pm_freeze+0x10/0x10 [ 7283.173425] dpm_run_callback+0x98/0x200 [ 7283.173430] __device_suspend+0x164/0x5f0 v2: drop gfx11 as it's fixed in a different solution by retiring cp_ecc_irq funcs(Hawking) Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2522 Signed-off-by: Guchun Chen Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 976d3c6778e99390c6d854d140b746d12ea18a51 Author: Mirsad Todorovac Date: Tue Apr 11 20:15:20 2023 +0300 selftests: gpio: gpio-sim: Fix BUG: test FAILED due to recent change According to Mirsad the gpio-sim.sh test appears to FAIL in a wrong way due to missing initialisation of shell variables: 4.2. Bias settings work correctly cat: /sys/devices/platform/gpio-sim.0/gpiochip18/sim_gpio0/value: No such file or directory ./gpio-sim.sh: line 393: test: =: unary operator expected bias setting does not work GPIO gpio-sim test FAIL After this change the test passed: 4.2. Bias settings work correctly GPIO gpio-sim test PASS His testing environment is AlmaLinux 8.7 on Lenovo desktop box with the latest Linux kernel based on v6.2: Linux 6.2.0-mglru-kmlk-andy-09238-gd2980d8d8265 x86_64 Suggested-by: Mirsad Todorovac Signed-off-by: Andy Shevchenko Tested-by: Mirsad Goran Todorovac Signed-off-by: Mirsad Goran Todorovac Signed-off-by: Bartosz Golaszewski commit 5247f05eadf1081a74b2233f291cee2efed25e3a Author: Guchun Chen Date: Tue May 9 09:36:49 2023 +0800 drm/amd/pm: avoid potential UBSAN issue on legacy asics Prevent further dpm casting on legacy asics without od_enabled in amdgpu_dpm_is_overdrive_supported. This can avoid UBSAN complain in init sequence. v2: add a macro to check legacy dpm instead of checking asic family/type v3: refine macro name for naming consistency Suggested-by: Evan Quan Signed-off-by: Guchun Chen Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 66b2ca086210732954a7790d63d35542936fc664 Author: Michael Ellerman Date: Thu May 11 21:42:24 2023 +1000 powerpc/64s/radix: Fix soft dirty tracking It was reported that soft dirty tracking doesn't work when using the Radix MMU. The tracking is supposed to work by clearing the soft dirty bit for a mapping and then write protecting the PTE. If/when the page is written to, a page fault occurs and the soft dirty bit is added back via pte_mkdirty(). For example in wp_page_reuse(): entry = maybe_mkwrite(pte_mkdirty(entry), vma); if (ptep_set_access_flags(vma, vmf->address, vmf->pte, entry, 1)) update_mmu_cache(vma, vmf->address, vmf->pte); Unfortunately on radix _PAGE_SOFTDIRTY is being dropped by radix__ptep_set_access_flags(), called from ptep_set_access_flags(), meaning the soft dirty bit is not set even though the page has been written to. Fix it by adding _PAGE_SOFTDIRTY to the set of bits that are able to be changed in radix__ptep_set_access_flags(). Fixes: b0b5e9b13047 ("powerpc/mm/radix: Add radix pte #defines") Cc: stable@vger.kernel.org # v4.7+ Reported-by: Dan Horák Link: https://lore.kernel.org/r/20230511095558.56663a50f86bdc4cd97700b7@danny.cz Signed-off-by: Michael Ellerman Link: https://msgid.link/20230511114224.977423-1-mpe@ellerman.id.au commit 79c901c93562bdf1c84ce6c1b744fbbe4389a6eb Author: Jani Nikula Date: Thu May 4 13:35:08 2023 +0300 drm/i915: taint kernel when force probing unsupported devices For development and testing purposes, the i915.force_probe module parameter and DRM_I915_FORCE_PROBE kconfig option allow probing of devices that aren't supported by the driver. The i915.force_probe module parameter is "unsafe" and setting it taints the kernel. However, using the kconfig option does not. Always taint the kernel when force probing a device that is not supported. v2: Drop "depends on EXPERT" to avoid build breakage (kernel test robot) Fixes: 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support") Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: Daniel Vetter Cc: Dave Airlie Acked-by: Daniel Vetter Reviewed-by: Rodrigo Vivi Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20230504103508.1818540-1-jani.nikula@intel.com (cherry picked from commit 3312bb4ad09ca6423bd4a5b15a94588a8962fb8e) Signed-off-by: Joonas Lahtinen commit 0ff80028e2702c7c3d78b69705dc47c1ccba8c39 Author: Nikita Zhandarovich Date: Tue Apr 18 07:04:30 2023 -0700 drm/i915/dp: prevent potential div-by-zero drm_dp_dsc_sink_max_slice_count() may return 0 if something goes wrong on the part of the DSC sink and its DPCD register. This null value may be later used as a divisor in intel_dsc_compute_params(), which will lead to an error. In the unlikely event that this issue occurs, fix it by testing the return value of drm_dp_dsc_sink_max_slice_count() against zero. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: a4a157777c80 ("drm/i915/dp: Compute DSC pipe config in atomic check") Signed-off-by: Nikita Zhandarovich Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20230418140430.69902-1-n.zhandarovich@fintech.ru (cherry picked from commit 51f7008239de011370c5067bbba07f0207f06b72) Signed-off-by: Joonas Lahtinen commit a41d985902c153c31c616fe183cf2ee331e95ecb Author: Stanislav Lisovskiy Date: Fri May 5 11:22:12 2023 +0300 drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we must check it for NULLness here, just as in many other places, where we can't guarantee that intel_atomic_get_crtc_state was called. We are currently getting NULL ptr deref because of that, so this fix was confirmed to help. Fixes: 74a75dc90869 ("drm/i915/display: move plane prepare/cleanup to intel_atomic_plane.c") Signed-off-by: Stanislav Lisovskiy Reviewed-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20230505082212.27089-1-stanislav.lisovskiy@intel.com (cherry picked from commit 1d5b09f8daf859247a1ea65b0d732a24d88980d8) Signed-off-by: Joonas Lahtinen commit 275dac1f7f5e9c2a2e806b34d3b10804eec0ac3c Author: John Harrison Date: Fri Apr 28 11:56:33 2023 -0700 drm/i915/guc: Don't capture Gen8 regs on Xe devices A pair of pre-Xe registers were being included in the Xe capture list. GuC was rejecting those as being invalid and logging errors about them. So, stop doing it. Signed-off-by: John Harrison Reviewed-by: Alan Previn Fixes: dce2bd542337 ("drm/i915/guc: Add Gen9 registers for GuC error state capture.") Cc: Alan Previn Cc: Umesh Nerlige Ramappa Cc: Lucas De Marchi Cc: John Harrison Cc: Jani Nikula Cc: Matt Roper Cc: Balasubramani Vivekanandan Cc: Daniele Ceraolo Spurio Link: https://patchwork.freedesktop.org/patch/msgid/20230428185636.457407-2-John.C.Harrison@Intel.com (cherry picked from commit b049132d61336f643d8faf2f6574b063667088cf) Signed-off-by: Joonas Lahtinen commit 04ac7f98b92181179ea84439642493f3826d04a2 Author: Ruidong Tian Date: Tue Apr 25 11:24:16 2023 +0800 coresight: perf: Release Coresight path when alloc trace id failed Error handler for etm_setup_aux can not release coresight path because cpu mask was cleared when coresight_trace_id_get_cpu_id failed. Call coresight_release_path function explicitly when alloc trace id filed. Fixes: 4ff1fdb4125c4 ("coresight: perf: traceid: Add perf ID allocation and notifiers") Signed-off-by: Ruidong Tian Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20230425032416.125542-1-tianruidong@linux.alibaba.com commit f67bc15e526bb9920683ad6c1891ff9e08981335 Author: Dan Carpenter Date: Fri Apr 21 13:42:41 2023 +0300 coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() This code generates a Smatch warning: drivers/hwtracing/coresight/coresight-tmc-etr.c:947 tmc_etr_buf_insert_barrier_packet() error: uninitialized symbol 'bufp'. The problem is that if tmc_sg_table_get_data() returns -EINVAL, then when we test if "len < CORESIGHT_BARRIER_PKT_SIZE", the negative "len" value is type promoted to a high unsigned long value which is greater than CORESIGHT_BARRIER_PKT_SIZE. Fix this bug by adding an explicit check for error codes. Fixes: 75f4e3619fe2 ("coresight: tmc-etr: Add transparent buffer management") Signed-off-by: Dan Carpenter Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/7d33e244-d8b9-4c27-9653-883a13534b01@kili.mountain commit eb4b8eca1bad98f4b8574558a74f041f9acb5a54 Author: Milo Spadacini Date: Mon May 8 15:18:48 2023 +0200 tools: gpio: fix debounce_period_us output of lsgpio Fix incorrect output that could occur when more attributes are used and GPIO_V2_LINE_ATTR_ID_DEBOUNCE is not the first one. Signed-off-by: Milo Spadacini Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 8b229ada2669b74fdae06c83fbfda5a5a99fc253 Author: Guchun Chen Date: Sat May 6 16:52:59 2023 +0800 drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend sdma_v4_0_ip is shared on a few asics, but in sdma_v4_0_hw_fini, driver unconditionally disables ecc_irq which is only enabled on those asics enabling sdma ecc. This will introduce a warning in suspend cycle on those chips with sdma ip v4.0, while without sdma ecc. So this patch correct this. [ 7283.166354] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu] [ 7283.167001] RSP: 0018:ffff9a5fc3967d08 EFLAGS: 00010246 [ 7283.167019] RAX: ffff98d88afd3770 RBX: 0000000000000001 RCX: 0000000000000000 [ 7283.167023] RDX: 0000000000000000 RSI: ffff98d89da30390 RDI: ffff98d89da20000 [ 7283.167025] RBP: ffff98d89da20000 R08: 0000000000036838 R09: 0000000000000006 [ 7283.167028] R10: ffffd5764243c008 R11: 0000000000000000 R12: ffff98d89da30390 [ 7283.167030] R13: ffff98d89da38978 R14: ffffffff999ae15a R15: ffff98d880130105 [ 7283.167032] FS: 0000000000000000(0000) GS:ffff98d996f00000(0000) knlGS:0000000000000000 [ 7283.167036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7283.167039] CR2: 00000000f7a9d178 CR3: 00000001c42ea000 CR4: 00000000003506e0 [ 7283.167041] Call Trace: [ 7283.167046] [ 7283.167048] sdma_v4_0_hw_fini+0x38/0xa0 [amdgpu] [ 7283.167704] amdgpu_device_ip_suspend_phase2+0x101/0x1a0 [amdgpu] [ 7283.168296] amdgpu_device_suspend+0x103/0x180 [amdgpu] [ 7283.168875] amdgpu_pmops_freeze+0x21/0x60 [amdgpu] [ 7283.169464] pci_pm_freeze+0x54/0xc0 Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2522 Signed-off-by: Guchun Chen Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 6c032c37ac3ef3b7df30937c785ecc4da428edc0 Author: Lin.Cao Date: Mon May 8 17:28:41 2023 +0800 drm/amdgpu: Fix vram recover doesn't work after whole GPU reset (v2) v1: Vmbo->shadow is used to back vram bo up when vram lost. So that we should set shadow as vmbo->shadow to recover vmbo->bo v2: Modify if(vmbo->shadow) shadow = vmbo->shadow as if(!vmbo->shadow) continue; Fixes: e18aaea733da ("drm/amdgpu: move shadow_list to amdgpu_bo_vm") Reviewed-by: Christian König Signed-off-by: Lin.Cao Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 720b47229a5b24061d1c2e29ddb6043a59178d79 Author: Horatio Zhang Date: Thu May 4 01:46:12 2023 -0400 drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs The gfx.cp_ecc_error_irq is retired in gfx11. In gfx_v11_0_hw_fini still use amdgpu_irq_put to disable this interrupt, which caused the call trace in this function. [ 102.873958] Call Trace: [ 102.873959] [ 102.873961] gfx_v11_0_hw_fini+0x23/0x1e0 [amdgpu] [ 102.874019] gfx_v11_0_suspend+0xe/0x20 [amdgpu] [ 102.874072] amdgpu_device_ip_suspend_phase2+0x240/0x460 [amdgpu] [ 102.874122] amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu] [ 102.874172] amdgpu_device_pre_asic_reset+0xd9/0x490 [amdgpu] [ 102.874223] amdgpu_device_gpu_recover.cold+0x548/0xce6 [amdgpu] [ 102.874321] amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu] [ 102.874375] process_one_work+0x21f/0x3f0 [ 102.874377] worker_thread+0x200/0x3e0 [ 102.874378] ? process_one_work+0x3f0/0x3f0 [ 102.874379] kthread+0xfd/0x130 [ 102.874380] ? kthread_complete_and_exit+0x20/0x20 [ 102.874381] ret_from_fork+0x22/0x30 v2: - Handle umc and gfx ras cases in separated patch - Retired the gfx_v11_0_cp_ecc_error_irq_funcs in gfx11 v3: - Improve the subject and code comments - Add judgment on gfx11 in the function of amdgpu_gfx_ras_late_init v4: - Drop the define of CP_ME1_PIPE_INST_ADDR_INTERVAL and SET_ECC_ME_PIPE_STATE which using in gfx_v11_0_set_cp_ecc_error_state - Check cp_ecc_error_irq.funcs rather than ip version for a more sustainable life v5: - Simplify judgment conditions Signed-off-by: Horatio Zhang Reviewed-by: Hawking Zhang Acked-by: Christian König Reviewed-by: Guchun Chen Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit b504f99ccaa64da364443431e388ecf30b604e38 Author: Alvin Lee Date: Thu Apr 27 15:10:13 2023 -0400 drm/amd/display: Enforce 60us prefetch for 200Mhz DCFCLK modes [Description] - Due to bandwidth / arbitration issues at 200Mhz DCFCLK, we want to enforce minimum 60us of prefetch to avoid intermittent underflow issues - Since 60us prefetch is already enforced for UCLK DPM0, and many DCFCLK's > 200Mhz are mapped to UCLK DPM1, in theory there should not be any UCLK DPM regressions by enforcing greater prefetch Reviewed-by: Nevenko Stupar Reviewed-by: Jun Lei Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Acked-by: Alex Hung Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f57fa0f23d9707747272b0d09af8b93b19cf8ee4 Author: Leo Chen Date: Wed Apr 26 16:02:28 2023 -0400 drm/amd/display: Add symclk workaround during disable link output [Why & How] This is originally a change (9c75891f) in DCN32 because of the lack of interface to set TX while keeping symclk on. Adding this workaround to DCN314 will resolve the current issue. Fixes: 9c75891feef0 ("drm/amd/display: rework recent update PHY state commit") Reviewed-by: Nicholas Kazlauskas Acked-by: Alex Hung Signed-off-by: Leo Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 58d9b9a14b47c2a3da6effcbb01607ad7edc0275 Author: Guchun Chen Date: Fri May 5 13:20:11 2023 +0800 drm/amd/pm: parse pp_handle under appropriate conditions amdgpu_dpm_is_overdrive_supported is a common API across all asics, so we should cast pp_handle into correct structure under different power frameworks. v2: using return directly to simplify code v3: SI asic does not carry od_enabled member in pp_handle, and update Fixes tag Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2541 Fixes: eb4900aa4c49 ("drm/amdgpu: Fix kernel NULL pointer dereference in dpm functions") Suggested-by: Mario Limonciello Signed-off-by: Guchun Chen Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit af7828fbceed4f9e503034111066a0adef3db383 Author: Yifan Zhang Date: Thu Apr 27 14:01:05 2023 +0800 drm/amdgpu: set gfx9 onwards APU atomics support to be true APUs w/ gfx9 onwards doesn't reply on PCIe atomics, rather it is internal path w/ native atomic support. Set have_atomics_support to true. Signed-off-by: Yifan Zhang Reviewed-by: Lang Yu Acked-by: Felix Kuehling Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 476ac50fc30540e29191615a26aaf5f9dee91c49 Author: Thong Thai Date: Mon May 1 11:04:36 2023 -0400 drm/amdgpu/nv: update VCN 3 max HEVC encoding resolution Update the maximum resolution reported for HEVC encoding on VCN 3 devices to reflect its 8K encoding capability. v2: Also update the max height for H.264 encoding to match spec. (Ruijing) Signed-off-by: Thong Thai Reviewed-by: Ruijing Dong Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit cceac9267887753f3c9594f1f7b92237cb0f64fb Merge: 33dcee99e0e6d 3acf8f6c14d0e Author: Jakub Kicinski Date: Wed May 10 19:08:58 2023 -0700 Merge tag 'nf-23-05-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter updates for net The following patchset contains Netfilter fixes for net: 1) Fix UAF when releasing netnamespace, from Florian Westphal. 2) Fix possible BUG_ON when nf_conntrack is enabled with enable_hooks, from Florian Westphal. 3) Fixes for nft_flowtable.sh selftest, from Boris Sukholitko. 4) Extend nft_flowtable.sh selftest to cover integration with ingress/egress hooks, from Florian Westphal. * tag 'nf-23-05-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: nft_flowtable.sh: check ingress/egress chain too selftests: nft_flowtable.sh: monitor result file sizes selftests: nft_flowtable.sh: wait for specific nc pids selftests: nft_flowtable.sh: no need for ps -x option selftests: nft_flowtable.sh: use /proc for pid checking netfilter: conntrack: fix possible bug_on with enable_hooks=1 netfilter: nf_tables: always release netdev hooks from notifier ==================== Link: https://lore.kernel.org/r/20230510083313.152961-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 33dcee99e0e6d37b4ac84b3ffdfe18b64bbca0c9 Merge: 5bca1d081f44c e1d09c2c2f579 Author: Jakub Kicinski Date: Wed May 10 19:06:55 2023 -0700 Merge branch 'af_unix-fix-two-data-races-reported-by-kcsan' Kuniyuki Iwashima says: ==================== af_unix: Fix two data races reported by KCSAN. KCSAN reported data races around these two fields for AF_UNIX sockets. * sk->sk_receive_queue->qlen * sk->sk_shutdown Let's annotate them properly. ==================== Link: https://lore.kernel.org/r/20230510003456.42357-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit e1d09c2c2f5793474556b60f83900e088d0d366d Author: Kuniyuki Iwashima Date: Tue May 9 17:34:56 2023 -0700 af_unix: Fix data races around sk->sk_shutdown. KCSAN found a data race around sk->sk_shutdown where unix_release_sock() and unix_shutdown() update it under unix_state_lock(), OTOH unix_poll() and unix_dgram_poll() read it locklessly. We need to annotate the writes and reads with WRITE_ONCE() and READ_ONCE(). BUG: KCSAN: data-race in unix_poll / unix_release_sock write to 0xffff88800d0f8aec of 1 bytes by task 264 on cpu 0: unix_release_sock+0x75c/0x910 net/unix/af_unix.c:631 unix_release+0x59/0x80 net/unix/af_unix.c:1042 __sock_release+0x7d/0x170 net/socket.c:653 sock_close+0x19/0x30 net/socket.c:1397 __fput+0x179/0x5e0 fs/file_table.c:321 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x116/0x1a0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297 do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff88800d0f8aec of 1 bytes by task 222 on cpu 1: unix_poll+0xa3/0x2a0 net/unix/af_unix.c:3170 sock_poll+0xcf/0x2b0 net/socket.c:1385 vfs_poll include/linux/poll.h:88 [inline] ep_item_poll.isra.0+0x78/0xc0 fs/eventpoll.c:855 ep_send_events fs/eventpoll.c:1694 [inline] ep_poll fs/eventpoll.c:1823 [inline] do_epoll_wait+0x6c4/0xea0 fs/eventpoll.c:2258 __do_sys_epoll_wait fs/eventpoll.c:2270 [inline] __se_sys_epoll_wait fs/eventpoll.c:2265 [inline] __x64_sys_epoll_wait+0xcc/0x190 fs/eventpoll.c:2265 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0x00 -> 0x03 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 222 Comm: dbus-broker Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Fixes: 3c73419c09a5 ("af_unix: fix 'poll for write'/ connected DGRAM sockets") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Michal Kubiak Signed-off-by: Jakub Kicinski commit 679ed006d416ea0cecfe24a99d365d1dea69c683 Author: Kuniyuki Iwashima Date: Tue May 9 17:34:55 2023 -0700 af_unix: Fix a data race of sk->sk_receive_queue->qlen. KCSAN found a data race of sk->sk_receive_queue->qlen where recvmsg() updates qlen under the queue lock and sendmsg() checks qlen under unix_state_sock(), not the queue lock, so the reader side needs READ_ONCE(). BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_wait_for_peer write (marked) to 0xffff888019fe7c68 of 4 bytes by task 49792 on cpu 0: __skb_unlink include/linux/skbuff.h:2347 [inline] __skb_try_recv_from_queue+0x3de/0x470 net/core/datagram.c:197 __skb_try_recv_datagram+0xf7/0x390 net/core/datagram.c:263 __unix_dgram_recvmsg+0x109/0x8a0 net/unix/af_unix.c:2452 unix_dgram_recvmsg+0x94/0xa0 net/unix/af_unix.c:2549 sock_recvmsg_nosec net/socket.c:1019 [inline] ____sys_recvmsg+0x3a3/0x3b0 net/socket.c:2720 ___sys_recvmsg+0xc8/0x150 net/socket.c:2764 do_recvmmsg+0x182/0x560 net/socket.c:2858 __sys_recvmmsg net/socket.c:2937 [inline] __do_sys_recvmmsg net/socket.c:2960 [inline] __se_sys_recvmmsg net/socket.c:2953 [inline] __x64_sys_recvmmsg+0x153/0x170 net/socket.c:2953 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff888019fe7c68 of 4 bytes by task 49793 on cpu 1: skb_queue_len include/linux/skbuff.h:2127 [inline] unix_recvq_full net/unix/af_unix.c:229 [inline] unix_wait_for_peer+0x154/0x1a0 net/unix/af_unix.c:1445 unix_dgram_sendmsg+0x13bc/0x14b0 net/unix/af_unix.c:2048 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x148/0x160 net/socket.c:747 ____sys_sendmsg+0x20e/0x620 net/socket.c:2503 ___sys_sendmsg+0xc6/0x140 net/socket.c:2557 __sys_sendmmsg+0x11d/0x370 net/socket.c:2643 __do_sys_sendmmsg net/socket.c:2672 [inline] __se_sys_sendmmsg net/socket.c:2669 [inline] __x64_sys_sendmmsg+0x58/0x70 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0x0000000b -> 0x00000001 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 49793 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Michal Kubiak Signed-off-by: Jakub Kicinski commit 5bca1d081f44c9443e61841842ce4e9179d327b6 Author: Eric Dumazet Date: Tue May 9 17:31:31 2023 +0000 net: datagram: fix data-races in datagram_poll() datagram_poll() runs locklessly, we should add READ_ONCE() annotations while reading sk->sk_err, sk->sk_shutdown and sk->sk_state. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230509173131.3263780-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4c329f5da7cfa366bacfda1328a025dd38951317 Author: Vijaya Krishna Nivarthi Date: Tue May 9 15:31:36 2023 +0530 spi: spi-geni-qcom: Select FIFO mode for chip select Spi geni driver switches between FIFO and DMA modes based on xfer length. FIFO mode relies on M_CMD_DONE_EN interrupt for completion while DMA mode relies on XX_DMA_DONE. During dynamic switching, if FIFO mode is chosen, FIFO related interrupts are enabled and DMA related interrupts are disabled. And viceversa. Chip select shares M_CMD_DONE_EN interrupt with FIFO to check completion. Now, if a chip select operation is preceded by a DMA xfer, M_CMD_DONE_EN interrupt would have been disabled and hence it will never receive one resulting in timeout. For chip select, in addition to setting the xfer mode to FIFO, select_mode() to FIFO so that required interrupts are enabled. Fixes: e5f0dfa78ac7 ("spi: spi-geni-qcom: Add support for SE DMA mode") Suggested-by: Praveen Talari Date: Tue May 9 17:34:12 2023 +0200 ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs A bunch of TI's codecs have binding schemas which force #sound-dai-cells to one despite those codecs only having a single DAI. Allow for bindings with zero DAI cells and deprecate the former non-zero value. Signed-off-by: Martin Povišer Date: Tue May 9 13:51:34 2023 +0100 ASoC: jz4740-i2s: Make I2S divider calculations more robust When the CPU supplies bit/frame clocks, the system clock (clk_i2s) is divided to produce the bit clock. This is a simple 1/N divider with a fairly limited range, so for a given system clock frequency only a few sample rates can be produced. Usually a wider range of sample rates is supported by varying the system clock frequency. The old calculation method was not very robust and could easily produce the wrong clock rate, especially with non-standard rates. For example, if the system clock is 1.99x the target bit clock rate, the divider would be calculated as 1 instead of the more accurate 2. Instead, use a more accurate method that considers two adjacent divider settings and selects the one that produces the least error versus the requested rate. If the error is 5% or higher then the rate setting is rejected to prevent garbled audio. Skip divider calculation when the codec is supplying both the bit and frame clock; in that case, the divider outputs are unused and we don't want to constrain the sample rate. Signed-off-by: Aidan MacDonald Date: Wed May 10 20:04:04 2023 -0500 MAINTAINERS: re-sort all entries and fields It's been a few years since we've sorted this thing, and the end result is that we've added MAINTAINERS entries in the wrong order, and a number of entries have their fields in non-canonical order too. So roll this boulder up the hill one more time by re-running ./scripts/parse-maintainers.pl --order on it. This file ends up being fairly painful for merge conflicts even normally, since unlike almost all other kernel files it's one of those "everybody touches the same thing", and re-ordering all entries is only going to make that worse. But the alternative is to never do it at all, and just let it all rot.. The rc2 week is likely the quietest and least painful time to do this. Requested-by: Randy Dunlap Requested-by: Joe Perches # "Please use --order" Signed-off-by: Linus Torvalds commit f7dcc5e33c1e4b0d278a30f7d2f0c9a63d7b40ca Author: Takashi Sakamoto Date: Wed May 10 10:35:33 2023 +0900 firewire: net: fix unexpected release of object for asynchronous request packet The lifetime of object for asynchronous request packet is now maintained by reference counting, while current implementation of firewire-net releases the passed object in the handler. This commit fixes the bug. Reported-by: Dan Carpenter Link: https://lore.kernel.org/lkml/Y%2Fymx6WZIAlrtjLc@workstation/ Fixes: 13a55d6bb15f ("firewire: core: use kref structure to maintain lifetime of data for fw_request structure") Link: https://lore.kernel.org/lkml/20230510031205.782032-1-o-takashi@sakamocchi.jp/ Signed-off-by: Takashi Sakamoto commit d39fc592ef8ae9a89c5e85c8d9f760937a57d5ba Author: Steve French Date: Wed May 10 17:42:21 2023 -0500 cifs: release leases for deferred close handles when freezing We should not be caching closed files when freeze is invoked on an fs (so we can release resources more gracefully). Fixes xfstests generic/068 generic/390 generic/491 Reviewed-by: David Howells Cc: Signed-off-by: Steve French commit d295b66a7b66ed504a827b58876ad9ea48c0f4a8 Merge: 2a78769da34b7 c915d8f5918be Author: Linus Torvalds Date: Wed May 10 17:07:42 2023 -0500 Merge tag 'fsnotify_for_v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull inotify fix from Jan Kara: "A fix for possibly reporting invalid watch descriptor with inotify event" * tag 'fsnotify_for_v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: inotify: Avoid reporting event with invalid wd commit 2a78769da34b792cc4c4f7157cda6b622fab0872 Merge: ad2fd53a7870a 504a10d9e46bc Author: Linus Torvalds Date: Wed May 10 16:48:35 2023 -0500 Merge tag 'gfs2-v6.3-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 fix from Andreas Gruenbacher: - Fix a NULL pointer dereference when mounting corrupted filesystems * tag 'gfs2-v6.3-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Don't deref jdesc in evict commit 760ebc45746b498a36332acefd9e2838a3f8fcf0 Author: Jiri Olsa Date: Wed May 10 15:51:31 2023 -0300 perf lock contention: Add empty 'struct rq' to satisfy libbpf 'runqueue' type verification If 'struct rq' isn't defined in lock_contention.bpf.c then the type for the 'runqueue' variable ends up being a forward declaration (BTF_KIND_FWD) while the kernel has it defined (BTF_KIND_STRUCT). This makes libbpf decide it has incompatible types and then fails to load the BPF skeleton: # perf lock con -ab sleep 1 libbpf: extern (var ksym) 'runqueues': incompatible types, expected [95] fwd rq, but kernel has [55509] struct rq libbpf: failed to load object 'lock_contention_bpf' libbpf: failed to load BPF skeleton 'lock_contention_bpf': -22 Failed to load lock-contention BPF skeleton lock contention BPF setup failed # Add it as an empty struct to satisfy that type verification: # perf lock con -ab sleep 1 contended total wait max wait avg wait type caller 2 50.64 us 25.38 us 25.32 us spinlock tick_do_update_jiffies64+0x25 1 26.18 us 26.18 us 26.18 us spinlock tick_do_update_jiffies64+0x25 # Committer notes: Extracted from a larger patch as Namhyung had already fixed the other issues in e53de7b65a3ca59a ("perf lock contention: Fix struct rq lock access"). Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Changbin Du Cc: Hao Luo Cc: Ian Rogers Cc: Namhyung Kim Cc: Song Liu Cc: Stephane Eranian Cc: Yang Jihong Link: https://lore.kernel.org/lkml/ZFVqeKLssg7uzxzI@krava Signed-off-by: Arnaldo Carvalho de Melo commit bfd431cb2c68cbaec7a27b8a979d031f8501301b Author: James Clark Date: Thu May 4 15:48:22 2023 +0100 perf cs-etm: Fix contextid validation Pre 5.11 kernels don't support 'contextid1' and 'contextid2' so validation would be skipped. By adding an additional check for 'contextid', old kernels will still have validation done even though contextid would either be contextid1 or contextid2. Additionally now that it's possible to override options, an existing bug in the validation is revealed. 'val' is overwritten by the contextid1 validation, and re-used for contextid2 validation causing it to always fail. '!val || val != 0x4' is the same as 'val != 0x4' because 0 is also != 4, so that expression can be simplified and the temp variable not overwritten. Fixes: 35c51f83dd1ed5db ("perf cs-etm: Validate options after applying them") Reviewed-by: Leo Yan Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/all/20230501073452.GA4660@leoy-yangtze.lan Link: https://lore.kernel.org/r/20230504144822.1938717-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit a3cee97446cc9ee1332b5f317024ccd23ac6c48c Author: James Clark Date: Thu May 4 17:08:45 2023 +0100 perf arm64: Fix build with refcount checking With EXTRA_CFLAGS=-DREFCNT_CHECKING=1 and build-test, some unwrapped map accesses appear. Wrap it in the new accessor to fix the error: error: 'struct perf_cpu_map' has no member named 'map' Signed-off-by: James Clark Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230504160845.2065510-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 8669862388b01de7a248fea8b743aafd42169875 Author: Sandipan Das Date: Fri May 5 15:32:54 2023 +0530 perf test: Add stat test for record and script When using the global aggregation mode, running perf script after perf stat record can result in a segmentation fault as seen with commit 8b76a3188b85 ("perf stat: Remove unused perf_counts.aggr field"). Add a basic test to the existing suite of stat-related tests for checking if that workflow runs without erroring out. Signed-off-by: Sandipan Das Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Nick Terrell Cc: Peter Zijlstra Cc: Ravi Bangoria Link: https://lore.kernel.org/r/6a5429879764e3dac984cbb11ee2d95cc1604161.1683280603.git.sandipan.das@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 2fe6575924612f1014a0539ab3053b106aded926 Author: Sandipan Das Date: Fri May 5 15:32:53 2023 +0530 perf script: Skip aggregation for stat events The script command does not support aggregation modes by itself although that can be achieved using post-processing scripts. Because of this, it does not allocate memory for aggregated event values. Upon running perf stat record, the aggregation mode is set in the perf data file. If the mode is AGGR_GLOBAL, the aggregated event values are accessed and this leads to a segmentation fault since these were never allocated to begin with. Set the mode to AGGR_NONE explicitly to avoid this. E.g. $ perf stat record -e cycles true $ perf script Before: Segmentation fault (core dumped) After: CPU THREAD VAL ENA RUN TIME EVENT -1 231919 162831 362069 362069 935289 cycles:u Fixes: 8b76a3188b85724f ("perf stat: Remove unused perf_counts.aggr field") Signed-off-by: Sandipan Das Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nick Terrell Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: stable@vger.kernel.org # v6.2+ Link: https://lore.kernel.org/r/83d6c6c05c54bf00c5a9df32ac160718efca0c7a.1683280603.git.sandipan.das@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit a2af0f6b8ef7ea402d6a531607bd0bc3dd3b4815 Author: Ian Rogers Date: Wed May 10 14:23:52 2023 -0300 perf build: Add system include paths to BPF builds There are insufficient headers in tools/include to satisfy building BPF programs and their header dependencies. Add the system include paths from the non-BPF clang compile so that these headers can be found. This code was taken from: tools/testing/selftests/bpf/Makefile Committer notes: Had to adjust the '#ifndef NO_BPF_SKEL' to '#ifdef BUILD_BPF_SKEL' as reverted that build BPF skels by default. Also cope with the addition of -I$(srctree)/tools/include/uapi done by Yang Jihong so that we prefer using the kernel sources headers instead of older ones in the system. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Andrii Nakryiko Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley , Cc: Peter Zijlstra Cc: Song Liu Cc: Tom Rix Cc: Yang Jihong Link: https://lore.kernel.org/lkml/20230506021450.3499232-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5be6cecda0802f2397504fd40c3402cd8ac8022e Author: Yang Jihong Date: Wed May 10 06:44:01 2023 +0000 perf bpf skels: Make vmlinux.h use bpf.h and perf_event.h in source directory Currently, vmlinux.h uses the bpf.h and perf_event.h header files in the system path. If the header files in compilation environment are old, compilation may fail. For example: /home/yangjihong/linux/tools/perf/util/bpf_skel/.tmp/../vmlinux.h:151:27: error: field has incomplete type 'union perf_sample_weight' union perf_sample_weight weight; Use the bpf.h and perf_event.h files in the source code directory to avoid compilation compatibility problems. Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Tom Rix Link: https://lore.kernel.org/r/20230510064401.225051-1-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 7d161165d9072dcbb1f01ce947436b7a3101c254 Author: Adrian Hunter Date: Mon May 8 12:39:52 2023 +0300 perf parse-events: Do not break up AUX event group Do not assume which events may have a PMU name, allowing the logic to keep an AUX event group together. Example: Before: $ perf record --no-bpf-event -c 10 -e '{intel_pt//,tlb_flush.stlb_any/aux-sample-size=8192/pp}:u' -- sleep 0.1 WARNING: events were regrouped to match PMUs Cannot add AUX area sampling to a group leader $ After: $ perf record --no-bpf-event -c 10 -e '{intel_pt//,tlb_flush.stlb_any/aux-sample-size=8192/pp}:u' -- sleep 0.1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.078 MB perf.data ] $ perf script -F-dso,+addr | grep -C5 tlb_flush.stlb_any | head -11 sleep 20444 [003] 7939.510243: 1 branches:uH: 7f5350cc82a2 dl_main+0x9a2 => 7f5350cb38f0 _dl_add_to_namespace_list+0x0 sleep 20444 [003] 7939.510243: 1 branches:uH: 7f5350cb3908 _dl_add_to_namespace_list+0x18 => 7f5350cbb080 rtld_mutex_dummy+0x0 sleep 20444 [003] 7939.510243: 1 branches:uH: 7f5350cc8350 dl_main+0xa50 => 0 [unknown] sleep 20444 [003] 7939.510244: 1 branches:uH: 7f5350cc83ca dl_main+0xaca => 7f5350caeb60 _dl_process_pt_gnu_property+0x0 sleep 20444 [003] 7939.510245: 1 branches:uH: 7f5350caeb60 _dl_process_pt_gnu_property+0x0 => 0 [unknown] sleep 20444 7939.510245: 10 tlb_flush.stlb_any/aux-sample-size=8192/pp: 0 7f5350caeb60 _dl_process_pt_gnu_property+0x0 sleep 20444 [003] 7939.510254: 1 branches:uH: 7f5350cc87fe dl_main+0xefe => 7f5350ccd240 strcmp+0x0 sleep 20444 [003] 7939.510254: 1 branches:uH: 7f5350cc8862 dl_main+0xf62 => 0 [unknown] sleep 20444 [003] 7939.510255: 1 branches:uH: 7f5350cc9cdc dl_main+0x23dc => 0 [unknown] sleep 20444 [003] 7939.510257: 1 branches:uH: 7f5350cc89f6 dl_main+0x10f6 => 7f5350cb9530 _dl_setup_hash+0x0 sleep 20444 [003] 7939.510257: 1 branches:uH: 7f5350cc8a2d dl_main+0x112d => 7f5350cb3990 _dl_new_object+0x0 $ Fixes: 347c2f0a0988c59c ("perf parse-events: Sort and group parsed events") Suggested-by: Ian Rogers Signed-off-by: Adrian Hunter Tested-by: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20230508093952.27482-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a468085011ea8bba7fc605a5423d6edaf46d35cf Author: Adrian Hunter Date: Mon May 8 12:39:51 2023 +0300 perf test test_intel_pt.sh: Test sample mode with event with PMU name br_misp_retired.all_branches is supported on processors that support Intel PT, so use it to test sample mode with an event that has been given a PMU name. Please note, the test fails prior to the fix "perf parse-events: Do not break up AUX event group". Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20230508093952.27482-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 123361659fa405de8e21bff485fe22a65d85e64e Author: Ian Rogers Date: Tue May 2 15:38:26 2023 -0700 perf evsel: Modify group pmu name for software events If we have a group of {cycles,faults} then we need the faults software event to appear to be on the same PMU as cycles so that we don't split the group in parse_events__sort_events_and_fix_groups. This case is relatively easy as cycles is the leader and will have a PMU name. In the reverse case, {faults,cycles} we still need faults to appear to have the PMU name of cycles but the old behavior is just to return "cpu". For hybrid this fails as cycles will be on "cpu_core" or "cpu_atom", causing faults to be split into a different group. Change the behavior for software events so that the whole group is searched for the named PMU. Signed-off-by: Ian Rogers Tested-by: Adrian Hunter Cc: Ahmad Yasin Cc: Alexander Shishkin Cc: Andi Kleen Cc: Athira Rajeev Cc: Caleb Biggers Cc: Edward Baker Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Kan Liang Cc: Kang Minchul Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Cc: Samantha Alt Cc: Stephane Eranian Cc: Sumanth Korikkar Cc: Suzuki Poulouse Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xing Zhengjun Cc: Yang Jihong Link: https://lore.kernel.org/r/20230502223851.2234828-20-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 34e82891d995ab89b494032c5ab0ee939cbb7524 Author: Yanteng Si Date: Wed May 10 18:24:52 2023 +0800 tools arch x86: Sync the msr-index.h copy with the kernel sources Picking the changes from: c68e3d473988b9af ("x86/include/asm/msr-index.h: Add IFS Array test bits") Silencing these perf build warnings: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Signed-off-by: Yanteng Si Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: loongson-kernel@lists.loongnix.cn Link: https://lore.kernel.org/r/05778ab3c168c8030f6b20e60375dc803f0cd300.1683712945.git.siyanteng@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit 705049ca4f5b7b00a792dfb559878945a6c7e084 Author: Yanteng Si Date: Wed May 10 18:24:11 2023 +0800 tools headers kvm: Sync uapi/{asm/linux} kvm.h headers with the kernel sources Picking the changes from: e65733b5c59a1ea2 ("KVM: x86: Redefine 'longmode' as a flag for KVM_EXIT_HYPERCALL") 30ec7997d175cd68 ("KVM: arm64: timers: Allow userspace to set the global counter offset") 821d935c87bc9525 ("KVM: arm64: Introduce support for userspace SMCCC filtering") 81dc9504a7006b48 ("KVM: arm64: nv: timers: Support hyp timer emulation") a8308b3fc9494953 ("KVM: arm64: Refactor hvc filtering to support different actions") 0e5c9a9d6548e9b1 ("KVM: arm64: Expose SMC/HVC width to userspace") Silencing these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm64/include/uapi/asm/kvm.h' diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Signed-off-by: Yanteng Si Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: loongson-kernel@lists.loongnix.cn Link: https://lore.kernel.org/r/ac5adb58411d23b3360d436a65038fefe91c32a8.1683712945.git.siyanteng@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit 8d6a41c8065e11206e03e7f9fa9018d35b398583 Author: Yanteng Si Date: Wed May 10 18:24:08 2023 +0800 tools include UAPI: Sync the sound/asound.h copy with the kernel sources Picking the changes from: 102882b5c62f6bfe ("ALSA: document that struct __snd_pcm_mmap_control64 is messed up") 9f656705c5faa18a ("ALSA: pcm: rewrite snd_pcm_playback_silence()") Silencing these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/sound/asound.h' differs from latest version at 'include/uapi/sound/asound.h' diff -u tools/include/uapi/sound/asound.h include/uapi/sound/asound.h Signed-off-by: Yanteng Si Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: loongson-kernel@lists.loongnix.cn Link: https://lore.kernel.org/r/5606e7989bbb029c400117f2e455ab995208266f.1683712945.git.siyanteng@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit 92b8e61e8835109140139bc1eb60329429c32a0f Author: Yanteng Si Date: Wed May 10 18:22:51 2023 +0800 tools headers UAPI: Sync the linux/const.h with the kernel headers Picking the changes from: 31088f6f7906253e ("uapi/linux/const.h: prefer ISO-friendly __typeof__") Silencing these perf build warnings:: Warning: Kernel ABI header at 'tools/include/uapi/linux/const.h' differs from latest version at 'include/uapi/linux/const.h' diff -u tools/include/uapi/linux/const.h include/uapi/linux/const.h Signed-off-by: Yanteng Si Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: loongson-kernel@lists.loongnix.cn Link: https://lore.kernel.org/r/33e963df304394f932d9108a1b0bb327f23a4eca.1683712945.git.siyanteng@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit e7ec3a249c38a9c9be3a1eeb0142fcbaa3bd02d9 Author: Yanteng Si Date: Wed May 10 18:22:49 2023 +0800 tools headers UAPI: Sync the i915_drm.h with the kernel sources Picking the changes from: 1cc064dce4ed0ff1 ("drm/i915/perf: Add support for OA media units") c61d04c9eb435498 ("drm/i915/perf: Add engine class instance parameters to perf") 02abecdeebfcd384 ("drm/i915/uapi: Replace fake flex-array with flexible-array member") Silencing these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Signed-off-by: Yanteng Si Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: loongson-kernel@lists.loongnix.cn Link: https://lore.kernel.org/r/4c0c150997ae1455f49094222daa121385643ae0.1683712945.git.siyanteng@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit e6232180e524e11205d285bb27045bf2c19db265 Author: Yanteng Si Date: Wed May 10 18:21:46 2023 +0800 tools headers UAPI: Sync the drm/drm.h with the kernel sources Picking the changes from: 6068771673a38efc ("drm: document DRM_IOCTL_PRIME_HANDLE_TO_FD and PRIME_FD_TO_HANDLE") 61a55f8b1ebcde68 ("drm: document expectations for GETFB2 handles") 158350aae16a4e66 ("drm: document DRM_IOCTL_GEM_CLOSE") Silencing these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/drm/drm.h' differs from latest version at 'include/uapi/drm/drm.h' diff -u tools/include/uapi/drm/drm.h include/uapi/drm/drm.h No changes in tooling as these are just C comment documentation changes. Signed-off-by: Yanteng Si Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: loongson-kernel@lists.loongnix.cn Link: https://lore.kernel.org/r/7552c61660bf079f2979fdcbcef8e921255f877a.1683712945.git.siyanteng@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit 5d1ac59ff7445e51a0e4958fa39ac8aa23691698 Author: Yanteng Si Date: Wed May 10 18:21:44 2023 +0800 tools headers UAPI: Sync the linux/in.h with the kernel sources Picking the changes from: 91d0b78c5177f3e4 ("inet: Add IP_LOCAL_PORT_RANGE socket option") Silencing these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/linux/in.h' differs from latest version at 'include/uapi/linux/in.h' diff -u tools/include/uapi/linux/in.h include/uapi/linux/in.h Signed-off-by: Yanteng Si Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: loongson-kernel@lists.loongnix.cn Link: https://lore.kernel.org/r/23aabc69956ac94fbf388b05c8be08a64e8c7ccc.1683712945.git.siyanteng@loongson.cn Signed-off-by: Arnaldo Carvalho de Melo commit b0618f38e2ab8ce3f094e4973955cfdbb55fceea Author: Arnaldo Carvalho de Melo Date: Tue May 9 15:42:38 2023 -0300 perf build: Gracefully fail the build if BUILD_BPF_SKEL=1 is specified and clang isn't available Build BPF skels require having a compiler able to generate BPF bytecode, and so far this is only possible with clang, so check for its availability and fail the build when the user explicitely ask for BPF skels to be built. Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Andrii Nakryiko , Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Song Liu Yang: Yang Jihong , Signed-off-by: Arnaldo Carvalho de Melo commit 5f0b89e632ed81b69993f3e68ed924ca3874d0d0 Author: Thomas Richter Date: Tue May 9 15:18:47 2023 +0200 perf test java symbol: Remove needless debuginfod queries Test case 'Test java symbol' might run for a long time. On Fedora 38 the run time is very, very long: Output before: # time ./perf test 108 108: Test java symbol : Ok real 22m15.775s user 3m42.584s sys 4m30.685s # The reason is a lookup for the server for debug symbols as shown in: # cat /etc/debuginfod/elfutils.urls https://debuginfod.fedoraproject.org/ # This lookup is done for every symbol/sample, so about 3500 lookups will take place. To omit this lookup, which is not needed, unset environment variable DEBUGINFOD_URLS=''. Output after: # time ./perf test 108 108: Test java symbol : Ok real 0m6.242s user 0m4.982s sys 0m3.243s # Signed-off-by: Thomas Richter Tested-by: Arnaldo Carvalho de Melo Cc: Heiko Carstens Cc: Ian Rogers Cc: Leo Yan Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20230509131847.835974-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 327daf34554d20a6aa190dce5a625a555055435e Author: Ian Rogers Date: Tue May 2 15:38:11 2023 -0700 perf parse-events: Don't reorder ungrouped events by PMU The pmu_group_name by default returns "cpu" which on non-hybrid/ARM means that ungrouped software, and hardware events are all going to sort by the original insertion index. However, on hybrid and ARM wildcard expansion may mean the PMU name is set and events will be unnecessarily reordered - triggering the reordering warning. Signed-off-by: Ian Rogers Tested-by: Kan Liang Cc: Adrian Hunter Cc: Ahmad Yasin Cc: Alexander Shishkin Cc: Andi Kleen Cc: Athira Rajeev Cc: Caleb Biggers Cc: Edward Baker Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Kang Minchul Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Cc: Samantha Alt Cc: Stephane Eranian Cc: Sumanth Korikkar Cc: Suzuki Poulouse Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xing Zhengjun Cc: Yang Jihong Link: https://lore.kernel.org/r/20230502223851.2234828-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ccc66c6092802d682537227136dcbd0527027e6f Author: Ian Rogers Date: Tue May 2 15:38:10 2023 -0700 perf metric: JSON flag to not group events if gathering a metric group Some metric groups have metrics that don't have fully overlapping events, meaning that the group's events become unique event groups that may need to multiplex with each other. This can be particularly unfortunate when the groups wouldn't need to multiplex because there are sufficient hardware counters. Add a flag so that if recording a metric group then the metrics within the group needn't use groups for their events. The flag is added to Intel TopdownL1 and TopdownL2 metrics. Signed-off-by: Ian Rogers Tested-by: Kan Liang Cc: Adrian Hunter Cc: Ahmad Yasin Cc: Alexander Shishkin Cc: Andi Kleen Cc: Athira Rajeev Cc: Caleb Biggers Cc: Edward Baker Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Kang Minchul Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Cc: Samantha Alt Cc: Stephane Eranian Cc: Sumanth Korikkar Cc: Suzuki Poulouse Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xing Zhengjun Cc: Yang Jihong Link: https://lore.kernel.org/r/20230502223851.2234828-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1b114824106ca4686276c94e414e06bf58b0934f Author: Ian Rogers Date: Tue May 2 15:38:09 2023 -0700 perf stat: Introduce skippable evsels 'perf stat' with no arguments will use default events and metrics. These events may fail to open even with kernel and hypervisor disabled. When these fail then the permissions error appears even though they were implicitly selected. This is particularly a problem with the automatic selection of the TopdownL1 metric group on certain architectures like Skylake: $ perf stat true Error: Access to performance monitoring and observability operations is limited. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open access to performance monitoring and observability operations for processes without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability. More information can be found at 'Perf events and tool security' document: https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html perf_event_paranoid setting is 2: -1: Allow use of (almost) all events by all users Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK >= 0: Disallow raw and ftrace function tracepoint access >= 1: Disallow CPU event access >= 2: Disallow kernel profiling To make the adjusted perf_event_paranoid setting permanent preserve it in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = ) $ This patch adds skippable evsels that when they fail to open won't cause termination and will appear as "" in output. The TopdownL1 events, from the metric group, are marked as skippable. This turns the failure above to: $ perf stat perf bench internals synthesize Computing performance of single threaded perf event synthesis by synthesizing events on the perf process itself: Average synthesis took: 49.287 usec (+- 0.083 usec) Average num. events: 3.000 (+- 0.000) Average time per event 16.429 usec Average data synthesis took: 49.641 usec (+- 0.085 usec) Average num. events: 11.000 (+- 0.000) Average time per event 4.513 usec Performance counter stats for 'perf bench internals synthesize': 1,222.38 msec task-clock:u # 0.993 CPUs utilized 0 context-switches:u # 0.000 /sec 0 cpu-migrations:u # 0.000 /sec 162 page-faults:u # 132.529 /sec 774,445,184 cycles:u # 0.634 GHz (49.61%) 1,640,969,811 instructions:u # 2.12 insn per cycle (59.67%) 302,052,148 branches:u # 247.102 M/sec (59.69%) 1,807,718 branch-misses:u # 0.60% of all branches (59.68%) 5,218,927 CPU_CLK_UNHALTED.REF_XCLK:u # 4.269 M/sec # 17.3 % tma_frontend_bound # 56.4 % tma_retiring # nan % tma_backend_bound # nan % tma_bad_speculation (60.01%) 536,580,469 IDQ_UOPS_NOT_DELIVERED.CORE:u # 438.965 M/sec (60.33%) INT_MISC.RECOVERY_CYCLES_ANY:u 5,223,936 CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE:u # 4.274 M/sec (40.31%) 774,127,250 CPU_CLK_UNHALTED.THREAD:u # 633.297 M/sec (50.34%) 1,746,579,518 UOPS_RETIRED.RETIRE_SLOTS:u # 1.429 G/sec (50.12%) 1,940,625,702 UOPS_ISSUED.ANY:u # 1.588 G/sec (49.70%) 1.231055525 seconds time elapsed 0.258327000 seconds user 0.965749000 seconds sys $ The event INT_MISC.RECOVERY_CYCLES_ANY:u is skipped as it can't be opened with paranoia 2 on Skylake. With a lower paranoia, or as root, all events/metrics are computed. Signed-off-by: Ian Rogers Tested-by: Kan Liang Cc: Adrian Hunter Cc: Ahmad Yasin Cc: Alexander Shishkin Cc: Andi Kleen Cc: Athira Rajeev Cc: Caleb Biggers Cc: Edward Baker Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Kang Minchul Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Cc: Samantha Alt Cc: Stephane Eranian Cc: Sumanth Korikkar Cc: Suzuki Poulouse Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xing Zhengjun Cc: Yang Jihong Link: https://lore.kernel.org/r/20230502223851.2234828-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 2a939c8695035b11e00239610d88551be34c7a61 Author: Ian Rogers Date: Tue May 2 15:38:08 2023 -0700 perf metric: Change divide by zero and !support events behavior Division by zero causes expression parsing to fail and no metric to be generated. This can mean for short running benchmarks metrics are not shown. Change the behavior to make the value nan, which gets shown like: ''' $ perf stat -M TopdownL2 true Performance counter stats for 'true': 1,031,492 INST_RETIRED.ANY # nan % tma_fetch_bandwidth # nan % tma_heavy_operations # nan % tma_light_operations 29,304 CPU_CLK_UNHALTED.REF_XCLK # nan % tma_fetch_latency # nan % tma_branch_mispredicts # nan % tma_machine_clears # nan % tma_core_bound # nan % tma_memory_bound 2,658,319 IDQ_UOPS_NOT_DELIVERED.CORE 11,167 EXE_ACTIVITY.BOUND_ON_STORES 262,058 EXE_ACTIVITY.1_PORTS_UTIL BR_MISP_RETIRED.ALL_BRANCHES (0.00%) INT_MISC.RECOVERY_CYCLES_ANY (0.00%) CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE (0.00%) CPU_CLK_UNHALTED.THREAD (0.00%) UOPS_RETIRED.RETIRE_SLOTS (0.00%) CYCLE_ACTIVITY.STALLS_MEM_ANY (0.00%) UOPS_RETIRED.MACRO_FUSED (0.00%) IDQ_UOPS_NOT_DELIVERED.CYCLES_0_UOPS_DELIV.CORE (0.00%) EXE_ACTIVITY.2_PORTS_UTIL (0.00%) CYCLE_ACTIVITY.STALLS_TOTAL (0.00%) MACHINE_CLEARS.COUNT (0.00%) UOPS_ISSUED.ANY (0.00%) 0.002864879 seconds time elapsed 0.003012000 seconds user 0.000000000 seconds sys ''' When events aren't supported a count of 0 can be confusing and make metrics look meaningful. Change these to be nan also which, with the next change, gets shown like: ''' $ perf stat true Performance counter stats for 'true': 1.25 msec task-clock:u # 0.387 CPUs utilized 0 context-switches:u # 0.000 /sec 0 cpu-migrations:u # 0.000 /sec 46 page-faults:u # 36.702 K/sec 255,942 cycles:u # 0.204 GHz (88.66%) 123,046 instructions:u # 0.48 insn per cycle 28,301 branches:u # 22.580 M/sec 2,489 branch-misses:u # 8.79% of all branches 4,719 CPU_CLK_UNHALTED.REF_XCLK:u # 3.765 M/sec # nan % tma_frontend_bound # nan % tma_retiring # nan % tma_backend_bound # nan % tma_bad_speculation 344,855 IDQ_UOPS_NOT_DELIVERED.CORE:u # 275.147 M/sec INT_MISC.RECOVERY_CYCLES_ANY:u CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE:u (0.00%) CPU_CLK_UNHALTED.THREAD:u (0.00%) UOPS_RETIRED.RETIRE_SLOTS:u (0.00%) UOPS_ISSUED.ANY:u (0.00%) 0.003238142 seconds time elapsed 0.000000000 seconds user 0.003434000 seconds sys ''' Ensure that nan metric values are quoted as nan isn't a valid number in JSON. Signed-off-by: Ian Rogers Tested-by: Kan Liang Cc: Adrian Hunter Cc: Ahmad Yasin Cc: Alexander Shishkin Cc: Andi Kleen Cc: Athira Rajeev Cc: Caleb Biggers Cc: Edward Baker Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Kang Minchul Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Cc: Samantha Alt Cc: Stephane Eranian Cc: Sumanth Korikkar Cc: Suzuki Poulouse Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xing Zhengjun Cc: Yang Jihong Link: https://lore.kernel.org/r/20230502223851.2234828-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 504a10d9e46bc37b23d0a1ae2f28973c8516e636 Author: Bob Peterson Date: Fri Apr 28 12:07:46 2023 -0400 gfs2: Don't deref jdesc in evict On corrupt gfs2 file systems the evict code can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. The sequence of events is: init_journal() ... fail_jindex: gfs2_jindex_free(sdp); <------frees journals, sets jdesc = NULL if (gfs2_holder_initialized(&ji_gh)) gfs2_glock_dq_uninit(&ji_gh); fail: iput(sdp->sd_jindex); <--references jdesc in evict_linked_inode evict() gfs2_evict_inode() evict_linked_inode() ret = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks); <------references the now freed/zeroed sd_jdesc pointer. The call to gfs2_trans_begin is done because the truncate_inode_pages call can cause gfs2 events that require a transaction, such as removing journaled data (jdata) blocks from the journal. This patch fixes the problem by adding a check for sdp->sd_jdesc to function gfs2_evict_inode. In theory, this should only happen to corrupt gfs2 file systems, when gfs2 detects the problem, reports it, then tries to evict all the system inodes it has read in up to that point. Reported-by: Yang Lan Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit ad2fd53a7870a395b8564697bef6c329d017c6c9 Merge: 16a8829130ca2 3d43f9f639542 Author: Linus Torvalds Date: Wed May 10 09:36:42 2023 -0500 Merge tag 'platform-drivers-x86-v6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Nothing special to report just various small fixes: - thinkpad_acpi: Fix profile (performance/bal/low-power) regression on T490 - misc other small fixes / hw-id additions" * tag 'platform-drivers-x86-v6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/mellanox: fix potential race in mlxbf-tmfifo driver platform/x86: touchscreen_dmi: Add info for the Dexp Ursus KX210i platform/x86: touchscreen_dmi: Add upside-down quirk for GDIX1002 ts on the Juno Tablet platform/x86: thinkpad_acpi: Add profile force ability platform/x86: thinkpad_acpi: Fix platform profiles on T490 platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct platform/x86/intel-uncore-freq: Return error on write frequency platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield commit 2da5bffe9eaa5819a868e8eaaa11b3fd0f16a691 Author: Vitaly Prosyak Date: Wed May 10 09:51:11 2023 -0400 drm/sched: Check scheduler work queue before calling timeout handling During an IGT GPU reset test we see again oops despite of commit 0c8c901aaaebc9 (drm/sched: Check scheduler ready before calling timeout handling). It uses ready condition whether to call drm_sched_fault which unwind the TDR leads to GPU reset. However it looks the ready condition is overloaded with other meanings, for example, for the following stack is related GPU reset : 0 gfx_v9_0_cp_gfx_start 1 gfx_v9_0_cp_gfx_resume 2 gfx_v9_0_cp_resume 3 gfx_v9_0_hw_init 4 gfx_v9_0_resume 5 amdgpu_device_ip_resume_phase2 does the following: /* start the ring */ gfx_v9_0_cp_gfx_start(adev); ring->sched.ready = true; The same approach is for other ASICs as well : gfx_v8_0_cp_gfx_resume gfx_v10_0_kiq_resume, etc... As a result, our GPU reset test causes GPU fault which calls unconditionally gfx_v9_0_fault and then drm_sched_fault. However now it depends on whether the interrupt service routine drm_sched_fault is executed after gfx_v9_0_cp_gfx_start is completed which sets the ready field of the scheduler to true even for uninitialized schedulers and causes oops vs no fault or when ISR drm_sched_fault is completed prior gfx_v9_0_cp_gfx_start and NULL pointer dereference does not occur. Use the field timeout_wq to prevent oops for uninitialized schedulers. The field could be initialized by the work queue of resetting the domain. v1: Corrections to commit message (Luben) Fixes: 11b3b9f461c5c4 ("drm/sched: Check scheduler ready before calling timeout handling") Signed-off-by: Vitaly Prosyak Link: https://lore.kernel.org/r/20230510135111.58631-1-vitaly.prosyak@amd.com Reviewed-by: Luben Tuikov Signed-off-by: Luben Tuikov commit 1d6a4fc85717677e00fefffd847a50fc5928ce69 Author: Qu Wenruo Date: Fri Apr 28 14:13:05 2023 +0800 btrfs: make clear_cache mount option to rebuild FST without disabling it Previously clear_cache mount option would simply disable free-space-tree feature temporarily then re-enable it to rebuild the whole free space tree. But this is problematic for block-group-tree feature, as we have an artificial dependency on free-space-tree feature. If we go the existing method, after clearing the free-space-tree feature, we would flip the filesystem to read-only mode, as we detect a super block write with block-group-tree but no free-space-tree feature. This patch would change the behavior by properly rebuilding the free space tree without disabling this feature, thus allowing clear_cache mount option to work with block group tree. Now we can mount a filesystem with block-group-tree feature and clear_mount option: $ mkfs.btrfs -O block-group-tree /dev/test/scratch1 -f $ sudo mount /dev/test/scratch1 /mnt/btrfs -o clear_cache $ sudo dmesg -t | head -n 5 BTRFS info (device dm-1): force clearing of disk cache BTRFS info (device dm-1): using free space tree BTRFS info (device dm-1): auto enabling async discard BTRFS info (device dm-1): rebuilding free space tree BTRFS info (device dm-1): checking UUID tree CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit c83b56d1dd87cf67492bb770c26d6f87aee70ed6 Author: Christoph Hellwig Date: Mon May 8 07:58:37 2023 -0700 btrfs: zero the buffer before marking it dirty in btrfs_redirty_list_add btrfs_redirty_list_add zeroes the buffer data and sets the EXTENT_BUFFER_NO_CHECK to make sure writeback is fine with a bogus header. But it does that after already marking the buffer dirty, which means that writeback could already be looking at the buffer. Switch the order of operations around so that the buffer is only marked dirty when we're ready to write it. Fixes: d3575156f662 ("btrfs: zoned: redirty released extent buffers") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 02ca9e6fb5f66a031df4fac508b8e477ca69e918 Author: Naohiro Aota Date: Tue May 9 18:29:15 2023 +0000 btrfs: zoned: fix full zone super block reading on ZNS When both of the superblock zones are full, we need to check which superblock is newer. The calculation of last superblock position is wrong as it does not consider zone_capacity and uses the length. Fixes: 9658b72ef300 ("btrfs: zoned: locate superblock position using zone capacity") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit f84353c7c20536ea7e01eca79430eccdf3cc7348 Author: Naohiro Aota Date: Mon May 8 22:14:20 2023 +0000 btrfs: zoned: zone finish data relocation BG with last IO For data block groups, we zone finish a zone (or, just deactivate it) when seeing the last IO in btrfs_finish_ordered_io(). That is only called for IOs using ZONE_APPEND, but we use a regular WRITE command for data relocation IOs. Detect it and call btrfs_zone_finish_endio() properly. Fixes: be1a1d7a5d24 ("btrfs: zoned: finish fully written block group") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit cdc2e28e214fe9315cdd7e069c1c8e2428f93427 Author: Colin Foster Date: Tue May 9 21:48:51 2023 -0700 net: mscc: ocelot: fix stat counter register values Commit d4c367650704 ("net: mscc: ocelot: keep ocelot_stat_layout by reg address, not offset") organized the stats counters for Ocelot chips, namely the VSC7512 and VSC7514. A few of the counter offsets were incorrect, and were caught by this warning: WARNING: CPU: 0 PID: 24 at drivers/net/ethernet/mscc/ocelot_stats.c:909 ocelot_stats_init+0x1fc/0x2d8 reg 0x5000078 had address 0x220 but reg 0x5000079 has address 0x214, bulking broken! Fix these register offsets. Fixes: d4c367650704 ("net: mscc: ocelot: keep ocelot_stat_layout by reg address, not offset") Signed-off-by: Colin Foster Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2b951b0efbaa6c805854b60c11f08811054d50cd Author: Ard Biesheuvel Date: Mon May 8 13:40:19 2023 +0100 ARM: 9297/1: vfp: avoid unbalanced stack on 'success' return path Commit c76c6c4ecbec0deb5 ("ARM: 9294/2: vfp: Fix broken softirq handling with instrumentation enabled") updated the VFP exception entry logic to go via a C function, so that we get the compiler's version of local_bh_disable(), which may be instrumented, and isn't generally callable from assembler. However, this assumes that passing an alternative 'success' return address works in C as it does in asm, and this is only the case if the C calls in question are tail calls, as otherwise, the stack will need some unwinding as well. I have already sent patches to the list that replace most of the asm logic with C code, and so it is preferable to have a minimal fix that addresses the issue and can be backported along with the commit that it fixes to v6.3 from v6.4. Hopefully, we can land the C conversion for v6.5. So instead of passing the 'success' return address as a function argument, pass the stack address from where to pop it so that both LR and SP have the expected value. Fixes: c76c6c4ecbec0deb5 ("ARM: 9294/2: vfp: Fix broken softirq handling with ...") Reported-by: syzbot+d4b00edc2d0c910d4bf4@syzkaller.appspotmail.com Tested-by: syzbot+d4b00edc2d0c910d4bf4@syzkaller.appspotmail.com Reviewed-by: Linus Walleij Tested-by: Andrew Lunn Signed-off-by: Ard Biesheuvel Tested-by: Andre Przywara Signed-off-by: Russell King (Oracle) commit 90cbed5247439a966b645b34eb0a2e037836ea8e Author: t.feng Date: Wed May 10 11:50:44 2023 +0800 ipvlan:Fix out-of-bounds caused by unclear skb->cb If skb enqueue the qdisc, fq_skb_cb(skb)->time_to_send is changed which is actually skb->cb, and IPCB(skb_in)->opt will be used in __ip_options_echo. It is possible that memcpy is out of bounds and lead to stack overflow. We should clear skb->cb before ip_local_out or ip6_local_out. v2: 1. clean the stack info 2. use IPCB/IP6CB instead of skb->cb crash on stable-5.10(reproduce in kasan kernel). Stack info: [ 2203.651571] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0x589/0x800 [ 2203.653327] Write of size 4 at addr ffff88811a388f27 by task swapper/3/0 [ 2203.655460] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 5.10.0-60.18.0.50.h856.kasan.eulerosv2r11.x86_64 #1 [ 2203.655466] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-20181220_000000-szxrtosci10000 04/01/2014 [ 2203.655475] Call Trace: [ 2203.655481] [ 2203.655501] dump_stack+0x9c/0xd3 [ 2203.655514] print_address_description.constprop.0+0x19/0x170 [ 2203.655530] __kasan_report.cold+0x6c/0x84 [ 2203.655586] kasan_report+0x3a/0x50 [ 2203.655594] check_memory_region+0xfd/0x1f0 [ 2203.655601] memcpy+0x39/0x60 [ 2203.655608] __ip_options_echo+0x589/0x800 [ 2203.655654] __icmp_send+0x59a/0x960 [ 2203.655755] nf_send_unreach+0x129/0x3d0 [nf_reject_ipv4] [ 2203.655763] reject_tg+0x77/0x1bf [ipt_REJECT] [ 2203.655772] ipt_do_table+0x691/0xa40 [ip_tables] [ 2203.655821] nf_hook_slow+0x69/0x100 [ 2203.655828] __ip_local_out+0x21e/0x2b0 [ 2203.655857] ip_local_out+0x28/0x90 [ 2203.655868] ipvlan_process_v4_outbound+0x21e/0x260 [ipvlan] [ 2203.655931] ipvlan_xmit_mode_l3+0x3bd/0x400 [ipvlan] [ 2203.655967] ipvlan_queue_xmit+0xb3/0x190 [ipvlan] [ 2203.655977] ipvlan_start_xmit+0x2e/0xb0 [ipvlan] [ 2203.655984] xmit_one.constprop.0+0xe1/0x280 [ 2203.655992] dev_hard_start_xmit+0x62/0x100 [ 2203.656000] sch_direct_xmit+0x215/0x640 [ 2203.656028] __qdisc_run+0x153/0x1f0 [ 2203.656069] __dev_queue_xmit+0x77f/0x1030 [ 2203.656173] ip_finish_output2+0x59b/0xc20 [ 2203.656244] __ip_finish_output.part.0+0x318/0x3d0 [ 2203.656312] ip_finish_output+0x168/0x190 [ 2203.656320] ip_output+0x12d/0x220 [ 2203.656357] __ip_queue_xmit+0x392/0x880 [ 2203.656380] __tcp_transmit_skb+0x1088/0x11c0 [ 2203.656436] __tcp_retransmit_skb+0x475/0xa30 [ 2203.656505] tcp_retransmit_skb+0x2d/0x190 [ 2203.656512] tcp_retransmit_timer+0x3af/0x9a0 [ 2203.656519] tcp_write_timer_handler+0x3ba/0x510 [ 2203.656529] tcp_write_timer+0x55/0x180 [ 2203.656542] call_timer_fn+0x3f/0x1d0 [ 2203.656555] expire_timers+0x160/0x200 [ 2203.656562] run_timer_softirq+0x1f4/0x480 [ 2203.656606] __do_softirq+0xfd/0x402 [ 2203.656613] asm_call_irq_on_stack+0x12/0x20 [ 2203.656617] [ 2203.656623] do_softirq_own_stack+0x37/0x50 [ 2203.656631] irq_exit_rcu+0x134/0x1a0 [ 2203.656639] sysvec_apic_timer_interrupt+0x36/0x80 [ 2203.656646] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 2203.656654] RIP: 0010:default_idle+0x13/0x20 [ 2203.656663] Code: 89 f0 5d 41 5c 41 5d 41 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 0f 1f 44 00 00 0f 1f 44 00 00 0f 00 2d 9f 32 57 00 fb f4 cc cc cc cc 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 be 08 [ 2203.656668] RSP: 0018:ffff88810036fe78 EFLAGS: 00000256 [ 2203.656676] RAX: ffffffffaf2a87f0 RBX: ffff888100360000 RCX: ffffffffaf290191 [ 2203.656681] RDX: 0000000000098b5e RSI: 0000000000000004 RDI: ffff88811a3c4f60 [ 2203.656686] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff88811a3c4f63 [ 2203.656690] R10: ffffed10234789ec R11: 0000000000000001 R12: 0000000000000003 [ 2203.656695] R13: ffff888100360000 R14: 0000000000000000 R15: 0000000000000000 [ 2203.656729] default_idle_call+0x5a/0x150 [ 2203.656735] cpuidle_idle_call+0x1c6/0x220 [ 2203.656780] do_idle+0xab/0x100 [ 2203.656786] cpu_startup_entry+0x19/0x20 [ 2203.656793] secondary_startup_64_no_verify+0xc2/0xcb [ 2203.657409] The buggy address belongs to the page: [ 2203.658648] page:0000000027a9842f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a388 [ 2203.658665] flags: 0x17ffffc0001000(reserved|node=0|zone=2|lastcpupid=0x1fffff) [ 2203.658675] raw: 0017ffffc0001000 ffffea000468e208 ffffea000468e208 0000000000000000 [ 2203.658682] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 2203.658686] page dumped because: kasan: bad access detected To reproduce(ipvlan with IPVLAN_MODE_L3): Env setting: ======================================================= modprobe ipvlan ipvlan_default_mode=1 sysctl net.ipv4.conf.eth0.forwarding=1 iptables -t nat -A POSTROUTING -s 20.0.0.0/255.255.255.0 -o eth0 -j MASQUERADE ip link add gw link eth0 type ipvlan ip -4 addr add 20.0.0.254/24 dev gw ip netns add net1 ip link add ipv1 link eth0 type ipvlan ip link set ipv1 netns net1 ip netns exec net1 ip link set ipv1 up ip netns exec net1 ip -4 addr add 20.0.0.4/24 dev ipv1 ip netns exec net1 route add default gw 20.0.0.254 ip netns exec net1 tc qdisc add dev ipv1 root netem loss 10% ifconfig gw up iptables -t filter -A OUTPUT -p tcp --dport 8888 -j REJECT --reject-with icmp-port-unreachable ======================================================= And then excute the shell(curl any address of eth0 can reach): for((i=1;i<=100000;i++)) do ip netns exec net1 curl x.x.x.x:8888 done ======================================================= Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Signed-off-by: "t.feng" Suggested-by: Florian Westphal Reviewed-by: Paolo Abeni Signed-off-by: David S. Miller commit 77c964dad99a182a3df6add8bad73aca1be59890 Author: Randy Dunlap Date: Tue May 9 19:29:14 2023 -0700 docs: networking: fix x25-iface.rst heading & index order Fix the chapter heading for "X.25 Device Driver Interface" so that it does not contain a trailing '-' character, which makes Sphinx omit this heading from the contents. Reverse the order of the x25.rst and x25-iface.rst files in the index so that the project introduction (x25.rst) comes first. Fixes: 883780af7209 ("docs: networking: convert x25-iface.txt to ReST") Signed-off-by: Randy Dunlap Cc: Mauro Carvalho Chehab Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Cc: Martin Schiller Cc: linux-x25@vger.kernel.org Reviewed-by: Bagas Sanjaya Signed-off-by: David S. Miller commit f4c2e67c1773d2a2632381ee30e9139c1e744c16 Author: Ziwei Xiao Date: Tue May 9 15:51:23 2023 -0700 gve: Remove the code of clearing PBA bit Clearing the PBA bit from the driver is race prone and it may lead to dropped interrupt events. This could potentially lead to the traffic being completely halted. Fixes: 5e8c5adf95f8 ("gve: DQO: Add core netdev features") Signed-off-by: Ziwei Xiao Signed-off-by: Bailey Forrest Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit e14cadfd80d76f01bfaa1a8d745b1db19b57d6be Author: Eric Dumazet Date: Tue May 9 20:36:56 2023 +0000 tcp: add annotations around sk->sk_shutdown accesses Now sk->sk_shutdown is no longer a bitfield, we can add standard READ_ONCE()/WRITE_ONCE() annotations to silence KCSAN reports like the following: BUG: KCSAN: data-race in tcp_disconnect / tcp_poll write to 0xffff88814588582c of 1 bytes by task 3404 on cpu 1: tcp_disconnect+0x4d6/0xdb0 net/ipv4/tcp.c:3121 __inet_stream_connect+0x5dd/0x6e0 net/ipv4/af_inet.c:715 inet_stream_connect+0x48/0x70 net/ipv4/af_inet.c:727 __sys_connect_file net/socket.c:2001 [inline] __sys_connect+0x19b/0x1b0 net/socket.c:2018 __do_sys_connect net/socket.c:2028 [inline] __se_sys_connect net/socket.c:2025 [inline] __x64_sys_connect+0x41/0x50 net/socket.c:2025 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88814588582c of 1 bytes by task 3374 on cpu 0: tcp_poll+0x2e6/0x7d0 net/ipv4/tcp.c:562 sock_poll+0x253/0x270 net/socket.c:1383 vfs_poll include/linux/poll.h:88 [inline] io_poll_check_events io_uring/poll.c:281 [inline] io_poll_task_func+0x15a/0x820 io_uring/poll.c:333 handle_tw_list io_uring/io_uring.c:1184 [inline] tctx_task_work+0x1fe/0x4d0 io_uring/io_uring.c:1246 task_work_run+0x123/0x160 kernel/task_work.c:179 get_signal+0xe64/0xff0 kernel/signal.c:2635 arch_do_signal_or_restart+0x89/0x2a0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop+0x6f/0xe0 kernel/entry/common.c:168 exit_to_user_mode_prepare+0x6c/0xb0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:297 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x03 -> 0x00 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 4063384ef762cc5946fc7a3f89879e76c6ec51e2 Author: Eric Dumazet Date: Tue May 9 13:18:57 2023 +0000 net: add vlan_get_protocol_and_depth() helper Before blamed commit, pskb_may_pull() was used instead of skb_header_pointer() in __vlan_get_protocol() and friends. Few callers depended on skb->head being populated with MAC header, syzbot caught one of them (skb_mac_gso_segment()) Add vlan_get_protocol_and_depth() to make the intent clearer and use it where sensible. This is a more generic fix than commit e9d3f80935b6 ("net/af_packet: make sure to pull mac header") which was dealing with a similar issue. kernel BUG at include/linux/skbuff.h:2655 ! invalid opcode: 0000 [#1] SMP KASAN CPU: 0 PID: 1441 Comm: syz-executor199 Not tainted 6.1.24-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:__skb_pull include/linux/skbuff.h:2655 [inline] RIP: 0010:skb_mac_gso_segment+0x68f/0x6a0 net/core/gro.c:136 Code: fd 48 8b 5c 24 10 44 89 6b 70 48 c7 c7 c0 ae 0d 86 44 89 e6 e8 a1 91 d0 00 48 c7 c7 00 af 0d 86 48 89 de 31 d2 e8 d1 4a e9 ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 RSP: 0018:ffffc90001bd7520 EFLAGS: 00010286 RAX: ffffffff8469736a RBX: ffff88810f31dac0 RCX: ffff888115a18b00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90001bd75e8 R08: ffffffff84697183 R09: fffff5200037adf9 R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000012 R13: 000000000000fee5 R14: 0000000000005865 R15: 000000000000fed7 FS: 000055555633f300(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 0000000116fea000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [] __skb_gso_segment+0x32d/0x4c0 net/core/dev.c:3419 [] skb_gso_segment include/linux/netdevice.h:4819 [inline] [] validate_xmit_skb+0x3aa/0xee0 net/core/dev.c:3725 [] __dev_queue_xmit+0x1332/0x3300 net/core/dev.c:4313 [] dev_queue_xmit+0x17/0x20 include/linux/netdevice.h:3029 [] packet_snd net/packet/af_packet.c:3111 [inline] [] packet_sendmsg+0x49d2/0x6470 net/packet/af_packet.c:3142 [] sock_sendmsg_nosec net/socket.c:716 [inline] [] sock_sendmsg net/socket.c:736 [inline] [] __sys_sendto+0x472/0x5f0 net/socket.c:2139 [] __do_sys_sendto net/socket.c:2151 [inline] [] __se_sys_sendto net/socket.c:2147 [inline] [] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 469aceddfa3e ("vlan: consolidate VLAN parsing code and limit max parsing depth") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Toke Høiland-Jørgensen Cc: Willem de Bruijn Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 43fb622d91a9f408322735d2f736495c1009f575 Author: Russell King (Oracle) Date: Tue May 9 12:50:04 2023 +0100 net: pcs: xpcs: fix incorrect number of interfaces In synopsys_xpcs_compat[], the DW_XPCS_2500BASEX entry was setting the number of interfaces using the xpcs_2500basex_features array rather than xpcs_2500basex_interfaces. This causes us to overflow the array of interfaces. Fix this. Fixes: f27abde3042a ("net: pcs: add 2500BASEX support for Intel mGbE controller") Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit d0ac89f6f9879fae316c155de77b5173b3e2c9c9 Author: Eric Dumazet Date: Tue May 9 18:29:48 2023 +0000 net: deal with most data-races in sk_wait_event() __condition is evaluated twice in sk_wait_event() macro. First invocation is lockless, and reads can race with writes, as spotted by syzbot. BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1: tcp_disconnect+0x2cd/0xdb0 inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911 __sys_shutdown_sock net/socket.c:2343 [inline] __sys_shutdown net/socket.c:2355 [inline] __do_sys_shutdown net/socket.c:2363 [inline] __se_sys_shutdown+0xf8/0x140 net/socket.c:2361 __x64_sys_shutdown+0x31/0x40 net/socket.c:2361 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0: sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75 tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266 tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484 inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] __sys_sendto+0x246/0x300 net/socket.c:2142 __do_sys_sendto net/socket.c:2154 [inline] __se_sys_sendto net/socket.c:2150 [inline] __x64_sys_sendto+0x78/0x90 net/socket.c:2150 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 -> 0x00000068 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit e05a5f510f26607616fecdd4ac136310c8bea56b Author: Eric Dumazet Date: Tue May 9 16:35:53 2023 +0000 net: annotate sk->sk_err write from do_recvmmsg() do_recvmmsg() can write to sk->sk_err from multiple threads. As said before, many other points reading or writing sk_err need annotations. Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path") Signed-off-by: Eric Dumazet Reported-by: syzbot Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit a939d14919b799e6fff8a9c80296ca229ba2f8a4 Author: Eric Dumazet Date: Tue May 9 16:56:34 2023 +0000 netlink: annotate accesses to nlk->cb_running Both netlink_recvmsg() and netlink_native_seq_show() read nlk->cb_running locklessly. Use READ_ONCE() there. Add corresponding WRITE_ONCE() to netlink_dump() and __netlink_dump_start() syzbot reported: BUG: KCSAN: data-race in __netlink_dump_start / netlink_recvmsg write to 0xffff88813ea4db59 of 1 bytes by task 28219 on cpu 0: __netlink_dump_start+0x3af/0x4d0 net/netlink/af_netlink.c:2399 netlink_dump_start include/linux/netlink.h:308 [inline] rtnetlink_rcv_msg+0x70f/0x8c0 net/core/rtnetlink.c:6130 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2577 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6192 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] sock_write_iter+0x1aa/0x230 net/socket.c:1138 call_write_iter include/linux/fs.h:1851 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x463/0x760 fs/read_write.c:584 ksys_write+0xeb/0x1a0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x42/0x50 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88813ea4db59 of 1 bytes by task 28222 on cpu 1: netlink_recvmsg+0x3b4/0x730 net/netlink/af_netlink.c:2022 sock_recvmsg_nosec+0x4c/0x80 net/socket.c:1017 ____sys_recvmsg+0x2db/0x310 net/socket.c:2718 ___sys_recvmsg net/socket.c:2762 [inline] do_recvmmsg+0x2e5/0x710 net/socket.c:2856 __sys_recvmmsg net/socket.c:2935 [inline] __do_sys_recvmmsg net/socket.c:2958 [inline] __se_sys_recvmmsg net/socket.c:2951 [inline] __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00 -> 0x01 Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit a5b3363d8cec749fbdfe96bde7edbe19eeaefeb1 Merge: 7c83e28f10830 6cbe791c0f4ed Author: David S. Miller Date: Wed May 10 09:27:21 2023 +0100 Merge branch 'bonding-overflow' Hangbin Liu says: ==================== bonding: fix send_peer_notif overflow Bonding send_peer_notif was defined as u8. But the value is num_peer_notif multiplied by peer_notif_delay, which is u8 * u32. This would cause the send_peer_notif overflow. Before the fix: TEST: num_grat_arp (active-backup miimon num_grat_arp 10) [ OK ] TEST: num_grat_arp (active-backup miimon num_grat_arp 20) [ OK ] 4 garp packets sent on active slave eth1 TEST: num_grat_arp (active-backup miimon num_grat_arp 30) [FAIL] 24 garp packets sent on active slave eth1 TEST: num_grat_arp (active-backup miimon num_grat_arp 50) [FAIL] After the fix: TEST: num_grat_arp (active-backup miimon num_grat_arp 10) [ OK ] TEST: num_grat_arp (active-backup miimon num_grat_arp 20) [ OK ] TEST: num_grat_arp (active-backup miimon num_grat_arp 30) [ OK ] TEST: num_grat_arp (active-backup miimon num_grat_arp 50) [ OK ] ==================== Signed-off-by: David S. Miller commit 6cbe791c0f4ed7310db212791e69c7ffedd4f4b6 Author: Hangbin Liu Date: Tue May 9 11:12:00 2023 +0800 kselftest: bonding: add num_grat_arp test TEST: num_grat_arp (active-backup miimon num_grat_arp 10) [ OK ] TEST: num_grat_arp (active-backup miimon num_grat_arp 20) [ OK ] TEST: num_grat_arp (active-backup miimon num_grat_arp 30) [ OK ] TEST: num_grat_arp (active-backup miimon num_grat_arp 50) [ OK ] Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit b6d1599f8c282bfbc4d291af750436d93005b9ea Author: Hangbin Liu Date: Tue May 9 11:11:59 2023 +0800 selftests: forwarding: lib: add netns support for tc rule handle stats get When run the test in netns, it's not easy to get the tc stats via tc_rule_handle_stats_get(). With the new netns parameter, we can get stats from specific netns like num=$(tc_rule_handle_stats_get "dev eth0 ingress" 101 ".packets" "-n ns") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 84df83e0ecd3beba62c3d06b43ab51cc47efaca0 Author: Hangbin Liu Date: Tue May 9 11:11:58 2023 +0800 Documentation: bonding: fix the doc of peer_notif_delay Bonding only supports setting peer_notif_delay with miimon set. Fixes: 0307d589c4d6 ("bonding: add documentation for peer_notif_delay") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 9949e2efb54eb3001cb2f6512ff3166dddbfb75d Author: Hangbin Liu Date: Tue May 9 11:11:57 2023 +0800 bonding: fix send_peer_notif overflow Bonding send_peer_notif was defined as u8. Since commit 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications"). the bond->send_peer_notif will be num_peer_notif multiplied by peer_notif_delay, which is u8 * u32. This would cause the send_peer_notif overflow easily. e.g. ip link add bond0 type bond mode 1 miimon 100 num_grat_arp 30 peer_notify_delay 1000 To fix the overflow, let's set the send_peer_notif to u32 and limit peer_notif_delay to 300s. Reported-by: Liang Li Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2090053 Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 7c83e28f10830aa5105c25eaabe890e3adac36aa Author: Daniel Golle Date: Tue May 9 03:20:06 2023 +0200 net: ethernet: mtk_eth_soc: fix NULL pointer dereference Check for NULL pointer to avoid kernel crashing in case of missing WO firmware in case only a single WEDv2 device has been initialized, e.g. on MT7981 which can connect just one wireless frontend. Fixes: 86ce0d09e424 ("net: ethernet: mtk_eth_soc: use WO firmware for MT7981") Signed-off-by: Daniel Golle Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 3acf8f6c14d0e42b889738d63b6d9cb63348fc94 Author: Florian Westphal Date: Tue May 9 16:47:24 2023 +0200 selftests: nft_flowtable.sh: check ingress/egress chain too Make sure flowtable interacts correctly with ingress and egress chains, i.e. those get handled before and after flow table respectively. Adds three more tests: 1. repeat flowtable test, but with 'ip dscp set cs3' done in inet forward chain. Expect that some packets have been mangled (before flowtable offload became effective) while some pass without mangling (after offload succeeds). 2. repeat flowtable test, but with 'ip dscp set cs3' done in veth0:ingress. Expect that all packets pass with cs3 dscp field. 3. same as 2, but use veth1:egress. Expect the same outcome. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 90ab51226d52ad61e5ff175b572e08046b1b0a99 Author: Boris Sukholitko Date: Thu May 4 11:48:14 2023 +0300 selftests: nft_flowtable.sh: monitor result file sizes When running nft_flowtable.sh in VM on a busy server we've found that the time of the netcat file transfers vary wildly. Therefore replace hardcoded 3 second sleep with the loop checking for a change in the file sizes. Once no change in detected we test the results. Nice side effect is that we shave 1 second sleep in the fast case (hard-coded 3 second sleep vs two 1 second sleeps). Acked-by: Florian Westphal Signed-off-by: Boris Sukholitko Signed-off-by: Pablo Neira Ayuso commit 1114803c2da974526ecbc0bd81e6c637bf257de5 Author: Boris Sukholitko Date: Thu May 4 11:48:13 2023 +0300 selftests: nft_flowtable.sh: wait for specific nc pids Doing wait with no parameters may interfere with some of the tests having their own background processes. Although no such test is currently present, the cleanup is useful to rely on the nft_flowtable.sh for local development (e.g. running background tcpdump command during the tests). Signed-off-by: Boris Sukholitko Signed-off-by: Pablo Neira Ayuso commit 0749d670d758099970c52ef70f4bbcfa5a15b3d3 Author: Boris Sukholitko Date: Thu May 4 11:48:12 2023 +0300 selftests: nft_flowtable.sh: no need for ps -x option Some ps commands (e.g. busybox derived) have no -x option. For the purposes of hash calculation of the list of processes this option is inessential. Signed-off-by: Boris Sukholitko Signed-off-by: Pablo Neira Ayuso commit 0a11073e8e3362d715255d28d294aa7350c1c01f Author: Boris Sukholitko Date: Thu May 4 11:48:11 2023 +0300 selftests: nft_flowtable.sh: use /proc for pid checking Some ps commands (e.g. busybox derived) have no -p option. Use /proc for pid existence check. Signed-off-by: Boris Sukholitko Signed-off-by: Pablo Neira Ayuso commit e72eeab542dbf4f544e389e64fa13b82a1b6d003 Author: Florian Westphal Date: Thu May 4 14:55:02 2023 +0200 netfilter: conntrack: fix possible bug_on with enable_hooks=1 I received a bug report (no reproducer so far) where we trip over 712 rcu_read_lock(); 713 ct_hook = rcu_dereference(nf_ct_hook); 714 BUG_ON(ct_hook == NULL); // here In nf_conntrack_destroy(). First turn this BUG_ON into a WARN. I think it was triggered via enable_hooks=1 flag. When this flag is turned on, the conntrack hooks are registered before nf_ct_hook pointer gets assigned. This opens a short window where packets enter the conntrack machinery, can have skb->_nfct set up and a subsequent kfree_skb might occur before nf_ct_hook is set. Call nf_conntrack_init_end() to set nf_ct_hook before we register the pernet ops. Fixes: ba3fbe663635 ("netfilter: nf_conntrack: provide modparam to always register conntrack hooks") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit dc1c9fd4a8bbe1e06add9053010b652449bfe411 Author: Florian Westphal Date: Thu May 4 14:20:21 2023 +0200 netfilter: nf_tables: always release netdev hooks from notifier This reverts "netfilter: nf_tables: skip netdev events generated on netns removal". The problem is that when a veth device is released, the veth release callback will also queue the peer netns device for removal. Its possible that the peer netns is also slated for removal. In this case, the device memory is already released before the pre_exit hook of the peer netns runs: BUG: KASAN: slab-use-after-free in nf_hook_entry_head+0x1b8/0x1d0 Read of size 8 at addr ffff88812c0124f0 by task kworker/u8:1/45 Workqueue: netns cleanup_net Call Trace: nf_hook_entry_head+0x1b8/0x1d0 __nf_unregister_net_hook+0x76/0x510 nft_netdev_unregister_hooks+0xa0/0x220 __nft_release_hook+0x184/0x490 nf_tables_pre_exit_net+0x12f/0x1b0 .. Order is: 1. First netns is released, veth_dellink() queues peer netns device for removal 2. peer netns is queued for removal 3. peer netns device is released, unreg event is triggered 4. unreg event is ignored because netns is going down 5. pre_exit hook calls nft_netdev_unregister_hooks but device memory might be free'd already. Fixes: 68a3765c659f ("netfilter: nf_tables: skip netdev events generated on netns removal") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8680407b6f8f5fba59e8f1d63c869abc280f04df Author: Benedict Wong Date: Wed May 10 01:14:14 2023 +0000 xfrm: Check if_id in inbound policy/secpath match This change ensures that if configured in the policy, the if_id set in the policy and secpath states match during the inbound policy check. Without this, there is potential for ambiguity where entries in the secpath differing by only the if_id could be mismatched. Notably, this is checked in the outbound direction when resolving templates to SAs, but not on the inbound path when matching SAs and policies. Test: Tested against Android kernel unit tests & CTS Signed-off-by: Benedict Wong Signed-off-by: Steffen Klassert commit cf3128a7aca55b2eefb68281d44749c683bdc96f Author: Tobias Brunner Date: Tue May 9 11:00:06 2023 +0200 af_key: Reject optional tunnel/BEET mode templates in outbound policies xfrm_state_find() uses `encap_family` of the current template with the passed local and remote addresses to find a matching state. If an optional tunnel or BEET mode template is skipped in a mixed-family scenario, there could be a mismatch causing an out-of-bounds read as the addresses were not replaced to match the family of the next template. While there are theoretical use cases for optional templates in outbound policies, the only practical one is to skip IPComp states in inbound policies if uncompressed packets are received that are handled by an implicitly created IPIP state instead. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Tobias Brunner Acked-by: Herbert Xu Signed-off-by: Steffen Klassert commit 3d776e31c841ba2f69895d2255a49320bec7cea6 Author: Tobias Brunner Date: Tue May 9 10:59:58 2023 +0200 xfrm: Reject optional tunnel/BEET mode templates in outbound policies xfrm_state_find() uses `encap_family` of the current template with the passed local and remote addresses to find a matching state. If an optional tunnel or BEET mode template is skipped in a mixed-family scenario, there could be a mismatch causing an out-of-bounds read as the addresses were not replaced to match the family of the next template. While there are theoretical use cases for optional templates in outbound policies, the only practical one is to skip IPComp states in inbound policies if uncompressed packets are received that are handled by an implicitly created IPIP state instead. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Tobias Brunner Acked-by: Herbert Xu Signed-off-by: Steffen Klassert commit 582dbb2cc1a0a7427840f5b1e3c65608e511b061 Author: Florian Fainelli Date: Mon May 8 16:17:49 2023 -0700 net: phy: bcm7xx: Correct read from expansion register Since the driver works in the "legacy" addressing mode, we need to write to the expansion register (0x17) with bits 11:8 set to 0xf to properly select the expansion register passed as argument. Fixes: f68d08c437f9 ("net: phy: bcm7xxx: Add EPHY entry for 72165") Signed-off-by: Florian Fainelli Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230508231749.1681169-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski commit dfd9248c071a3710c24365897459538551cb7167 Author: Kuniyuki Iwashima Date: Mon May 8 10:55:43 2023 -0700 net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). KCSAN found a data race in sock_recv_cmsgs() where the read access to sk->sk_stamp needs READ_ONCE(). BUG: KCSAN: data-race in packet_recvmsg / packet_recvmsg write (marked) to 0xffff88803c81f258 of 8 bytes by task 19171 on cpu 0: sock_write_timestamp include/net/sock.h:2670 [inline] sock_recv_cmsgs include/net/sock.h:2722 [inline] packet_recvmsg+0xb97/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff88803c81f258 of 8 bytes by task 19183 on cpu 1: sock_recv_cmsgs include/net/sock.h:2721 [inline] packet_recvmsg+0xb64/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0xffffffffc4653600 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19183 Comm: syz-executor.5 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Fixes: 6c7c98bad488 ("sock: avoid dirtying sk_stamp, if possible") Reported-by: syzbot Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230508175543.55756-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 8efbdbfa99381a017dd2c0f6375a7d80a8118b74 Author: Marek Vasut Date: Sun May 7 01:58:45 2023 +0200 net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register Initialize MAC_ONEUS_TIC_COUNTER register with correct value derived from CSR clock, otherwise EEE is unstable on at least NXP i.MX8M Plus and Micrel KSZ9131RNX PHY, to the point where not even ARP request can be sent out. i.MX 8M Plus Applications Processor Reference Manual, Rev. 1, 06/2021 11.7.6.1.34 One-microsecond Reference Timer (MAC_ONEUS_TIC_COUNTER) defines this register as: " This register controls the generation of the Reference time (1 microsecond tic) for all the LPI timers. This timer has to be programmed by the software initially. ... The application must program this counter so that the number of clock cycles of CSR clock is 1us. (Subtract 1 from the value before programming). For example if the CSR clock is 100MHz then this field needs to be programmed to value 100 - 1 = 99 (which is 0x63). This is required to generate the 1US events that are used to update some of the EEE related counters. " The reset value is 0x63 on i.MX8M Plus, which means expected CSR clock are 100 MHz. However, the i.MX8M Plus "enet_qos_root_clk" are 266 MHz instead, which means the LPI timers reach their count much sooner on this platform. This is visible using a scope by monitoring e.g. exit from LPI mode on TX_CTL line from MAC to PHY. This should take 30us per STMMAC_DEFAULT_TWT_LS setting, during which the TX_CTL line transitions from tristate to low, and 30 us later from low to high. On i.MX8M Plus, this transition takes 11 us, which matches the 30us * 100/266 formula for misconfigured MAC_ONEUS_TIC_COUNTER register. Configure MAC_ONEUS_TIC_COUNTER based on CSR clock, so that the LPI timers have correct 1us reference. This then fixes EEE on i.MX8M Plus with Micrel KSZ9131RNX PHY. Fixes: 477286b53f55 ("stmmac: add GMAC4 core support") Signed-off-by: Marek Vasut Tested-by: Harald Seiler Reviewed-by: Francesco Dolcini Tested-by: Francesco Dolcini # Toradex Verdin iMX8MP Reviewed-by: Jesse Brandeburg Link: https://lore.kernel.org/r/20230506235845.246105-1-marex@denx.de Signed-off-by: Jakub Kicinski commit 3b90b09af5be42491a8a74a549318cfa265b3029 Author: Alexandre Ghiti Date: Thu May 4 14:07:59 2023 +0200 riscv: Fix orphan section warnings caused by kernel/pi kernel/pi gives rise to a lot of new sections that end up orphans: the first attempt to fix that tried to enumerate them all in the linker script, but kernel test robot with a random config keeps finding more of them. So prefix all those sections with .init.pi instead of only .init in order to be able to easily catch them all in the linker script. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304301606.Cgp113Ha-lkp@intel.com/ Fixes: 26e7aacb83df ("riscv: Allow to downgrade paging mode from the command line") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230504120759.18730-1-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 73a23d7710331a530e972903318528b75e5a5f58 Author: Johannes Berg Date: Tue Apr 25 10:38:37 2023 +0200 um: harddog: fix modular build Since we no longer (want to) export any libc symbols the _user portions of any drivers need to be built into image rather than the module. I missed this for the watchdog. Fix the watchdog accordingly. Reported-by: kernel test robot Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 0cad8f14d70cfeb5173dce93cafeba665a95430e Author: Filipe Manana Date: Tue May 9 12:50:02 2023 +0100 btrfs: fix backref walking not returning all inode refs When using the logical to ino ioctl v2, if the flag to ignore offsets of file extent items (BTRFS_LOGICAL_INO_ARGS_IGNORE_OFFSET) is given, the backref walking code ends up not returning references for all file offsets of an inode that point to the given logical bytenr. This happens since kernel 6.2, commit 6ce6ba534418 ("btrfs: use a single argument for extent offset in backref walking functions") because: 1) It mistakenly skipped the search for file extent items in a leaf that point to the target extent if that flag is given. Instead it should only skip the filtering done by check_extent_in_eb() - that is, it should not avoid the calls to that function (or find_extent_in_eb(), which uses it). 2) It was also not building a list of inode extent elements (struct extent_inode_elem) if we have multiple inode references for an extent when the ignore offset flag is given to the logical to ino ioctl - it would leave a single element, only the last one that was found. These stem from the confusing old interface for backref walking functions where we had an extent item offset argument that was a pointer to a u64 and another boolean argument that indicated if the offset should be ignored, but the pointer could be NULL. That NULL case is used by relocation, qgroup extent accounting and fiemap, simply to avoid building the inode extent list for each reference, as it's not necessary for those use cases and therefore avoids memory allocations and some computations. Fix this by adding a boolean argument to the backref walk context structure to indicate that the inode extent list should not be built, make relocation set that argument to true and fix the backref walking logic to skip the calls to check_extent_in_eb() and find_extent_in_eb() only if this new argument is true, instead of 'ignore_extent_item_pos' being true. A test case for fstests will be added soon, to provide cover not only for these cases but to the logical to ino ioctl in general as well, as currently we do not have a test case for it. Reported-by: Vladimir Panteleev Link: https://lore.kernel.org/linux-btrfs/CAHhfkvwo=nmzrJSqZ2qMfF-rZB-ab6ahHnCD_sq9h4o8v+M7QQ@mail.gmail.com/ Fixes: 6ce6ba534418 ("btrfs: use a single argument for extent offset in backref walking functions") CC: stable@vger.kernel.org # 6.2+ Tested-by: Vladimir Panteleev Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 0004ff15ea26015a0a3a6182dca3b9d1df32e2b7 Author: Filipe Manana Date: Thu May 4 12:04:18 2023 +0100 btrfs: fix space cache inconsistency after error loading it from disk When loading a free space cache from disk, at __load_free_space_cache(), if we fail to insert a bitmap entry, we still increment the number of total bitmaps in the btrfs_free_space_ctl structure, which is incorrect since we failed to add the bitmap entry. On error we then empty the cache by calling __btrfs_remove_free_space_cache(), which will result in getting the total bitmaps counter set to 1. A failure to load a free space cache is not critical, so if a failure happens we just rebuild the cache by scanning the extent tree, which happens at block-group.c:caching_thread(). Yet the failure will result in having the total bitmaps of the btrfs_free_space_ctl always bigger by 1 then the number of bitmap entries we have. So fix this by having the total bitmaps counter be incremented only if we successfully added the bitmap entry. Fixes: a67509c30079 ("Btrfs: add a io_ctl struct and helpers for dealing with the space cache") Reviewed-by: Anand Jain CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c87f318e6f47696b4040b58f460d5c17ea0280e6 Author: Anastasia Belova Date: Wed Apr 26 14:53:23 2023 +0300 btrfs: print-tree: parent bytenr must be aligned to sector size Check nodesize to sectorsize in alignment check in print_extent_item. The comment states that and this is correct, similar check is done elsewhere in the functions. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ea57788eb76d ("btrfs: require only sector size alignment for parent eb bytenr") CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Qu Wenruo Signed-off-by: Anastasia Belova Reviewed-by: David Sterba Signed-off-by: David Sterba commit 16a8829130ca22666ac6236178a6233208d425c3 Author: Linus Torvalds Date: Tue May 9 10:22:13 2023 -0700 nfs: fix another case of NULL/IS_ERR confusion wrt folio pointers Dan has been improving on the smatch error pointer checks, and pointed at another case where the __filemap_get_folio() conversion to error pointers had been overlooked. This time because it was hidden behind the filemap_grab_folio() helper function that is a wrapper around it. Reported-by: Dan Carpenter Cc: Anna Schumaker Cc: Matthew Wilcox Cc: Christoph Hellwig Signed-off-by: Linus Torvalds commit 1dc3731daf1f350cfd631b5559aac865ab2fbb4c Merge: ba0ad6ed89fd5 d246331b78cbe Author: Linus Torvalds Date: Tue May 9 09:53:41 2023 -0700 Merge tag 'for-6.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix backward leaf iteration which could possibly return the same key - fix assertion when device add and balance race for exclusive operation - fix regression when freeing device, state tree would leak after device replace - fix attempt to clear space cache v1 when block-group-tree is enabled - fix potential i_size corruption when encoded write races with send v2 and enabled no-holes (the race is hard to hit though, the window is a few instructions wide) - fix wrong bitmap API use when checking empty zones, parameters were swapped but not causing a bug due to other code - prevent potential qgroup leak if subvolume create does not commit transaction (which is pending in the development queue) - error handling and reporting: - abort transaction when sibling keys check fails for leaves - print extent buffers when sibling keys check fails * tag 'for-6.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: don't free qgroup space unless specified btrfs: fix encoded write i_size corruption with no-holes btrfs: zoned: fix wrong use of bitops API in btrfs_ensure_empty_zones btrfs: properly reject clear_cache and v1 cache for block-group-tree btrfs: print extent buffers when sibling keys check fails btrfs: abort transaction when sibling keys check fails for leaves btrfs: fix leak of source device allocation state after device replace btrfs: fix assertion of exclop condition when starting balance btrfs: fix btrfs_prev_leaf() to not return the same key twice commit 716a3cf317456fa01d54398bb14ab354f50ed6a2 Author: Steve French Date: Tue May 9 01:37:19 2023 -0500 smb3: fix problem remounting a share after shutdown xfstests generic/392 showed a problem where even after a shutdown call was made on a mount, we would still attempt to use the (now inaccessible) superblock if another mount was attempted for the same share. Reported-by: David Howells Reviewed-by: David Howells Cc: Fixes: 087f757b0129 ("cifs: add shutdown support") Signed-off-by: Steve French commit 2cb6f968775a9fd60c90a6042b9550bcec3ea087 Author: Steve French Date: Tue May 9 01:00:42 2023 -0500 SMB3: force unmount was failing to close deferred close files In investigating a failure with xfstest generic/392 it was noticed that mounts were reusing a superblock that should already have been freed. This turned out to be related to deferred close files keeping a reference count until the closetimeo expired. Currently the only way an fs knows that mount is beginning is when force unmount is called, but when this, ie umount_begin(), is called all deferred close files on the share (tree connection) should be closed immediately (unless shared by another mount) to avoid using excess resources on the server and to avoid reusing a superblock which should already be freed. In umount_begin, close all deferred close handles for that share if this is the last mount using that share on this client (ie send the SMB3 close request over the wire for those that have been already closed by the app but that we have kept a handle lease open for and have not sent closes to the server for yet). Reported-by: David Howells Acked-by: Bharath SM Cc: Fixes: 78c09634f7dc ("Cifs: Fix kernel oops caused by deferred close for files.") Signed-off-by: Steve French commit 293007b033418c8c9d1b35d68dec49a500750fde Author: Jens Axboe Date: Mon May 8 12:13:27 2023 -0600 io_uring: make io_uring_sqe_cmd() unconditionally available If CONFIG_IO_URING isn't set, then io_uring_sqe_cmd() is not defined. As the nvme driver uses this helper, it causes a compilation issue: drivers/nvme/host/ioctl.c: In function 'nvme_uring_cmd_io': drivers/nvme/host/ioctl.c:555:44: error: implicit declaration of function 'io_uring_sqe_cmd'; did you mean 'io_uring_free'? [-Werror=implicit-function-declaration] 555 | const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe); | ^~~~~~~~~~~~~~~~ | io_uring_free Fix it by just making io_uring_sqe_cmd() generally available - the types are known, and there's no reason to hide it under CONFIG_IO_URING. Fixes: fd9b8547bc5c ("io_uring: Pass whole sqe to commands") Reported-by: kernel test robot Reported-by: Chen-Yu Tsai Tested-by: Chen-Yu Tsai Signed-off-by: Jens Axboe commit cc719a9ce7a455bef132e0211437847bcd89b4ef Author: Simon Horman Date: Tue May 9 09:01:50 2023 +0200 parisc: kexec: include reboot.h Include reboot.h in machine_kexec.c for declaration of machine_crash_shutdown and machine_shutdown. gcc-12 with W=1 reports: arch/parisc/kernel/kexec.c:57:6: warning: no previous prototype for 'machine_crash_shutdown' [-Wmissing-prototypes] 57 | void machine_crash_shutdown(struct pt_regs *regs) | ^~~~~~~~~~~~~~~~~~~~~~ arch/parisc/kernel/kexec.c:61:6: warning: no previous prototype for 'machine_shutdown' [-Wmissing-prototypes] 61 | void machine_shutdown(void) | ^~~~~~~~~~~~~~~~ No functional changes intended. Compile tested only. Signed-off-by: Simon Horman Acked-by: Baoquan He Signed-off-by: Helge Deller commit 81dce1490e28439c3cd8a8650b862a712f3061ba Author: Haibo Chen Date: Thu May 4 19:22:22 2023 +0800 mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works After commit 1ed5c3b22fc7 ("mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on 8bit bus"), the property "no-mmc-hs400" from device tree file do not work any more. This patch reorder the code, which can avoid the warning message "drop HS400 support since no 8-bit bus" and also make the property "no-mmc-hs400" from dts file works. Fixes: 1ed5c3b22fc7 ("mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on 8bit bus") Signed-off-by: Haibo Chen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230504112222.3599602-1-haibo.chen@nxp.com Signed-off-by: Ulf Hansson commit 3d43f9f639542fadfb28f40b509bf147a6624d48 Author: Liming Sun Date: Wed Apr 26 10:23:44 2023 -0400 platform/mellanox: fix potential race in mlxbf-tmfifo driver This commit adds memory barrier for the 'vq' update in function mlxbf_tmfifo_virtio_find_vqs() to avoid potential race due to out-of-order memory write. It also adds barrier for the 'is_ready' flag to make sure the initializations are visible before this flag is checked. Signed-off-by: Liming Sun Reviewed-by: Vadim Pasternak Link: https://lore.kernel.org/r/b98c0ab61d644ba38fa9b3fd1607b138b0dd820b.1682518748.git.limings@nvidia.com Signed-off-by: Hans de Goede commit e5bce3c15ad20d7dd4f8393513b1c41373d2dc37 Author: Christophe JAILLET Date: Tue Apr 25 15:41:26 2023 +0200 mmc: sdhci-cadence: Fix an error handling path in sdhci_cdns_probe() If devm_reset_control_get_optional_exclusive() fails, some resources still need to be released. So branch to the error handling path instead of returning directly. Fixes: aad53d4ee756 ("mmc: sdhci-cadence: Support mmc hardware reset") Signed-off-by: Christophe JAILLET Acked-by: Adrian Hunter Acked-by: Brad Larson Link: https://lore.kernel.org/r/f61599a9ef23767c2d66e5af9c975f05ef1cec6b.1682430069.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson commit 003fb0a51162d940f25fc35e70b0996a12c9e08a Author: Christian Loehle Date: Wed Apr 26 16:59:39 2023 +0000 mmc: block: ensure error propagation for non-blk Requests to the mmc layer usually come through a block device IO. The exceptions are the ioctl interface, RPMB chardev ioctl and debugfs, which issue their own blk_mq requests through blk_execute_rq and do not query the BLK_STS error but the mmcblk-internal drv_op_result. This patch ensures that drv_op_result defaults to an error and has to be overwritten by the operation to be considered successful. The behavior leads to a bug where the request never propagates the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged) and thus may assume that their call executed successfully when it did not. While always checking the blk_execute_rq return value would be advised, let's eliminate the error by always setting drv_op_result as -EIO to be overwritten on success (or other error) Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests") Signed-off-by: Christian Loehle Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/59c17ada35664b818b7bd83752119b2d@hyperstone.com Signed-off-by: Ulf Hansson commit 162bd18eb55adf464a0fa2b4144b8d61c75ff7c2 Author: Roy Novich Date: Sun May 7 16:57:43 2023 +0300 linux/dim: Do nothing if no time delta between samples Add return value for dim_calc_stats. This is an indication for the caller if curr_stats was assigned by the function. Avoid using curr_stats uninitialized over {rdma/net}_dim, when no time delta between samples. Coverity reported this potential use of an uninitialized variable. Fixes: 4c4dbb4a7363 ("net/mlx5e: Move dynamic interrupt coalescing code to include/linux") Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing") Signed-off-by: Roy Novich Reviewed-by: Aya Levin Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Reviewed-by: Leon Romanovsky Reviewed-by: Michal Kubiak Link: https://lore.kernel.org/r/20230507135743.138993-1-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 4b65f95c87c35699bc6ad540d6b9dd7f950d0924 Author: Andrey Avdeev Date: Sun Apr 30 11:01:10 2023 +0300 platform/x86: touchscreen_dmi: Add info for the Dexp Ursus KX210i Add touchscreen info for the Dexp Ursus KX210i Signed-off-by: Andrey Avdeev Link: https://lore.kernel.org/r/ZE4gRgzRQCjXFYD0@avdeevavpc Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 6abfa99ce52f61a31bcfc2aaaae09006f5665495 Author: Hans de Goede Date: Fri May 5 23:03:23 2023 +0200 platform/x86: touchscreen_dmi: Add upside-down quirk for GDIX1002 ts on the Juno Tablet The Juno Computers Juno Tablet has an upside-down mounted Goodix touchscreen. Add a quirk to invert both axis to correct for this. Link: https://junocomputers.com/us/product/juno-tablet/ Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230505210323.43177-1-hdegoede@redhat.com commit 1684878952929e20a864af5df7b498941c750f45 Author: Mark Pearson Date: Fri May 5 09:25:23 2023 -0400 platform/x86: thinkpad_acpi: Add profile force ability There has been a lot of confusion around which platform profiles are supported on various platforms and it would be useful to have a debug method to be able to override the profile mode that is selected. I don't expect this to be used in anything other than debugging in conjunction with Lenovo engineers - but it does give a way to get a system working whilst we wait for either FW fixes, or a driver fix to land upstream, if something is wonky in the mode detection logic Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230505132523.214338-2-mpearson-lenovo@squebb.ca Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 0c0cd3e25a5b64b541dd83ba6e032475a9d77432 Author: Mark Pearson Date: Fri May 5 09:25:22 2023 -0400 platform/x86: thinkpad_acpi: Fix platform profiles on T490 I had incorrectly thought that PSC profiles were not usable on Intel platforms so had blocked them in the driver initialistion. This broke platform profiles on the T490. After discussion with the FW team PSC does work on Intel platforms and should be allowed. Note - it's possible this may impact other platforms where it is advertised but special driver support that only Windows has is needed. But if it does then they will need fixing via quirks. Please report any issues to me so I can get them addressed - but I haven't found any problems in testing...yet Fixes: bce6243f767f ("platform/x86: thinkpad_acpi: do not use PSC mode on Intel platforms") Link: https://bugzilla.redhat.com/show_bug.cgi?id=2177962 Cc: stable@vger.kernel.org Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230505132523.214338-1-mpearson-lenovo@squebb.ca Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit decab2825c3ef9b154c6f76bce40872ffb41c36f Author: Fae Date: Tue Apr 25 01:36:44 2023 -0500 platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct Fixes micmute key of HP Envy X360 ey0xxx. Signed-off-by: Fae Link: https://lore.kernel.org/r/20230425063644.11828-1-faenkhauser@gmail.com Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 75e406b540c3eca67625d97bbefd4e3787eafbfe Author: Srinivas Pandruvada Date: Tue Apr 18 08:32:30 2023 -0700 platform/x86/intel-uncore-freq: Return error on write frequency Currently when the uncore_write() returns error, it is silently ignored. Return error to user space when uncore_write() fails. Fixes: 49a474c7ba51 ("platform/x86: Add support for Uncore frequency control") Signed-off-by: Srinivas Pandruvada Reviewed-by: Zhang Rui Tested-by: Wendy Wang Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20230418153230.679094-1-srinivas.pandruvada@linux.intel.com Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede commit 44c524b642996148a8e94f1a1b8751076edcf577 Author: Huacai Chen Date: Tue May 9 10:44:48 2023 +0800 power: supply: Fix power_supply_get_battery_info() if parent is NULL After commit 27a2195efa8d26447c ("power: supply: core: auto-exposure of simple-battery data") we call power_supply_get_battery_info() in __power_supply_register(), but it causes test_battery crash with NULL pointer: [ 7.524846] __power_supply_register: Expected proper parent device for 'test_battery' [ 7.524856] CPU 3 Unable to handle kernel paging request at virtual address 0000000000000278, era == 9000000002fb279c, ra == 9000000003173434 [ 7.524862] Oops[#1]: [ 7.524866] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 6.3.0+ #524 [ 7.524870] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 [ 7.524872] pc 9000000002fb279c ra 9000000003173434 tp 90000001001f0000 sp 90000001001f3c00 [ 7.524875] a0 0000000000000000 a1 0000000000000000 a2 0000000000000000 a3 9000000004553e13 [ 7.524878] a4 9000000004553e16 a5 ffffffffffffffff a6 9000000003fd0948 a7 0000000000000030 [ 7.524881] t0 9000000003173434 t1 90000000035e2c00 t2 0000000000000001 t3 00000000fffff2b0 [ 7.524883] t4 0000000000000007 t5 fffffffffffffffe t6 0000000000000000 t7 0000000000000010 [ 7.524886] t8 00000000000000b4 u0 00000001c0840c76 s9 0000000000000000 s0 0000000000000000 [ 7.524889] s1 900000000370c458 s2 0000000000000001 s3 9000000101f81000 s4 9000000101f81038 [ 7.524891] s5 9000000101f813a0 s6 900000000370c398 s7 9000000003eebd18 s8 90000000037c0070 [ 7.524894] ra: 9000000003173434 power_supply_get_battery_info+0xe4/0x710 [ 7.591224] ERA: 9000000002fb279c __dev_fwnode+0x8/0x20 [ 7.853583] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 7.859740] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 7.864073] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 7.868839] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) [ 7.873430] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 7.878884] BADV: 0000000000000278 [ 7.882346] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) [ 7.888056] Modules linked in: [ 7.891088] Process swapper/0 (pid: 1, threadinfo=0000000091357ee8, task=00000000313d98cb) [ 7.899307] Stack : 00000000000000b4 900000000279aca8 0000000000000001 0000000000000000 [ 7.907274] 0000000000000049 0000000000000408 9000000100008c00 90000000035b6370 [ 7.915238] 900000000b801080 90000000029a440c 9000000003eb4680 9000000003eb4680 [ 7.923202] 9000000101f81038 900000000357cdcc 0000000000000001 900000000370c458 [ 7.931166] 9000000101f81000 90000000037c0070 9000000003eebd18 900000000370c398 [ 7.939131] 90000000045f4530 9000000101f81038 0000000000000000 0000000000000001 [ 7.947095] 900000000370c458 9000000101f81000 0000000000000000 9000000003173e64 [ 7.955059] 0000000000000026 9000000003de3880 9000000100562040 900000000357e07c [ 7.963023] 000000000000026f 0000000000000001 90000001001f3d68 fffffffffffffff5 [ 7.970987] 90000000036d2ca8 90000000027429d8 90000000037c0030 0000000000000001 [ 7.978951] ... [ 7.981379] Call Trace: [ 7.981382] [<9000000002fb279c>] __dev_fwnode+0x8/0x20 [ 7.988916] [<9000000003173434>] power_supply_get_battery_info+0xe4/0x710 [ 7.995666] [<9000000003173e64>] __power_supply_register+0x404/0x580 [ 8.001984] [<900000000379d368>] test_power_init+0x6c/0x124 [ 8.007527] [<90000000026e08f8>] do_one_initcall+0x58/0x1ec [ 8.013066] [<9000000003761614>] kernel_init_freeable+0x290/0x310 [ 8.019127] [<90000000035b40e8>] kernel_init+0x24/0x11c [ 8.024324] [<90000000026e2048>] ret_from_kernel_thread+0xc/0xa4 [ 8.030295] [ 8.031769] Code: 4c000020 0015002c 03400000 <28c9e08c> 40000d80 02c06184 4c000020 28ca0084 4c000020 Root cause: psy->dev.parent is NULL in power_supply_get_battery_info(), so change the else branch to be 'else if (psy->dev.parent)' and return -ENOENT if psy->dev.parent is NULL. Fixes: 27a2195efa8d26447c ("power: supply: core: auto-exposure of simple-battery data") Signed-off-by: Huacai Chen Signed-off-by: Sebastian Reichel commit c4af8e3fecd03b0aedcd38145955605cfebe7e3a Author: Mario Limonciello Date: Mon Apr 24 14:55:54 2023 -0500 thunderbolt: Clear registers properly when auto clear isn't in use When `QUIRK_AUTO_CLEAR_INT` isn't set, interrupt masking should be cleared by writing to Interrupt Mask Clear (IMR) and interrupt status should be cleared properly at shutdown/init. This fixes an error where interrupts are left enabled during resume from hibernation with `CONFIG_USB4=y`. Fixes: 468c49f44759 ("thunderbolt: Disable interrupt auto clear for rings") Cc: stable@vger.kernel.org # v6.3 Reported-by: Takashi Iwai Link: https://bugzilla.kernel.org/show_bug.cgi?id=217343 Signed-off-by: Mario Limonciello Signed-off-by: Mika Westerberg commit 8bbec86ce6d66fb33530c679f7bb3a123fc9e7da Author: Krzysztof Kozlowski Date: Mon May 8 09:18:37 2023 +0200 dt-bindings: PCI: fsl,imx6q: fix assigned-clocks warning assigned-clocks are a dependency of clocks, however the dtschema has limitation and expects clocks to be present in the binding using assigned-clocks, not in other referenced bindings. The clocks were defined in common fsl,imx6q-pcie-common.yaml, which is referenced by fsl,imx6q-pcie-ep.yaml. The fsl,imx6q-pcie-ep.yaml used assigned-clocks thus leading to warnings: Documentation/devicetree/bindings/pci/fsl,imx6q-pcie-ep.example.dtb: pcie-ep@33800000: Unevaluated properties are not allowed ('assigned-clock-parents', 'assigned-clock-rates', 'assigned-clocks' were unexpected) From schema: Documentation/devicetree/bindings/pci/fsl,imx6q-pcie-ep.yaml Fix this by moving clocks to each specific schema from the common one and narrowing them to strictly match what is expected for given device. Fixes: b10f82380eeb ("dt-bindings: imx6q-pcie: Restruct i.MX PCIe schema") Acked-by: Conor Dooley Reviewed-by: Richard Zhu Link: https://lore.kernel.org/r/20230508071837.68552-1-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit ba8c2b75b02a162202d31e6200ab15da1035a7d0 Author: Steve French Date: Mon May 8 00:45:45 2023 -0500 smb3: improve parallel reads of large files rasize (ra_pages) should be set higher than read size by default to allow parallel reads when reading large files in order to improve performance (otherwise there is much dead time on the network when doing readahead of large files). Default rasize to twice readsize. Signed-off-by: Steve French commit 051d71e073614a72ad423d6dacba37a7eeff274d Author: V sujith kumar Reddy Date: Mon May 8 12:35:08 2023 +0530 ASoC: SOF: amd: Fix NULL pointer crash in acp_sof_ipc_msg_data function Check substream and runtime variables before assigning. Signed-off-by: V sujith kumar Reddy Date: Sat May 6 18:40:57 2023 +0200 tick/broadcast: Make broadcast device replacement work correctly When a tick broadcast clockevent device is initialized for one shot mode then tick_broadcast_setup_oneshot() OR's the periodic broadcast mode cpumask into the oneshot broadcast cpumask. This is required when switching from periodic broadcast mode to oneshot broadcast mode to ensure that CPUs which are waiting for periodic broadcast are woken up on the next tick. But it is subtly broken, when an active broadcast device is replaced and the system is already in oneshot (NOHZ/HIGHRES) mode. Victor observed this and debugged the issue. Then the OR of the periodic broadcast CPU mask is wrong as the periodic cpumask bits are sticky after tick_broadcast_enable() set it for a CPU unless explicitly cleared via tick_broadcast_disable(). That means that this sets all other CPUs which have tick broadcasting enabled at that point unconditionally in the oneshot broadcast mask. If the affected CPUs were already idle and had their bits set in the oneshot broadcast mask then this does no harm. But for non idle CPUs which were not set this corrupts their state. On their next invocation of tick_broadcast_enable() they observe the bit set, which indicates that the broadcast for the CPU is already set up. As a consequence they fail to update the broadcast event even if their earliest expiring timer is before the actually programmed broadcast event. If the programmed broadcast event is far in the future, then this can cause stalls or trigger the hung task detector. Avoid this by telling tick_broadcast_setup_oneshot() explicitly whether this is the initial switch over from periodic to oneshot broadcast which must take the periodic broadcast mask into account. In the case of initialization of a replacement device this prevents that the broadcast oneshot mask is modified. There is a second problem with broadcast device replacement in this function. The broadcast device is only armed when the previous state of the device was periodic. That is correct for the switch from periodic broadcast mode to oneshot broadcast mode as the underlying broadcast device could operate in oneshot state already due to lack of periodic state in hardware. In that case it is already armed to expire at the next tick. For the replacement case this is wrong as the device is in shutdown state. That means that any already pending broadcast event will not be armed. This went unnoticed because any CPU which goes idle will observe that the broadcast device has an expiry time of KTIME_MAX and therefore any CPUs next timer event will be earlier and cause a reprogramming of the broadcast device. But that does not guarantee that the events of the CPUs which were already in idle are delivered on time. Fix this by arming the newly installed device for an immediate event which will reevaluate the per CPU expiry times and reprogram the broadcast device accordingly. This is simpler than caching the last expiry time in yet another place or saving it before the device exchange and handing it down to the setup function. Replacement of broadcast devices is not a frequent operation and usually happens once somewhere late in the boot process. Fixes: 9c336c9935cf ("tick/broadcast: Allow late registered device to enter oneshot mode") Reported-by: Victor Hassan Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/87pm7d2z1i.ffs@tglx commit 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 Author: Sudeep Holla Date: Wed May 3 14:12:52 2023 +0100 firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors The transmit buffers allocated by the driver can be used to transmit data by any messages/commands needing the buffer. However, it is not guaranteed to have been zero-ed before every new transmission and hence it will just contain residual value from the previous transmission. There are several reserved fields in the memory descriptors that must be zero(MBZ). The receiver can reject the transmission if any such MBZ fields are non-zero. While we can set the whole page to zero, it is not optimal as most of the fields get initialised to the value required for the current transmission. So, just set the reserved/MBZ fields to zero in the memory descriptors explicitly to honour the requirement and keep the receiver happy. Fixes: cc2195fe536c ("firmware: arm_ffa: Add support for MEM_* interfaces") Reported-by: Marc Bonnici Link: https://lore.kernel.org/r/20230503131252.12585-1-sudeep.holla@arm.com Signed-off-by: Sudeep Holla commit 19b8766459c41c6f318f8a548cc1c66dffd18363 Author: Sudeep Holla Date: Thu Apr 20 16:06:03 2023 +0100 firmware: arm_ffa: Fix FFA device names for logical partitions Each physical partition can provide multiple services each with UUID. Each such service can be presented as logical partition with a unique combination of VM ID and UUID. The number of distinct UUID in a system will be less than or equal to the number of logical partitions. However, currently it fails to register more than one logical partition or service within a physical partition as the device name contains only VM ID while both VM ID and UUID are maintained in the partition information. The kernel complains with the below message: | sysfs: cannot create duplicate filename '/devices/arm-ffa-8001' | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7 #8 | Hardware name: FVP Base RevC (DT) | Call trace: | dump_backtrace+0xf8/0x118 | show_stack+0x18/0x24 | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | sysfs_create_dir_ns+0xe0/0x13c | kobject_add_internal+0x220/0x3d4 | kobject_add+0x94/0x100 | device_add+0x144/0x5d8 | device_register+0x20/0x30 | ffa_device_register+0x88/0xd8 | ffa_setup_partitions+0x108/0x1b8 | ffa_init+0x2ec/0x3a4 | do_one_initcall+0xcc/0x240 | do_initcall_level+0x8c/0xac | do_initcalls+0x54/0x94 | do_basic_setup+0x1c/0x28 | kernel_init_freeable+0x100/0x16c | kernel_init+0x20/0x1a0 | ret_from_fork+0x10/0x20 | kobject_add_internal failed for arm-ffa-8001 with -EEXIST, don't try to | register things with the same name in the same directory. | arm_ffa arm-ffa: unable to register device arm-ffa-8001 err=-17 | ARM FF-A: ffa_setup_partitions: failed to register partition ID 0x8001 By virtue of being random enough to avoid collisions when generated in a distributed system, there is no way to compress UUID keys to the number of bits required to identify each. We can eliminate '-' in the name but it is not worth eliminating 4 bytes and add unnecessary logic for doing that. Also v1.0 doesn't provide the UUID of the partitions which makes it hard to use the same for the device name. So to keep it simple, let us alloc an ID using ida_alloc() and append the same to "arm-ffa" to make up a unique device name. Also stash the id value in ffa_dev to help freeing the ID later when the device is destroyed. Fixes: e781858488b9 ("firmware: arm_ffa: Add initial FFA bus support for device enumeration") Reported-by: Lucian Paul-Trifu Link: https://lore.kernel.org/r/20230419-ffa_fixes_6-4-v2-3-d9108e43a176@arm.com Signed-off-by: Sudeep Holla commit c6e045361a27ecd4fac6413164e0d091d80eee99 Author: Sudeep Holla Date: Thu Apr 20 16:06:02 2023 +0100 firmware: arm_ffa: Fix usage of partition info get count flag Commit bb1be7498500 ("firmware: arm_ffa: Add v1.1 get_partition_info support") adds support to discovery the UUIDs of the partitions or just fetch the partition count using the PARTITION_INFO_GET_RETURN_COUNT_ONLY flag. However the commit doesn't handle the fact that the older version doesn't understand the flag and must be MBZ which results in firmware returning invalid parameter error. That results in the failure of the driver probe which is in correct. Limit the usage of the PARTITION_INFO_GET_RETURN_COUNT_ONLY flag for the versions above v1.0(i.e v1.1 and onwards) which fixes the issue. Fixes: bb1be7498500 ("firmware: arm_ffa: Add v1.1 get_partition_info support") Reported-by: Jens Wiklander Reported-by: Marc Bonnici Tested-by: Jens Wiklander Reviewed-by: Jens Wiklander Link: https://lore.kernel.org/r/20230419-ffa_fixes_6-4-v2-2-d9108e43a176@arm.com Signed-off-by: Sudeep Holla commit b71b55248a580e9c9befc4ae060539f1f8e477da Author: Sudeep Holla Date: Thu Apr 20 16:06:01 2023 +0100 firmware: arm_ffa: Check if ffa_driver remove is present before executing Currently ffa_drv->remove() is called unconditionally from ffa_device_remove(). Since the driver registration doesn't check for it and allows it to be registered without .remove callback, we need to check for the presence of it before executing it from ffa_device_remove() to above a NULL pointer dereference like the one below: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000086000004 | EC = 0x21: IABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881cc8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP | CPU: 3 PID: 130 Comm: rmmod Not tainted 6.3.0-rc7 #6 | Hardware name: FVP Base RevC (DT) | pstate: 63402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c) | pc : 0x0 | lr : ffa_device_remove+0x20/0x2c | Call trace: | 0x0 | device_release_driver_internal+0x16c/0x260 | driver_detach+0x90/0xd0 | bus_remove_driver+0xdc/0x11c | driver_unregister+0x30/0x54 | ffa_driver_unregister+0x14/0x20 | cleanup_module+0x18/0xeec | __arm64_sys_delete_module+0x234/0x378 | invoke_syscall+0x40/0x108 | el0_svc_common+0xb4/0xf0 | do_el0_svc+0x30/0xa4 | el0_svc+0x2c/0x7c | el0t_64_sync_handler+0x84/0xf0 | el0t_64_sync+0x190/0x194 Fixes: 244f5d597e1e ("firmware: arm_ffa: Add missing remove callback to ffa_bus_type") Link: https://lore.kernel.org/r/20230419-ffa_fixes_6-4-v2-1-d9108e43a176@arm.com Signed-off-by: Sudeep Holla commit 55b37d9c8ba23d28c584aef0801fb1e60e4a817c Author: Krzysztof Kozlowski Date: Sat Apr 22 00:32:12 2023 +0200 arm64: dts: arm: add missing cache properties As all level 2 and level 3 caches are unified, add required cache-unified properties to fix warnings like: foundation-v8.dtb: l2-cache0: 'cache-unified' is a required property Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230421223213.115639-1-krzysztof.kozlowski@linaro.org Signed-off-by: Sudeep Holla commit 328acc5657c6197753238d7ce0a6924ead829347 Author: Krzysztof Kozlowski Date: Sun Apr 23 17:08:37 2023 +0200 ARM: dts: vexpress: add missing cache properties As all level 2 and level 3 caches are unified, add required cache-unified property to fix warnings like: vexpress-v2p-ca5s.dtb: cache-controller@2c0f0000: 'cache-unified' is a required property Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230423150837.118466-1-krzysztof.kozlowski@linaro.org Signed-off-by: Sudeep Holla commit 44e8d5ad2dc01529eb1316b1521f24ac4aac8eaf Author: Tejun Heo Date: Thu Apr 20 09:33:49 2023 -1000 firmware: arm_scmi: Fix incorrect alloc_workqueue() invocation scmi_xfer_raw_worker_init() is specifying a flag, WQ_SYSFS, as @max_active. Fix it by or'ing WQ_SYSFS into @flags so that it actually enables sysfs interface and using 0 for @max_active for the default setting. Signed-off-by: Tejun Heo Fixes: 3c3d818a9317 ("firmware: arm_scmi: Add core raw transmission support") Link: https://lore.kernel.org/r/ZEGTnajiQm7mkkZS@slm.duckdns.org Signed-off-by: Sudeep Holla commit ec97e112985c2581ee61854a4b74f080f6cdfc2c Author: Dexuan Cui Date: Thu May 4 15:41:55 2023 -0700 Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails Commit 572086325ce9 ("Drivers: hv: vmbus: Cleanup synic memory free path") says "Any memory allocations that succeeded will be freed when the caller cleans up by calling hv_synic_free()", but if the get_zeroed_page() in hv_synic_alloc() fails, currently hv_synic_free() is not really called in vmbus_bus_init(), consequently there will be a memory leak, e.g. hv_context.hv_numa_map is not freed in the error path. Fix this by updating the goto labels. Cc: stable@kernel.org Signed-off-by: Dexuan Cui Fixes: 4df4cb9e99f8 ("x86/hyperv: Initialize clockevents earlier in CPU onlining") Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20230504224155.10484-1-decui@microsoft.com Signed-off-by: Wei Liu commit dbcf76390eb9a65d5d0c37b0cd57335218564e37 Author: Mark Brown Date: Mon May 8 22:15:42 2023 +0900 selftests/ftrace: Improve integration with kselftest runner The ftrace selftests do not currently produce KTAP output, they produce a custom format much nicer for human consumption. This means that when run in automated test systems we just get a single result for the suite as a whole rather than recording results for individual test cases, making it harder to look at the test data and masking things like inappropriate skips. Address this by adding support for KTAP output to the ftracetest script and providing a trivial wrapper which will be invoked by the kselftest runner to generate output in this format by default, users using ftracetest directly will continue to get the existing output. This is not the most elegant solution but it is simple and effective. I did consider implementing this by post processing the existing output format but that felt more complex and likely to result in all output being lost if something goes seriously wrong during the run which would not be helpful. I did also consider just writing a separate runner script but there's enough going on with things like the signal handling for that to seem like it would be duplicating too much. Acked-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Tested-by: Masami Hiramatsu (Google) Signed-off-by: Mark Brown Signed-off-by: Shuah Khan commit 4b79f76920a49fc13766b95df1df1f4d700acbad Author: Yi Lai Date: Fri Apr 21 11:31:23 2023 +0800 selftests/sgx: Add "test_encl.elf" to TEST_FILES The "test_encl.elf" file used by test_sgx is not installed in INSTALL_PATH. Attempting to execute test_sgx causes false negative: " enclave executable open(): No such file or directory main.c:188:unclobbered_vdso:Failed to load the test enclave. " Add "test_encl.elf" to TEST_FILES so that it will be installed. Fixes: 2adcba79e69d ("selftests/x86: Add a selftest for SGX") Signed-off-by: Yi Lai Reviewed-by: Jarkko Sakkinen Signed-off-by: Shuah Khan commit cbd4cbabef646f1719a73a01cc491b1c1fea4d41 Author: Steve French Date: Sun May 7 17:57:17 2023 -0500 do not reuse connection if share marked as isolated "SHAREFLAG_ISOLATED_TRANSPORT" indicates that we should not reuse the socket for this share (for future mounts). Mark the socket as server->nosharesock if share flags returned include SHAREFLAG_ISOLATED_TRANSPORT. See MS-SMB2 MS-SMB2 2.2.10 and 3.2.5.5 Signed-off-by: Steve French commit d66cde50c3c868af7abddafce701bb86e4a93039 Author: Pawel Witek Date: Fri May 5 17:14:59 2023 +0200 cifs: fix pcchunk length type in smb2_copychunk_range Change type of pcchunk->Length from u32 to u64 to match smb2_copychunk_range arguments type. Fixes the problem where performing server-side copy with CIFS_IOC_COPYCHUNK_FILE ioctl resulted in incomplete copy of large files while returning -EINVAL. Fixes: 9bf0c9cd4314 ("CIFS: Fix SMB2/SMB3 Copy offload support (refcopy) for large files") Cc: Signed-off-by: Pawel Witek Signed-off-by: Steve French commit c2adb1877b76fc81ae041e1db1a6ed2078c6746b Author: Wyes Karny Date: Thu May 4 06:25:44 2023 +0000 cpupower: Make TSC read per CPU for Mperf monitor System-wide TSC read could cause a drift in C0 percentage calculation. Because if first TSC is read and then one by one mperf is read for all cpus, this introduces drift between mperf reading of later CPUs and TSC reading. To lower this drift read TSC per CPU and also just after mperf read. This technique improves C0 percentage calculation in Mperf monitor. Before fix: (System 100% busy) | Mperf || RAPL || Idle_Stats PKG|CORE| CPU| C0 | Cx | Freq || pack | core || POLL | C1 | C2 0| 0| 0| 87.15| 12.85| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 0| 256| 84.62| 15.38| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 1| 1| 87.15| 12.85| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 1| 257| 84.08| 15.92| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 2| 2| 86.61| 13.39| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 2| 258| 83.26| 16.74| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 3| 3| 86.61| 13.39| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 3| 259| 83.60| 16.40| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 4| 4| 86.33| 13.67| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 4| 260| 83.33| 16.67| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 5| 5| 86.06| 13.94| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 5| 261| 83.05| 16.95| 2695||168659003|3970468|| 0.00| 0.00| 0.00 0| 6| 6| 85.51| 14.49| 2695||168659003|3970468|| 0.00| 0.00| 0.00 After fix: (System 100% busy) | Mperf || RAPL || Idle_Stats PKG|CORE| CPU| C0 | Cx | Freq || pack | core || POLL | C1 | C2 0| 0| 0| 98.03| 1.97| 2415||163295480|3811189|| 0.00| 0.00| 0.00 0| 0| 256| 98.50| 1.50| 2394||163295480|3811189|| 0.00| 0.00| 0.00 0| 1| 1| 99.99| 0.01| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 1| 257| 99.99| 0.01| 2375||163295480|3811189|| 0.00| 0.00| 0.00 0| 2| 2| 99.99| 0.01| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 2| 258|100.00| 0.00| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 3| 3|100.00| 0.00| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 3| 259| 99.99| 0.01| 2435||163295480|3811189|| 0.00| 0.00| 0.00 0| 4| 4|100.00| 0.00| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 4| 260|100.00| 0.00| 2435||163295480|3811189|| 0.00| 0.00| 0.00 0| 5| 5| 99.99| 0.01| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 5| 261|100.00| 0.00| 2435||163295480|3811189|| 0.00| 0.00| 0.00 0| 6| 6|100.00| 0.00| 2401||163295480|3811189|| 0.00| 0.00| 0.00 0| 6| 262|100.00| 0.00| 2435||163295480|3811189|| 0.00| 0.00| 0.00 Cc: Thomas Renninger Cc: Shuah Khan Cc: Dominik Brodowski Fixes: 7fe2f6399a84 ("cpupowerutils - cpufrequtils extended with quite some features") Signed-off-by: Wyes Karny Signed-off-by: Shuah Khan commit cb6aeeb69af06b09e687fbef4da36a81c36b4994 Author: Saurabh Sengar Date: Mon Apr 24 03:10:16 2023 -0700 x86/hyperv/vtl: Add noop for realmode pointers Assign the realmode pointers to noop, instead of NULL to fix kernel panic. Signed-off-by: Saurabh Sengar Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1682331016-22561-1-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Wei Liu commit ba0ad6ed89fd5dada3b7b65ef2b08e95d449d4ab Author: Arnd Bergmann Date: Tue Apr 18 08:11:43 2023 +0200 media: nxp: imx8-isi: fix buiding on 32-bit The #if check is wrong, leading to a build failure: drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c: In function 'mxc_isi_channel_set_inbuf': drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c:33:5: error: "CONFIG_ARCH_DMA_ADDR_T_64BIT" is not defined, evaluates to 0 [-Werror=undef] 33 | #if CONFIG_ARCH_DMA_ADDR_T_64BIT | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ This could just be an #ifdef, but it seems nicer to just remove the check entirely. Apparently the only reason for the #ifdef is to avoid another warning: drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c:55:24: error: right shift count >= width of type [-Werror=shift-count-overflow] But this is best avoided by using the lower_32_bits()/upper_32_bits() helpers. Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") Signed-off-by: Arnd Bergmann Reviewed-by: Laurent Pinchart Signed-off-by: Linus Torvalds commit 4a9b6850c794e4394cad99e2b863d75f5bc8e92f Author: Julian Winkler Date: Sun Apr 16 17:49:32 2023 +0200 platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield This id was removed in commit b47018a778c1 ("platform/x86: intel_scu_ipc: Remove Lincroft support"), saying it is only used on Moorestown, but apparently the same id is also used on Medfield. Tested on the Medfield based Motorola RAZR i smartphone. Signed-off-by: Julian Winkler Link: https://lore.kernel.org/r/20230416154932.6579-1-julian.winkler1@web.de Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit e652be0f59d4ba4d5c636b1f7f4dcb73aae049fa Author: Hao Zeng Date: Tue Apr 18 09:30:56 2023 +0800 cpupower:Fix resource leaks in sysfs_get_enabled() The sysfs_get_enabled() opened file processor not closed, may cause a file handle leak. Putting error handling and resource cleanup code together makes the code easy to maintain and read. Removed the unnecessary else if branch from the original function, as it should return an error in cases other than '0'. Signed-off-by: Hao Zeng Suggested-by: Shuah Khan Signed-off-by: Shuah Khan commit b3dad076a058916c443c93074dc3ee80baaff4ea Author: Aaro Koskinen Date: Fri Apr 28 00:16:06 2023 +0300 staging: octeon: delete my name from TODO contact I gave up using MIPS OCTEON hardware after the drivers were deleted from staging in 2019. Afterwards, the driver seems to be added back but the TODO contact name was not updated accordingly. Delete my name, as I still get mails from people asking help with the driver and their systems. Fixes: 422d97b8b05e ("Revert "staging: octeon: delete driver"") Signed-off-by: Aaro Koskinen Link: https://lore.kernel.org/r/20230427211606.GD881984@darkstar.musicnaut.iki.fi Signed-off-by: Greg Kroah-Hartman commit 17955aba7877a4494d8093ae5498e19469b01d57 Author: Shengjiu Wang Date: Mon May 8 18:16:36 2023 +0800 ASoC: fsl_micfil: Fix error handler with pm_runtime_enable There is error message when defer probe happens: fsl-micfil-dai 30ca0000.micfil: Unbalanced pm_runtime_enable! Fix the error handler with pm_runtime_enable and add fsl_micfil_remove() for pm_runtime_disable. Fixes: 47a70e6fc9a8 ("ASoC: Add MICFIL SoC Digital Audio Interface driver.") Signed-off-by: Shengjiu Wang Date: Sat Apr 15 20:23:41 2023 +0200 power: supply: bq24190: Call power_supply_changed() after updating input current The bq24192 model relies on external charger-type detection and once that is done the bq24190_charger code will update the input current. In this case, when the initial power_supply_changed() call is made from the interrupt handler, the input settings are 5V/0.5A which on many devices is not enough power to charge (while the device is on). On many devices the fuel-gauge relies in its external_power_changed callback to timely signal userspace about charging <-> discharging status changes. Add a power_supply_changed() call after updating the input current. This allows the fuel-gauge driver to timely recheck if the battery is charging after the new input current has been applied and then it can immediately notify userspace about this. Fixes: 18f8e6f695ac ("power: supply: bq24190_charger: Get input_current_limit from our supplier") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit ad3d9c779b1f09f3f3a6fefd07af407c7bc7c9a7 Author: Hans de Goede Date: Sat Apr 15 20:23:40 2023 +0200 power: supply: bq25890: Call power_supply_changed() after updating input current or voltage The bq25892 model relies on external charger-type detection and once that is done the bq25890_charger code will update the input current and if pumpexpress is used also the input voltage. In this case, when the initial power_supply_changed() call is made from the interrupt handler, the input settings are 5V/0.5A which on many devices is not enough power to charge (while the device is on). On many devices the fuel-gauge relies in its external_power_changed callback to timely signal userspace about charging <-> discharging status changes. Add a power_supply_changed() call after updating the input current or voltage. This allows the fuel-gauge driver to timely recheck if the battery is charging after the new input settings have been applied and then it can immediately notify userspace about this. Fixes: 48f45b094dbb ("power: supply: bq25890: Support higher charging voltages through Pump Express+ protocol") Fixes: eab25b4f93aa ("power: supply: bq25890: On the bq25892 set the IINLIM based on external charger detection") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 59dddea9879713423c7b2ade43c423bb71e0d216 Author: Hans de Goede Date: Sat Apr 15 20:23:39 2023 +0200 power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() Use mod_delayed_work() instead of separate cancel_delayed_work_sync() + schedule_delayed_work() calls. Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 59a99cd462fbdf71f4e845e09f37783035088b4f Author: Hans de Goede Date: Sat Apr 15 20:23:38 2023 +0200 power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize bq27xxx_external_power_changed() gets called when the charger is plugged in or out. Rather then immediately scheduling an update wait 0.5 seconds for things to stabilize, so that e.g. the (dis)charge current is stable when bq27xxx_battery_update() runs. Fixes: 740b755a3b34 ("bq27x00: Poll battery state") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 939a116142012926e25de0ea6b7e2f8d86a5f1b6 Author: Hans de Goede Date: Sat Apr 15 20:23:37 2023 +0200 power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes On gauges where the current register is signed, there is no charging flag in the flags register. So only checking flags will not result in power_supply_changed() getting called when e.g. a charger is plugged in and the current sign changes from negative (discharging) to positive (charging). This causes userspace's notion of the status to lag until userspace does a poll. And when a power_supply_leds.c LED trigger is used to indicate charging status with a LED, this LED will lag until the capacity percentage changes, which may take many minutes (because the LED trigger only is updated on power_supply_changed() calls). Fix this by calling bq27xxx_battery_current_and_status() on gauges with a signed current register and checking if the status has changed. Fixes: 297a533b3e62 ("bq27x00: Cache battery registers") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit ff4c4a2a4437a6d03787c7aafb2617f20c3ef45f Author: Hans de Goede Date: Sat Apr 15 20:23:36 2023 +0200 power: supply: bq27xxx: Move bq27xxx_battery_update() down Move the bq27xxx_battery_update() functions to below the bq27xxx_battery_current_and_status() function. This is just moving a block of text, no functional changes. This is a preparation patch for making bq27xxx_battery_update() check the status and have it call power_supply_changed() on status changes. Fixes: 297a533b3e62 ("bq27x00: Cache battery registers") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 35092c5819f8c5acc7bafe3fdbb13d6307c4f5e1 Author: Hans de Goede Date: Sat Apr 15 20:23:35 2023 +0200 power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status() Add a cache parameter to bq27xxx_battery_current_and_status() so that it can optionally use cached flags instead of re-reading them itself. This is a preparation patch for making bq27xxx_battery_update() check the status and have it call power_supply_changed() on status changes. Fixes: 297a533b3e62 ("bq27x00: Cache battery registers") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit c00bc80462afc7963f449d7f21d896d2f629cacc Author: Hans de Goede Date: Sat Apr 15 20:23:34 2023 +0200 power: supply: bq27xxx: Fix poll_interval handling and races on remove Before this patch bq27xxx_battery_teardown() was setting poll_interval = 0 to avoid bq27xxx_battery_update() requeuing the delayed_work item. There are 2 problems with this: 1. If the driver is unbound through sysfs, rather then the module being rmmod-ed, this changes poll_interval unexpectedly 2. This is racy, after it being set poll_interval could be changed before bq27xxx_battery_update() checks it through /sys/module/bq27xxx_battery/parameters/poll_interval Fix this by added a removed attribute to struct bq27xxx_device_info and using that instead of setting poll_interval to 0. There also is another poll_interval related race on remove(), writing /sys/module/bq27xxx_battery/parameters/poll_interval will requeue the delayed_work item for all devices on the bq27xxx_battery_devices list and the device being removed was only removed from that list after cancelling the delayed_work item. Fix this by moving the removal from the bq27xxx_battery_devices list to before cancelling the delayed_work item. Fixes: 8cfaaa811894 ("bq27x00_battery: Fix OOPS caused by unregistring bq27x00 driver") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 444ff00734f3878cd54ddd1ed5e2e6dbea9326d5 Author: Hans de Goede Date: Sat Apr 15 20:23:33 2023 +0200 power: supply: bq27xxx: Fix I2C IRQ race on remove devm_request_threaded_irq() requested IRQs are only free-ed after the driver's remove function has ran. So the IRQ could trigger and call bq27xxx_battery_update() after bq27xxx_battery_teardown() has already run. Switch to explicitly free-ing the IRQ in bq27xxx_battery_i2c_remove() to fix this. Fixes: 8807feb91b76 ("power: bq27xxx_battery: Add interrupt handling support") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 5c34c0aef185dcd10881847b9ebf20046aa77cb4 Author: Hans de Goede Date: Sat Apr 15 20:23:32 2023 +0200 power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition bq27xxx_battery_update() assumes / requires that it is only run once, not multiple times at the same time. But there are 3 possible callers: 1. bq27xxx_battery_poll() delayed_work item handler 2. bq27xxx_battery_irq_handler_thread() I2C IRQ handler 3. bq27xxx_battery_setup() And there is no protection against these racing with each other, fix this race condition by making all callers take di->lock: - Rename bq27xxx_battery_update() to bq27xxx_battery_update_unlocked() - Add new bq27xxx_battery_update() which takes di->lock and then calls bq27xxx_battery_update_unlocked() - Make stale cache check code in bq27xxx_battery_get_property(), which already takes di->lock directly to check the jiffies, call bq27xxx_battery_update_unlocked() instead of messing with the delayed_work item - Make bq27xxx_battery_update_unlocked() mod the delayed-work item so that the next poll is delayed to poll_interval milliseconds after the last update independent of the source of the update Fixes: 740b755a3b34 ("bq27x00: Poll battery state") Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit e4484643991e0f6b89060092563f0dbab9450cbb Author: Hans de Goede Date: Thu Apr 13 12:09:41 2023 +0200 power: supply: leds: Fix blink to LED on transition When a battery's status changes from charging to full then the charging-blink-full-solid trigger tries to change the LED from blinking to solid/on. As is documented in include/linux/leds.h to deactivate blinking / to make the LED solid a LED_OFF must be send: """ * Deactivate blinking again when the brightness is set to LED_OFF * via the brightness_set() callback. """ led_set_brighness() calls with a brightness value other then 0 / LED_OFF merely change the brightness of the LED in its on state while it is blinking. So power_supply_update_bat_leds() must first send a LED_OFF event before the LED_FULL to disable blinking. Fixes: 6501f728c56f ("power_supply: Add new LED trigger charging-blink-solid-full") Signed-off-by: Hans de Goede Reviewed-by: Vasily Khoruzhick Signed-off-by: Sebastian Reichel commit 4d5c129d6c8993fe96e9ae712141eedcb9ca68c2 Author: Hans de Goede Date: Sat Apr 15 18:07:32 2023 +0200 power: supply: sc27xx: Fix external_power_changed race sc27xx_fgu_external_power_changed() dereferences data->battery, which gets sets in ab8500_btemp_probe() like this: data->battery = devm_power_supply_register(dev, &sc27xx_fgu_desc, &fgu_cfg); As soon as devm_power_supply_register() has called device_add() the external_power_changed callback can get called. So there is a window where sc27xx_fgu_external_power_changed() may get called while data->battery has not been set yet leading to a NULL pointer dereference. Fixing this is easy. The external_power_changed callback gets passed the power_supply which will eventually get stored in data->battery, so sc27xx_fgu_external_power_changed() can simply directly use the passed in psy argument which is always valid. After this change sc27xx_fgu_external_power_changed() is reduced to just "power_supply_changed(psy);" and it has the same prototype. While at it simply replace it with making the external_power_changed callback directly point to power_supply_changed. Cc: Orson Zhai Cc: Chunyan Zhang Signed-off-by: Hans de Goede Reviewed-by: Baolin Wang Signed-off-by: Sebastian Reichel commit 029a443b9b6424170f00f6dd5b7682e682cce92e Author: Hans de Goede Date: Sat Apr 15 18:07:31 2023 +0200 power: supply: bq25890: Fix external_power_changed race bq25890_charger_external_power_changed() dereferences bq->charger, which gets sets in bq25890_power_supply_init() like this: bq->charger = devm_power_supply_register(bq->dev, &bq->desc, &psy_cfg); As soon as devm_power_supply_register() has called device_add() the external_power_changed callback can get called. So there is a window where bq25890_charger_external_power_changed() may get called while bq->charger has not been set yet leading to a NULL pointer dereference. This race hits during boot sometimes on a Lenovo Yoga Book 1 yb1-x90f when the cht_wcove_pwrsrc (extcon) power_supply is done with detecting the connected charger-type which happens to exactly hit the small window: BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:__power_supply_is_supplied_by+0xb/0xb0 Call Trace: __power_supply_get_supplier_property+0x19/0x50 class_for_each_device+0xb1/0xe0 power_supply_get_property_from_supplier+0x2e/0x50 bq25890_charger_external_power_changed+0x38/0x1b0 [bq25890_charger] __power_supply_changed_work+0x30/0x40 class_for_each_device+0xb1/0xe0 power_supply_changed_work+0x5f/0xe0 Fixing this is easy. The external_power_changed callback gets passed the power_supply which will eventually get stored in bq->charger, so bq25890_charger_external_power_changed() can simply directly use the passed in psy argument which is always valid. Fixes: eab25b4f93aa ("power: supply: bq25890: On the bq25892 set the IINLIM based on external charger detection") Cc: stable@vger.kernel.org Cc: Marek Vasut Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit f8319774d6f1567d6e7d03653174ab0c82c5c66d Author: Hans de Goede Date: Sat Apr 15 18:07:30 2023 +0200 power: supply: axp288_fuel_gauge: Fix external_power_changed race fuel_gauge_external_power_changed() dereferences info->bat, which gets sets in axp288_fuel_gauge_probe() like this: info->bat = devm_power_supply_register(dev, &fuel_gauge_desc, &psy_cfg); As soon as devm_power_supply_register() has called device_add() the external_power_changed callback can get called. So there is a window where fuel_gauge_external_power_changed() may get called while info->bat has not been set yet leading to a NULL pointer dereference. Fixing this is easy. The external_power_changed callback gets passed the power_supply which will eventually get stored in info->bat, so fuel_gauge_external_power_changed() can simply directly use the passed in psy argument which is always valid. Fixes: 30abb3d07929 ("power: supply: axp288_fuel_gauge: Take lock before updating the valid flag") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit a5299ce4e96f3e8930e9c051b28d8093ada87b08 Author: Hans de Goede Date: Sat Apr 15 18:07:29 2023 +0200 power: supply: ab8500: Fix external_power_changed race ab8500_btemp_external_power_changed() dereferences di->btemp_psy, which gets sets in ab8500_btemp_probe() like this: di->btemp_psy = devm_power_supply_register(dev, &ab8500_btemp_desc, &psy_cfg); As soon as devm_power_supply_register() has called device_add() the external_power_changed callback can get called. So there is a window where ab8500_btemp_external_power_changed() may get called while di->btemp_psy has not been set yet leading to a NULL pointer dereference. Fixing this is easy. The external_power_changed callback gets passed the power_supply which will eventually get stored in di->btemp_psy, so ab8500_btemp_external_power_changed() can simply directly use the passed in psy argument which is always valid. And the same applies to ab8500_fg_external_power_changed(). Signed-off-by: Hans de Goede Reviewed-by: Linus Walleij Signed-off-by: Sebastian Reichel commit 536d948a8dee21166d9c5b5a4189af56beba16e3 Author: Randy Dunlap Date: Fri Apr 28 21:35:19 2023 -0700 powerpc/fsl_uli1575: fix kconfig warnings and build errors Neither FSL_SOC_BOOKE nor PPC_86xx enables CONFIG_PCI by default, so it may be unset in some randconfigs. When that happens, FSL_ULI1575 may be set when it should not be since it is a PCI driver. When it is set, there are 3 kconfig warnings and a slew of build errors WARNING: unmet direct dependencies detected for PCI_QUIRKS Depends on [n]: PCI [=n] Selected by [y]: - FSL_PCI [=y] WARNING: unmet direct dependencies detected for GENERIC_ISA_DMA Depends on [n]: ISA_DMA_API [=n] Selected by [y]: - FSL_ULI1575 [=y] && (FSL_SOC_BOOKE [=n] || PPC_86xx [=y]) WARNING: unmet direct dependencies detected for PPC_INDIRECT_PCI Depends on [n]: PCI [=n] Selected by [y]: - FSL_PCI [=y] and 30+ build errors. Fixes: 22fdf79171e8 ("powerpc/fsl_uli1575: Allow to disable FSL_ULI1575 support") Signed-off-by: Randy Dunlap Reviewed-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230429043519.19807-1-rdunlap@infradead.org commit 79de36042eecb684e0f748d17ba52f365fde0d65 Author: Rob Herring Date: Fri May 5 12:18:17 2023 -0500 powerpc/isa-bridge: Fix ISA mapping when "ranges" is not present Commit e4ab08be5b49 ("powerpc/isa-bridge: Remove open coded "ranges" parsing") broke PASemi Nemo board booting. The issue is the ISA I/O range was not getting mapped as the logic to handle no "ranges" was inverted. If phb_io_base_phys is non-zero, then the ISA range defaults to the first 64K of the PCI I/O space. phb_io_base_phys should only be 0 when looking for a non-PCI ISA region. Fixes: e4ab08be5b49 ("powerpc/isa-bridge: Remove open coded "ranges" parsing") Reported-by: Christian Zigotzky Link: https://lore.kernel.org/all/301595ad-0edf-2113-b55f-f5b8051ed24c@xenosoft.de/ Signed-off-by: Rob Herring Tested-by: Christian Zigotzky Signed-off-by: Michael Ellerman Link: https://msgid.link/20230505171816.3175865-1-robh@kernel.org commit 1a7edd041f2d252f251523ba3f2eaead076a8f8d Author: Keoseong Park Date: Tue Apr 25 12:17:21 2023 +0900 scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend Even when urgent BKOPS fails, the consumer will get stuck in runtime suspend status. Like commit 1a5665fc8d7a ("scsi: ufs: core: WLUN suspend SSU/enter hibern8 fail recovery"), trigger the error handler and return -EBUSY to break the suspend. Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Signed-off-by: Keoseong Park Link: https://lore.kernel.org/r/20230425031721epcms2p5d4de65616478c967d466626e20c42a3a@epcms2p5 Reviewed-by: Avri Altman Signed-off-by: Martin K. Petersen commit ae3c253f595b31ff30d55b4c50b4470e56bc4e0d Author: Arnd Bergmann Date: Tue Apr 18 11:15:48 2023 +0200 media: platform: mtk-mdp3: work around unused-variable warning When CONFIG_OF is disabled, the 'data' variable is not used at all because of_match_node() turns into a dummy macro: drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c: In function 'mdp_comp_sub_create': drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c:1038:36: error: unused variable 'data' [-Werror=unused-variable] 1038 | const struct mtk_mdp_driver_data *data = mdp->mdp_data; | ^~~~ Remove the variable again by moving the pointer dereference into the of_match_node call. Fixes: b385b991ef2f ("media: platform: mtk-mdp3: chip config split about subcomponents") Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil commit 55e2a6e36be6d61f914898ce731f9321c0dcf4e8 Author: Arnd Bergmann Date: Tue Apr 18 11:19:55 2023 +0200 media: nxp: ignore unused suspend operations gcc warns about some functions being unused when CONFIG_PM_SLEEP is disabled: drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:328:12: error: 'mxc_isi_pm_resume' defined but not used [-Werror=unused-function] 328 | static int mxc_isi_pm_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~ drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:314:12: error: 'mxc_isi_pm_suspend' defined but not used [-Werror=unused-function] 314 | static int mxc_isi_pm_suspend(struct device *dev) | ^~~~~~~~~~~~~~~~~~ Use the modern SYSTEM_SLEEP_PM_OPS()/RUNTIME_PM_OPS() helpers in place of the old SET_SYSTEM_SLEEP_PM_OPS()/SET_RUNTIME_PM_OPS() ones. By convention, use pm_ptr() to guard the reference to the operations. This makes no difference as long as the driver requires CONFIG_PM, but is what users of SET_RUNTIME_PM_OPS() are supposed to do. Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") Reviewed-by: Laurent Pinchart Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil commit e10707d5865c90d3dfe4ef589ce02ff4287fef85 Author: Niklas Söderlund Date: Sat Feb 11 21:55:34 2023 +0100 media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE When adding proper support for V4L2_FIELD_ALTERNATE it was missed that this field format should trigger an interrupt for each field, not just for the whole frame. Fix this by marking it as progressive in the capture setup, which will then select the correct interrupt mode. Tested on both Gen2 and Gen3 with the result of a doubling of the frame rate for V4L2_FIELD_ALTERNATE. From a PAL video source the frame rate is now 50, which is expected for alternate field capture. Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit cb88d8289fc222bd21b7a7f99b055e7e73e316f4 Author: Niklas Söderlund Date: Sat Feb 11 21:54:32 2023 +0100 media: rcar-vin: Fix NV12 size alignment When doing format validation for NV12 the width and height should be aligned to 32 pixels. Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit 879c5a458e532b95783ce27f704d1b21573066f7 Author: Niklas Söderlund Date: Sat Feb 11 21:54:31 2023 +0100 media: rcar-vin: Gen3 can not scale NV12 The VIN modules on Gen3 can not scale NV12, fail format validation if the user tries. Currently no frames are produced if this is attempted. Signed-off-by: Niklas Söderlund Signed-off-by: Hans Verkuil commit 6ad9cf7a615287d640deb4a6530c4d9846621be0 Author: Lukas Bulwahn Date: Mon Apr 24 13:40:43 2023 +0200 MAINTAINERS: adjust file entry for ARM/APPLE MACHINE SUPPORT Commit de614ac31955 ("MAINTAINERS: Add entries for Apple PWM driver") adds an entry for Documentation/devicetree/bindings/pwm/pwm-apple.yaml, but commit 87a3a3929c71 ("dt-bindings: pwm: Add Apple PWM controller") from the same patch series actually adds the devicetree binding file with the name apple,s5l-fpwm.yaml. Adjust the file entry to the file actually added. Fixes: de614ac31955 ("MAINTAINERS: Add entries for Apple PWM driver") Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20230424114043.22475-1-lukas.bulwahn@gmail.com Signed-off-by: Krzysztof Kozlowski commit 7d8accfaa0ab65e4282c8e58950f7d688342cd86 Author: Mario Limonciello Date: Thu Apr 27 00:33:37 2023 -0500 hwmon: (k10temp) Add PCI ID for family 19, model 78h Enable k10temp on this system. [ bp: Massage. ] Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20230427053338.16653-3-mario.limonciello@amd.com commit 23a5b8bb022c1e071ca91b1a9c10f0ad6a0966e9 Author: Mario Limonciello Date: Thu Apr 27 00:33:36 2023 -0500 x86/amd_nb: Add PCI ID for family 19h model 78h Commit 310e782a99c7 ("platform/x86/amd: pmc: Utilize SMN index 0 for driver probe") switched to using amd_smn_read() which relies upon the misc PCI ID used by DF function 3 being included in a table. The ID for model 78h is missing in that table, so amd_smn_read() doesn't work. Add the missing ID into amd_nb, restoring s2idle on this system. [ bp: Simplify commit message. ] Fixes: 310e782a99c7 ("platform/x86/amd: pmc: Utilize SMN index 0 for driver probe") Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Acked-by: Bjorn Helgaas # pci_ids.h Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20230427053338.16653-2-mario.limonciello@amd.com commit e42f110700ed7293700c26145e1ed07ea05ac3f6 Author: Johan Hovold Date: Tue May 2 12:38:10 2023 +0200 phy: qcom-qmp-pcie-msm8996: fix init-count imbalance The init counter is not decremented on initialisation errors, which prevents retrying initialisation. Add the missing decrement on initialisation errors so that the counter reflects the state of the device. Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets") Cc: stable@vger.kernel.org # 4.12 Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20230502103810.12061-3-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9 Author: Johan Hovold Date: Tue May 2 12:38:09 2023 +0200 phy: qcom-qmp-combo: fix init-count imbalance The init counter is not decremented on initialisation errors, which prevents retrying initialisation and can lead to the runtime suspend callback attempting to disable resources that have never been enabled. Add the missing decrement on initialisation errors so that the counter reflects the state of the device. Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets") Cc: stable@vger.kernel.org # 4.12 Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20230502103810.12061-2-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 0019a2d4b7e37a983d133d42b707b8a3018ae6f4 Author: Randy Dunlap Date: Thu Apr 27 20:11:11 2023 -0700 sched: fix cid_lock kernel-doc warnings Fix kernel-doc warnings for cid_lock and use_cid_lock. These comments are not in kernel-doc format. kernel/sched/core.c:11496: warning: Cannot understand * @cid_lock: Guarantee forward-progress of cid allocation. on line 11496 - I thought it was a doc line kernel/sched/core.c:11505: warning: Cannot understand * @use_cid_lock: Select cid allocation behavior: lock-free vs spinlock. on line 11505 - I thought it was a doc line Fixes: 223baf9d17f2 ("sched: Fix performance regression introduced by mm_cid") Signed-off-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230428031111.322-1-rdunlap@infradead.org commit b752ea0c28e3f7f0aaaad6abf84f735eebc37a60 Author: Kan Liang Date: Fri Apr 21 11:45:28 2023 -0700 perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG Several similar kernel warnings can be triggered, [56605.607840] CPU0 PEBS record size 0, expected 32, config 0 cpuc->record_size=208 when the below commands are running in parallel for a while on SPR. while true; do perf record --no-buildid -a --intr-regs=AX \ -e cpu/event=0xd0,umask=0x81/pp \ -c 10003 -o /dev/null ./triad; done & while true; do perf record -o /tmp/out -W -d \ -e '{ld_blocks.store_forward:period=1000000, \ MEM_TRANS_RETIRED.LOAD_LATENCY:u:precise=2:ldlat=4}' \ -c 1037 ./triad; done The triad program is just the generation of loads/stores. The warnings are triggered when an unexpected PEBS record (with a different config and size) is found. A system-wide PEBS event with the large PEBS config may be enabled during a context switch. Some PEBS records for the system-wide PEBS may be generated while the old task is sched out but the new one hasn't been sched in yet. When the new task is sched in, the cpuc->pebs_record_size may be updated for the per-task PEBS events. So the existing system-wide PEBS records have a different size from the later PEBS records. The PEBS buffer should be flushed right before the hardware is reprogrammed. The new size and threshold should be updated after the old buffer has been flushed. Reported-by: Stephane Eranian Suggested-by: Peter Zijlstra (Intel) Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230421184529.3320912-1-kan.liang@linux.intel.com commit 90befef5a9e820ccccc33181ec14c015980300cc Author: Namhyung Kim Date: Wed Apr 26 20:05:27 2023 -0700 perf/x86: Fix missing sample size update on AMD BRS It missed to convert a PERF_SAMPLE_BRANCH_STACK user to call the new perf_sample_save_brstack() helper in order to update the dyn_size. This affects AMD Zen3 machines with the branch-brs event. Fixes: eb55b455ef9c ("perf/core: Add perf_sample_save_brstack() helper") Signed-off-by: Namhyung Kim Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20230427030527.580841-1-namhyung@kernel.org commit 1d1bfe30dad50d4bea83cd38d73c441972ea0173 Author: Yang Jihong Date: Tue Apr 25 10:32:17 2023 +0000 perf/core: Fix perf_sample_data not properly initialized for different swevents in perf_tp_event() data->sample_flags may be modified in perf_prepare_sample(), in perf_tp_event(), different swevents use the same on-stack perf_sample_data, the previous swevent may change sample_flags in perf_prepare_sample(), as a result, some members of perf_sample_data are not correctly initialized when next swevent_event preparing sample (for example data->id, the value varies according to swevent). A simple scenario triggers this problem is as follows: # perf record -e sched:sched_switch --switch-output-event sched:sched_switch -a sleep 1 [ perf record: dump data: Woken up 0 times ] [ perf record: Dump perf.data.2023041209014396 ] [ perf record: dump data: Woken up 0 times ] [ perf record: Dump perf.data.2023041209014662 ] [ perf record: dump data: Woken up 0 times ] [ perf record: Dump perf.data.2023041209014910 ] [ perf record: Woken up 0 times to write data ] [ perf record: Dump perf.data.2023041209015164 ] [ perf record: Captured and wrote 0.069 MB perf.data. ] # ls -l total 860 -rw------- 1 root root 95694 Apr 12 09:01 perf.data.2023041209014396 -rw------- 1 root root 606430 Apr 12 09:01 perf.data.2023041209014662 -rw------- 1 root root 82246 Apr 12 09:01 perf.data.2023041209014910 -rw------- 1 root root 82342 Apr 12 09:01 perf.data.2023041209015164 # perf script -i perf.data.2023041209014396 0x11d58 [0x80]: failed to process type: 9 [Bad address] Solution: Re-initialize perf_sample_data after each event is processed. Note that data->raw->frag.data may be accessed in perf_tp_event_match(). Therefore, need to init sample_data and then go through swevent hlist to prevent reference of NULL pointer, reported by [1]. After fix: # perf record -e sched:sched_switch --switch-output-event sched:sched_switch -a sleep 1 [ perf record: dump data: Woken up 0 times ] [ perf record: Dump perf.data.2023041209442259 ] [ perf record: dump data: Woken up 0 times ] [ perf record: Dump perf.data.2023041209442514 ] [ perf record: dump data: Woken up 0 times ] [ perf record: Dump perf.data.2023041209442760 ] [ perf record: Woken up 0 times to write data ] [ perf record: Dump perf.data.2023041209443003 ] [ perf record: Captured and wrote 0.069 MB perf.data. ] # ls -l total 864 -rw------- 1 root root 100166 Apr 12 09:44 perf.data.2023041209442259 -rw------- 1 root root 606438 Apr 12 09:44 perf.data.2023041209442514 -rw------- 1 root root 82246 Apr 12 09:44 perf.data.2023041209442760 -rw------- 1 root root 82342 Apr 12 09:44 perf.data.2023041209443003 # perf script -i perf.data.2023041209442259 | head -n 5 perf 232 [000] 66.846217: sched:sched_switch: prev_comm=perf prev_pid=232 prev_prio=120 prev_state=D ==> next_comm=perf next_pid=234 next_prio=120 perf 234 [000] 66.846449: sched:sched_switch: prev_comm=perf prev_pid=234 prev_prio=120 prev_state=S ==> next_comm=perf next_pid=232 next_prio=120 perf 232 [000] 66.846546: sched:sched_switch: prev_comm=perf prev_pid=232 prev_prio=120 prev_state=R ==> next_comm=perf next_pid=234 next_prio=120 perf 234 [000] 66.846606: sched:sched_switch: prev_comm=perf prev_pid=234 prev_prio=120 prev_state=S ==> next_comm=perf next_pid=232 next_prio=120 perf 232 [000] 66.846646: sched:sched_switch: prev_comm=perf prev_pid=232 prev_prio=120 prev_state=R ==> next_comm=perf next_pid=234 next_prio=120 [1] Link: https://lore.kernel.org/oe-lkp/202304250929.efef2caa-yujie.liu@intel.com Fixes: bb447c27a467 ("perf/core: Set data->sample_flags in perf_prepare_sample()") Signed-off-by: Yang Jihong Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230425103217.130600-1-yangjihong1@huawei.com commit 92cc5d00a431e96e5a49c0b97e5ad4fa7536bd4b Author: John Stultz Date: Wed May 3 02:33:51 2023 +0000 locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers Apparently despite it being marked inline, the compiler may not inline __down_read_common() which makes it difficult to identify the cause of lock contention, as the blocked function in traceevents will always be listed as __down_read_common(). So this patch adds __always_inline annotation to the common function (as well as the inlined helper callers) to force it to be inlined so the blocking function will be listed (via Wchan) in traceevents. Fixes: c995e638ccbb ("locking/rwsem: Fold __down_{read,write}*()") Reported-by: Tim Murray Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Waiman Long Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20230503023351.2832796-1-jstultz@google.com commit 048bce15da19e46ce5e866a48338929c76ca4152 Author: Luca Weiss Date: Wed Apr 19 17:58:27 2023 +0200 media: dt-bindings: ov2685: Correct data-lanes attribute When adapting the original doc conversion to support 2 lanes, minItems should've been added as well since the sensor supports either 1 or 2 lanes. Add minItems to make the validation happy again. Fixes: 8d561d78aeab ("media: dt-bindings: ov2685: convert to dtschema") Signed-off-by: Luca Weiss Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230419-ov2685-dtschema-fixup-v1-1-c850a34b3a26@z3ntu.xyz Signed-off-by: Krzysztof Kozlowski commit 90670ef774a8b6700c38ce1222e6aa263be54d5f Author: Ai Chao Date: Sat May 6 10:26:53 2023 +0800 ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 Add a quirk for HP EliteDesk 805 to fixup ALC3867 headset MIC no sound. Signed-off-by: Ai Chao Cc: Link: https://lore.kernel.org/r/20230506022653.2074343-1-aichao@kylinos.cn Signed-off-by: Takashi Iwai commit a4671b7fba59775845ee60cfbdfc4ba64300211b Author: Luke D. Jones Date: Sat May 6 11:58:24 2023 +1200 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 Add quirk for GU603 with 0x1c62 variant of codec. Signed-off-by: Luke D. Jones Cc: Link: https://lore.kernel.org/r/20230505235824.49607-2-luke@ljones.dev Signed-off-by: Takashi Iwai commit 0a6b36c5dc3dda0196f4fb65bdb34c38b8d060c3 Author: Jeremy Soller Date: Fri May 5 10:36:51 2023 -0600 ALSA: hda/realtek: Add quirk for Clevo L140AU Fixes headset detection on Clevo L140AU. Signed-off-by: Jeremy Soller Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20230505163651.21257-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit 949f95ff39bf188e594e7ecd8e29b82eb108f5bf Author: Jan Kara Date: Tue Apr 11 14:10:19 2023 +0200 ext4: fix lockdep warning when enabling MMP When we enable MMP in ext4_multi_mount_protect() during mount or remount, we end up calling sb_start_write() from write_mmp_block(). This triggers lockdep warning because freeze protection ranks above s_umount semaphore we are holding during mount / remount. The problem is harmless because we are guaranteed the filesystem is not frozen during mount / remount but still let's fix the warning by not grabbing freeze protection from ext4_multi_mount_protect(). Cc: stable@kernel.org Reported-by: syzbot+6b7df7d5506b32467149@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=ab7e5b6f400b7778d46f01841422e5718fb81843 Signed-off-by: Jan Kara Reviewed-by: Christian Brauner Link: https://lore.kernel.org/r/20230411121019.21940-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit fa08a7b61dff8a4df11ff1e84abfc214b487caf7 Author: Ye Bin Date: Mon Jan 16 10:00:15 2023 +0800 ext4: fix WARNING in mb_find_extent Syzbot found the following issue: EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! EXT4-fs (loop0): orphan cleanup on readonly fs ------------[ cut here ]------------ WARNING: CPU: 1 PID: 5067 at fs/ext4/mballoc.c:1869 mb_find_extent+0x8a1/0xe30 Modules linked in: CPU: 1 PID: 5067 Comm: syz-executor307 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:mb_find_extent+0x8a1/0xe30 fs/ext4/mballoc.c:1869 RSP: 0018:ffffc90003c9e098 EFLAGS: 00010293 RAX: ffffffff82405731 RBX: 0000000000000041 RCX: ffff8880783457c0 RDX: 0000000000000000 RSI: 0000000000000041 RDI: 0000000000000040 RBP: 0000000000000040 R08: ffffffff82405723 R09: ffffed10053c9402 R10: ffffed10053c9402 R11: 1ffff110053c9401 R12: 0000000000000000 R13: ffffc90003c9e538 R14: dffffc0000000000 R15: ffffc90003c9e2cc FS: 0000555556665300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056312f6796f8 CR3: 0000000022437000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ext4_mb_complex_scan_group+0x353/0x1100 fs/ext4/mballoc.c:2307 ext4_mb_regular_allocator+0x1533/0x3860 fs/ext4/mballoc.c:2735 ext4_mb_new_blocks+0xddf/0x3db0 fs/ext4/mballoc.c:5605 ext4_ext_map_blocks+0x1868/0x6880 fs/ext4/extents.c:4286 ext4_map_blocks+0xa49/0x1cc0 fs/ext4/inode.c:651 ext4_getblk+0x1b9/0x770 fs/ext4/inode.c:864 ext4_bread+0x2a/0x170 fs/ext4/inode.c:920 ext4_quota_write+0x225/0x570 fs/ext4/super.c:7105 write_blk fs/quota/quota_tree.c:64 [inline] get_free_dqblk+0x34a/0x6d0 fs/quota/quota_tree.c:130 do_insert_tree+0x26b/0x1aa0 fs/quota/quota_tree.c:340 do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375 do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375 do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375 dq_insert_tree fs/quota/quota_tree.c:401 [inline] qtree_write_dquot+0x3b6/0x530 fs/quota/quota_tree.c:420 v2_write_dquot+0x11b/0x190 fs/quota/quota_v2.c:358 dquot_acquire+0x348/0x670 fs/quota/dquot.c:444 ext4_acquire_dquot+0x2dc/0x400 fs/ext4/super.c:6740 dqget+0x999/0xdc0 fs/quota/dquot.c:914 __dquot_initialize+0x3d0/0xcf0 fs/quota/dquot.c:1492 ext4_process_orphan+0x57/0x2d0 fs/ext4/orphan.c:329 ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474 __ext4_fill_super fs/ext4/super.c:5516 [inline] ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Add some debug information: mb_find_extent: mb_find_extent block=41, order=0 needed=64 next=0 ex=0/41/1@3735929054 64 64 7 block_bitmap: ff 3f 0c 00 fc 01 00 00 d2 3d 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Acctually, blocks per group is 64, but block bitmap indicate at least has 128 blocks. Now, ext4_validate_block_bitmap() didn't check invalid block's bitmap if set. To resolve above issue, add check like fsck "Padding at end of block bitmap is not set". Cc: stable@kernel.org Reported-by: syzbot+68223fe9f6c95ad43bed@syzkaller.appspotmail.com Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230116020015.1506120-1-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit 70a640c0efa7667453c3911b13335304ce46ad8b Author: Geert Uytterhoeven Date: Wed Apr 26 15:35:45 2023 +0200 regmap: REGMAP_KUNIT should not select REGMAP Enabling a (modular) test should not silently enable additional kernel functionality, as that may increase the attack vector of a product. Fix this by: 1. making REGMAP visible if CONFIG_KUNIT_ALL_TESTS is enabled, 2. making REGMAP_KUNIT depend on REGMAP instead of selecting it. After this, one can safely enable CONFIG_KUNIT_ALL_TESTS=m to build modules for all appropriate tests for ones system, without pulling in extra unwanted functionality, while still allowing a tester to manually enable REGMAP and its test suite on a system where REGMAP is not enabled by default. Fixes: 2238959b6ad27040 ("regmap: Add some basic kunit tests") Signed-off-by: Geert Uytterhoeven Date: Fri May 5 09:28:20 2023 +0300 ASoC: dwc: limit the number of overrun messages On slow CPU (FPGA/QEMU emulated) printing overrun messages from interrupt handler to uart console may leads to more overrun errors. So use dev_err_ratelimited to limit the number of error messages. Signed-off-by: Maxim Kochetkov Date: Fri May 5 10:14:58 2023 -0600 ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12 Add pang12 quirk to enable the internal microphone. Signed-off-by: Jeremy Soller Date: Fri Apr 21 17:26:10 2023 +0200 arm64: dts: rockchip: fix nEXTRST on SOQuartz In pre-production prototypes (of which I only know one person having one, Peter Geis), GPIO0 pin A5 was tied to the SDMMC power enable pin on the CM4 connector. On all production models, this is not the case; instead, this pin is used for the nEXTRST signal, and the SDMMC power enable pin is always pulled high. Since everyone currently using the SOQuartz device trees will want this change, it is made to the tree without splitting the trees into two separate ones of which users will then inevitably choose the wrong one. This fixes USB and PCIe on a wide variety of CM4IO-compatible boards which use the nEXTRST signal. Fixes: 5859b5a9c3ac ("arm64: dts: rockchip: add SoQuartz CM4IO dts") Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20230421152610.21688-1-frattaroli.nicolas@gmail.com Signed-off-by: Heiko Stuebner commit 42dcd054a6493e1adf292c3e246d1a2a9258942e Author: Krzysztof Kozlowski Date: Sat Apr 22 00:31:48 2023 +0200 arm64: dts: rockchip: add missing cache properties As all level 2 and level 3 caches are unified, add required cache-unified properties to fix warnings like: rk3588s-khadas-edge2.dtb: l3-cache: 'cache-unified' is a dependency of 'cache-size' Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230421223149.115185-1-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 03633c4ef1fb5ee119296dfe0c411656a9b5e04f Author: Lorenz Brun Date: Fri Apr 21 23:38:41 2023 +0200 arm64: dts: rockchip: fix USB regulator on ROCK64 Currently the ROCK64 device tree specifies two regulators, vcc_host_5v and vcc_host1_5v for USB VBUS on the device. Both of those are however specified with RK_PA2 as the GPIO enabling them, causing the following error when booting: rockchip-pinctrl pinctrl: pin gpio0-2 already requested by vcc-host-5v-regulator; cannot claim for vcc-host1-5v-regulator rockchip-pinctrl pinctrl: pin-2 (vcc-host1-5v-regulator) status -22 rockchip-pinctrl pinctrl: could not request pin 2 (gpio0-2) from group usb20-host-drv on device rockchip-pinctrl reg-fixed-voltage vcc-host1-5v-regulator: Error applying setting, reverse things back Looking at the schematic, there are in fact three USB regulators, vcc_host_5v, vcc_host1_5v and vcc_otg_v5. But the enable signal for all three is driven by Q2604 which is in turn driven by GPIO_A2/PA2. Since these three regulators are not controllable separately, I removed the second one which was causing the error and added labels for all rails to the single regulator. Signed-off-by: Lorenz Brun Tested-by: Diederik de Haas Link: https://lore.kernel.org/r/20230421213841.3079632-1-lorenz@brun.one Signed-off-by: Heiko Stuebner commit ac9a78681b921877518763ba0e89202254349d1b Author: Linus Torvalds Date: Sun May 7 13:34:35 2023 -0700 Linux 6.4-rc1 commit f085df1be60abf670315c11036261cfaec16b2eb Merge: 17784de648be9 9a2d5178b9d51 Author: Linus Torvalds Date: Sun May 7 11:32:18 2023 -0700 Merge tag 'perf-tools-for-v6.4-3-2023-05-06' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tool updates from Arnaldo Carvalho de Melo: "Third version of perf tool updates, with the build problems with with using a 'vmlinux.h' generated from the main build fixed, and the bpf skeleton build disabled by default. Build: - Require libtraceevent to build, one can disable it using NO_LIBTRACEEVENT=1. It is required for tools like 'perf sched', 'perf kvm', 'perf trace', etc. libtraceevent is available in most distros so installing 'libtraceevent-devel' should be a one-time event to continue building perf as usual. Using NO_LIBTRACEEVENT=1 produces tooling that is functional and sufficient for lots of users not interested in those libtraceevent dependent features. - Allow Python support in 'perf script' when libtraceevent isn't linked, as not all features requires it, for instance Intel PT does not use tracepoints. - Error if the python interpreter needed for jevents to work isn't available and NO_JEVENTS=1 isn't set, preventing a build without support for JSON vendor events, which is a rare but possible condition. The two check error messages: $(error ERROR: No python interpreter needed for jevents generation. Install python or build with NO_JEVENTS=1.) $(error ERROR: Python interpreter needed for jevents generation too old (older than 3.6). Install a newer python or build with NO_JEVENTS=1.) - Make libbpf 1.0 the minimum required when building with out of tree, distro provided libbpf. - Use libsdtc++'s and LLVM's libcxx's __cxa_demangle, a portable C++ demangler, add 'perf test' entry for it. - Make binutils libraries opt in, as distros disable building with it due to licensing, they were used for C++ demangling, for instance. - Switch libpfm4 to opt-out rather than opt-in, if libpfm-devel (or equivalent) isn't installed, we'll just have a build warning: Makefile.config:1144: libpfm4 not found, disables libpfm4 support. Please install libpfm4-dev - Add a feature test for scandirat(), that is not implemented so far in musl and uclibc, disabling features that need it, such as scanning for tracepoints in /sys/kernel/tracing/events. perf BPF filters: - New feature where BPF can be used to filter samples, for instance: $ sudo ./perf record -e cycles --filter 'period > 1000' true $ sudo ./perf script perf-exec 2273949 546850.708501: 5029 cycles: ffffffff826f9e25 finish_wait+0x5 ([kernel.kallsyms]) perf-exec 2273949 546850.708508: 32409 cycles: ffffffff826f9e25 finish_wait+0x5 ([kernel.kallsyms]) perf-exec 2273949 546850.708526: 143369 cycles: ffffffff82b4cdbf xas_start+0x5f ([kernel.kallsyms]) perf-exec 2273949 546850.708600: 372650 cycles: ffffffff8286b8f7 __pagevec_lru_add+0x117 ([kernel.kallsyms]) perf-exec 2273949 546850.708791: 482953 cycles: ffffffff829190de __mod_memcg_lruvec_state+0x4e ([kernel.kallsyms]) true 2273949 546850.709036: 501985 cycles: ffffffff828add7c tlb_gather_mmu+0x4c ([kernel.kallsyms]) true 2273949 546850.709292: 503065 cycles: 7f2446d97c03 _dl_map_object_deps+0x973 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) - In addition to 'period' (PERF_SAMPLE_PERIOD), the other PERF_SAMPLE_ can be used for filtering, and also some other sample accessible values, from tools/perf/Documentation/perf-record.txt: Essentially the BPF filter expression is: (("," | "||") )* The can be one of: ip, id, tid, pid, cpu, time, addr, period, txn, weight, phys_addr, code_pgsz, data_pgsz, weight1, weight2, weight3, ins_lat, retire_lat, p_stage_cyc, mem_op, mem_lvl, mem_snoop, mem_remote, mem_lock, mem_dtlb, mem_blk, mem_hops The can be one of: ==, !=, >, >=, <, <=, & The can be one of: (for any term) na, load, store, pfetch, exec (for mem_op) l1, l2, l3, l4, cxl, io, any_cache, lfb, ram, pmem (for mem_lvl) na, none, hit, miss, hitm, fwd, peer (for mem_snoop) remote (for mem_remote) na, locked (for mem_locked) na, l1_hit, l1_miss, l2_hit, l2_miss, any_hit, any_miss, walk, fault (for mem_dtlb) na, by_data, by_addr (for mem_blk) hops0, hops1, hops2, hops3 (for mem_hops) perf lock contention: - Show lock type with address. - Track and show mmap_lock, siglock and per-cpu rq_lock with address. This is done for mmap_lock by following the current->mm pointer: $ sudo ./perf lock con -abl -- sleep 10 contended total wait max wait avg wait address symbol ... 16344 312.30 ms 2.22 ms 19.11 us ffff8cc702595640 17686 310.08 ms 1.49 ms 17.53 us ffff8cc7025952c0 3 84.14 ms 45.79 ms 28.05 ms ffff8cc78114c478 mmap_lock 3557 76.80 ms 68.75 us 21.59 us ffff8cc77ca3af58 1 68.27 ms 68.27 ms 68.27 ms ffff8cda745dfd70 9 54.53 ms 7.96 ms 6.06 ms ffff8cc7642a48b8 mmap_lock 14629 44.01 ms 60.00 us 3.01 us ffff8cc7625f9ca0 3481 42.63 ms 140.71 us 12.24 us ffffffff937906ac vmap_area_lock 16194 38.73 ms 42.15 us 2.39 us ffff8cd397cbc560 11 38.44 ms 10.39 ms 3.49 ms ffff8ccd6d12fbb8 mmap_lock 1 5.43 ms 5.43 ms 5.43 ms ffff8cd70018f0d8 1674 5.38 ms 422.93 us 3.21 us ffffffff92e06080 tasklist_lock 581 4.51 ms 130.68 us 7.75 us ffff8cc9b1259058 5 3.52 ms 1.27 ms 703.23 us ffff8cc754510070 112 3.47 ms 56.47 us 31.02 us ffff8ccee38b3120 381 3.31 ms 73.44 us 8.69 us ffffffff93790690 purge_vmap_area_lock 255 3.19 ms 36.35 us 12.49 us ffff8d053ce30c80 - Update default map size to 16384. - Allocate single letter option -M for --map-nr-entries, as it is proving being frequently used. - Fix struct rq lock access for older kernels with BPF's CO-RE (Compile once, run everywhere). - Fix problems found with MSAn. perf report/top: - Add inline information when using --call-graph=fp or lbr, as was already done to the --call-graph=dwarf callchain mode. - Improve the 'srcfile' sort key performance by really using an optimization introduced in 6.2 for the 'srcline' sort key that avoids calling addr2line for comparision with each sample. perf sched: - Make 'perf sched latency/map/replay' to use "sched:sched_waking" instead of "sched:sched_waking", consistent with 'perf record' since d566a9c2d482 ("perf sched: Prefer sched_waking event when it exists"). perf ftrace: - Make system wide the default target for latency subcommand, run the following command then generate some network traffic and press control+C: # perf ftrace latency -T __kfree_skb ^C DURATION | COUNT | GRAPH | 0 - 1 us | 27 | ############# | 1 - 2 us | 22 | ########### | 2 - 4 us | 8 | #### | 4 - 8 us | 5 | ## | 8 - 16 us | 24 | ############ | 16 - 32 us | 2 | # | 32 - 64 us | 1 | | 64 - 128 us | 0 | | 128 - 256 us | 0 | | 256 - 512 us | 0 | | 512 - 1024 us | 0 | | 1 - 2 ms | 0 | | 2 - 4 ms | 0 | | 4 - 8 ms | 0 | | 8 - 16 ms | 0 | | 16 - 32 ms | 0 | | 32 - 64 ms | 0 | | 64 - 128 ms | 0 | | 128 - 256 ms | 0 | | 256 - 512 ms | 0 | | 512 - 1024 ms | 0 | | 1 - ... s | 0 | | # perf top: - Add --branch-history (LBR: Last Branch Record) option, just like already available for 'perf record'. - Fix segfault in thread__comm_len() where thread->comm was being used outside thread->comm_lock. perf annotate: - Allow configuring objdump and addr2line in ~/.perfconfig., so that you can use alternative binaries, such as llvm's. perf kvm: - Add TUI mode for 'perf kvm stat report'. Reference counting: - Add reference count checking infrastructure to check for use after free, done to the 'cpumap', 'namespaces', 'maps' and 'map' structs, more to come. To build with it use -DREFCNT_CHECKING=1 in the make command line to build tools/perf. Documented at: https://perf.wiki.kernel.org/index.php/Reference_Count_Checking - The above caught, for instance, fix, present in this series: - Fix maps use after put in 'perf test "Share thread maps"': 'maps' is copied from leader, but the leader is put on line 79 and then 'maps' is used to read the reference count below - so a use after put, with the put of maps happening within thread__put. Fixed by reversing the order of puts so that the leader is put last. - Also several fixes were made to places where reference counts were not being held. - Make this one of the tests in 'make -C tools/perf build-test' to regularly build test it and to make sure no direct access to the reference counted structs are made, doing that via accessors to check the validity of the struct pointer. ARM64: - Fix 'perf report' segfault when filtering coresight traces by sparse lists of CPUs. - Add support for 'simd' as a sort field for 'perf report', to show ARM's NEON SIMD's predicate flags: "partial" and "empty". arm64 vendor events: - Add N1 metrics. Intel vendor events: - Add graniterapids, grandridge and sierraforrest events. - Refresh events for: alderlake, aldernaken, broadwell, broadwellde, broadwellx, cascadelakx, haswell, haswellx, icelake, icelakex, jaketown, meteorlake, knightslanding, sandybridge, sapphirerapids, silvermont, skylake, tigerlake and westmereep-dp - Refresh metrics for alderlake-n, broadwell, broadwellde, broadwellx, haswell, haswellx, icelakex, ivybridge, ivytown and skylakex. perf stat: - Implement --topdown using JSON metrics. - Add TopdownL1 JSON metric as a default if present, but disable it for now for some Intel hybrid architectures, a series of patches addressing this is being reviewed and will be submitted for v6.5. - Use metrics for --smi-cost. - Update topdown documentation. Vendor events (JSON) infrastructure: - Add support for computing and printing metric threshold values. For instance, here is one found in thesapphirerapids json file: { "BriefDescription": "Percentage of cycles spent in System Management Interrupts.", "MetricExpr": "((msr@aperf@ - cycles) / msr@aperf@ if msr@smi@ > 0 else 0)", "MetricGroup": "smi", "MetricName": "smi_cycles", "MetricThreshold": "smi_cycles > 0.1", "ScaleUnit": "100%" }, - Test parsing metric thresholds with the fake PMU in 'perf test pmu-events'. - Support for printing metric thresholds in 'perf list'. - Add --metric-no-threshold option to 'perf stat'. - Add rand (reverse and) and has_pmem (optane memory) support to metrics. - Sort list of input files to avoid depending on the order from readdir() helping in obtaining reproducible builds. S/390: - Add common metrics: - CPI (cycles per instruction), prbstate (ratio of instructions executed in problem state compared to total number of instructions), l1mp (Level one instruction and data cache misses per 100 instructions). - Add cache metrics for z13, z14, z15 and z16. - Add metric for TLB and cache. ARM: - Add raw decoding for SPE (Statistical Profiling Extension) v1.3 MTE (Memory Tagging Extension) and MOPS (Memory Operations) load/store. Intel PT hardware tracing: - Add event type names UINTR (User interrupt delivered) and UIRET (Exiting from user interrupt routine), documented in table 32-50 "CFE Packet Type and Vector Fields Details" in the Intel Processor Trace chapter of The Intel SDM Volume 3 version 078. - Add support for new branch instructions ERETS and ERETU. - Fix CYC timestamps after standalone CBR ARM CoreSight hardware tracing: - Allow user to override timestamp and contextid settings. - Fix segfault in dso lookup. - Fix timeless decode mode detection. - Add separate decode paths for timeless and per-thread modes. auxtrace: - Fix address filter entire kernel size. Miscellaneous: - Fix use-after-free and unaligned bugs in the PLT handling routines. - Use zfree() to reduce chances of use after free. - Add missing 0x prefix for addresses printed in hexadecimal in 'perf probe'. - Suppress massive unsupported target platform errors in the unwind code. - Fix return incorrect build_id size in elf_read_build_id(). - Fix 'perf scripts intel-pt-events.py' IPC output for Python 2 . - Add missing new parameter in kfree_skb tracepoint to the python scripts using it. - Add 'perf bench syscall fork' benchmark. - Add support for printing PERF_MEM_LVLNUM_UNC (Uncached access) in 'perf mem'. - Fix wrong size expectation for perf test 'Setup struct perf_event_attr' caused by the patch adding perf_event_attr::config3. - Fix some spelling mistakes" * tag 'perf-tools-for-v6.4-3-2023-05-06' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (365 commits) Revert "perf build: Make BUILD_BPF_SKEL default, rename to NO_BPF_SKEL" Revert "perf build: Warn for BPF skeletons if endian mismatches" perf metrics: Fix SEGV with --for-each-cgroup perf bpf skels: Stop using vmlinux.h generated from BTF, use subset of used structs + CO-RE perf stat: Separate bperf from bpf_profiler perf test record+probe_libc_inet_pton: Fix call chain match on x86_64 perf test record+probe_libc_inet_pton: Fix call chain match on s390 perf tracepoint: Fix memory leak in is_valid_tracepoint() perf cs-etm: Add fix for coresight trace for any range of CPUs perf build: Fix unescaped # in perf build-test perf unwind: Suppress massive unsupported target platform errors perf script: Add new parameter in kfree_skb tracepoint to the python scripts using it perf script: Print raw ip instead of binary offset for callchain perf symbols: Fix return incorrect build_id size in elf_read_build_id() perf list: Modify the warning message about scandirat(3) perf list: Fix memory leaks in print_tracepoint_events() perf lock contention: Rework offset calculation with BPF CO-RE perf lock contention: Fix struct rq lock access perf stat: Disable TopdownL1 on hybrid perf stat: Avoid SEGV on counter->name ... commit 17784de648be93b4eef0ef8fe28a16ff04feecc7 Merge: 6f69c981811c8 0af462f19e635 Author: Linus Torvalds Date: Sun May 7 11:04:26 2023 -0700 Merge tag 'core-debugobjects-2023-05-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects fix from Thomas Gleixner: "A single fix for debugobjects: The recent fix to ensure atomicity of lookup and allocation inadvertently broke the pool refill mechanism, so that debugobject OOMs now in certain situations. The reason is that the functions which got updated no longer invoke debug_objecs_init(), which is now the only place to care about refilling the tracking object pool. Restore the original behaviour by adding explicit refill opportunities to those places" * tag 'core-debugobjects-2023-05-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobject: Ensure pool refill (again) commit 6f69c981811c8b019d7882839e31c34ea8330860 Merge: 63342b1dd5f88 b8969a1b69672 Author: Linus Torvalds Date: Sun May 7 10:57:14 2023 -0700 Merge tag 'v6.4-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - A long-standing bug in crypto_engine - A buggy but harmless check in the sun8i-ss driver - A regression in the CRYPTO_USER interface * tag 'v6.4-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: api - Fix CRYPTO_USER checks for report function crypto: engine - fix crypto_queue backlog handling crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs() commit 63342b1dd5f884d97b41b0cd04fae01a69e0a762 Merge: d6b8a8c49ad6a 9ee04875ae734 Author: Linus Torvalds Date: Sun May 7 10:46:21 2023 -0700 Merge tag '6.4-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "smb3 client fixes, mostly DFS or reconnect related: - Two DFS connection sharing fixes - DFS refresh fix - Reconnect fix - Two potential use after free fixes - Also print prefix patch in mount debug msg - Two small cleanup fixes" * tag '6.4-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: cifs: Remove unneeded semicolon cifs: fix sharing of DFS connections cifs: avoid potential races when handling multiple dfs tcons cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath cifs: fix potential race when tree connecting ipc cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname cifs: print smb3_fs_context::source when mounting cifs: protect session status check in smb2_reconnect() SMB3.1.1: correct definition for app_instance_id create contexts commit d6b8a8c49ad6afce23c2c65a3cda0a0ccd3eaf61 Merge: 1c1094e47ef10 31c6ed4e89187 Author: Linus Torvalds Date: Sun May 7 10:31:45 2023 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A couple more patches that would be good to get into -rc1: - Revert an i.MX patch that's causing video failures because division math goes sideways - Fix a clang + W=1 build isue where FIELD_PREP() is taking a 32-bit variable instead of the usual u64 type - Fix a Kconfig bug in the StarFive JH7110 clk config that selects a reset controller when it can't be selected" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: starfive: Fix RESET_STARFIVE_JH7110 can't be selected in a specified case clk: sp7021: Adjust width of _m in HWM_FIELD_PREP() Revert "clk: imx: composite-8m: Add support to determine_rate" commit 1c1094e47ef10be267a982fb1c69dbb80aa4f257 Merge: 03e5cb7b50feb d396133dced4c Author: Linus Torvalds Date: Sun May 7 10:17:33 2023 -0700 Merge tag 'mailbox-v6.4' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - mailbox api: allow direct registration to a channel and convert omap and pcc to use mbox_bind_client - omap and hi6220 : use of_property_read_bool - test: fix double-free and use spinlock header - rockchip and bcm-pdc: drop of_match_ptr - mpfs: change config symbol - mediatek gce: support MT6795 - qcom apcs: consolidate of_device_id and support IPQ9574 * tag 'mailbox-v6.4' of git://git.linaro.org/landing-teams/working/fujitsu/integration: dt-bindings: mailbox: qcom: add compatible for IPQ9574 SoC mailbox: qcom-apcs-ipc: do not grow the of_device_id dt-bindings: mailbox: qcom,apcs-kpss-global: use fallbacks for few variants dt-bindings: mailbox: mediatek,gce-mailbox: Add support for MT6795 mailbox: mpfs: convert SOC_MICROCHIP_POLARFIRE to ARCH_MICROCHIP_POLARFIRE mailbox: bcm-pdc: drop of_match_ptr for ID table mailbox: rockchip: drop of_match_ptr for ID table mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() mailbox: mailbox-test: Explicitly include header for spinlock support mailbox: Use of_property_read_bool() for boolean properties mailbox: pcc: Use mbox_bind_client mailbox: omap: Use mbox_bind_client mailbox: Allow direct registration to a channel commit 03e5cb7b50feb687508946a702febaba24c77f0b Merge: fc4354c6e5c21 d2b7fa6174bc4 Author: Linus Torvalds Date: Sun May 7 10:00:09 2023 -0700 Merge tag 'for-6.4/io_uring-2023-05-07' of git://git.kernel.dk/linux Pull more io_uring updates from Jens Axboe: "Nothing major in here, just two different parts: - A small series from Breno that enables passing the full SQE down for ->uring_cmd(). This is a prerequisite for enabling full network socket operations. Queued up a bit late because of some stylistic concerns that got resolved, would be nice to have this in 6.4-rc1 so the dependent work will be easier to handle for 6.5. - Fix for the huge page coalescing, which was a regression introduced in the 6.3 kernel release (Tobias)" * tag 'for-6.4/io_uring-2023-05-07' of git://git.kernel.dk/linux: io_uring: Remove unnecessary BUILD_BUG_ON io_uring: Pass whole sqe to commands io_uring: Create a helper to return the SQE size io_uring/rsrc: check for nonconsecutive pages commit 27c1eaa07283b0c94becf8241f95368267cf558b Author: Christophe JAILLET Date: Fri May 5 20:39:33 2023 +0200 net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() Should of_mdiobus_register() fail, a previous usb_get_dev() call should be undone as in the .disconnect function. Fixes: 04e37d92fbed ("net: phy: add marvell usb to mdio controller") Signed-off-by: Christophe JAILLET Reviewed-by: Simon Horman Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 424f8416bb39936df6365442d651ee729b283460 Author: Eric Dumazet Date: Fri May 5 17:06:18 2023 +0000 net: skb_partial_csum_set() fix against transport header magic value skb->transport_header uses the special 0xFFFF value to mark if the transport header was set or not. We must prevent callers to accidentaly set skb->transport_header to 0xFFFF. Note that only fuzzers can possibly do this today. syzbot reported: WARNING: CPU: 0 PID: 2340 at include/linux/skbuff.h:2847 skb_transport_offset include/linux/skbuff.h:2956 [inline] WARNING: CPU: 0 PID: 2340 at include/linux/skbuff.h:2847 virtio_net_hdr_to_skb+0xbcc/0x10c0 include/linux/virtio_net.h:103 Modules linked in: CPU: 0 PID: 2340 Comm: syz-executor.0 Not tainted 6.3.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:skb_transport_header include/linux/skbuff.h:2847 [inline] RIP: 0010:skb_transport_offset include/linux/skbuff.h:2956 [inline] RIP: 0010:virtio_net_hdr_to_skb+0xbcc/0x10c0 include/linux/virtio_net.h:103 Code: 41 39 df 0f 82 c3 04 00 00 48 8b 7c 24 10 44 89 e6 e8 08 6e 59 ff 48 85 c0 74 54 e8 ce 36 7e fc e9 37 f8 ff ff e8 c4 36 7e fc <0f> 0b e9 93 f8 ff ff 44 89 f7 44 89 e6 e8 32 38 7e fc 45 39 e6 0f RSP: 0018:ffffc90004497880 EFLAGS: 00010293 RAX: ffffffff84fea55c RBX: 000000000000ffff RCX: ffff888120be2100 RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff RBP: ffffc90004497990 R08: ffffffff84fe9de5 R09: 0000000000000034 R10: ffffea00048ebd80 R11: 0000000000000034 R12: ffff88811dc2d9c8 R13: dffffc0000000000 R14: ffff88811dc2d9ae R15: 1ffff11023b85b35 FS: 00007f9211a59700(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200002c0 CR3: 00000001215a5000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: packet_snd net/packet/af_packet.c:3076 [inline] packet_sendmsg+0x4590/0x61a0 net/packet/af_packet.c:3115 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] __sys_sendto+0x472/0x630 net/socket.c:2144 __do_sys_sendto net/socket.c:2156 [inline] __se_sys_sendto net/socket.c:2152 [inline] __x64_sys_sendto+0xe5/0x100 net/socket.c:2152 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f9210c8c169 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9211a59168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f9210dabf80 RCX: 00007f9210c8c169 RDX: 000000000000ffed RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007f9210ce7ca1 R08: 0000000020000540 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe135d65cf R14: 00007f9211a59300 R15: 0000000000022000 Fixes: 66e4c8d95008 ("net: warn if transport header was not set") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Willem de Bruijn Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 9a2d5178b9d51e1c5f9e08989ff97fc8d4893f31 Author: Arnaldo Carvalho de Melo Date: Sat May 6 18:07:37 2023 -0300 Revert "perf build: Make BUILD_BPF_SKEL default, rename to NO_BPF_SKEL" This reverts commit a980755beb5aca9002e1c95ba519b83a44242b5b. We need to better polish building with BPF skels, so revert back to making it an experimental feature that has to be explicitely enabled using BUILD_BPF_SKEL=1. Signed-off-by: Arnaldo Carvalho de Melo commit c3e6df97fa25ff310c3d5e7f1644248e072e3cb0 Author: Arnaldo Carvalho de Melo Date: Sat May 6 18:06:43 2023 -0300 Revert "perf build: Warn for BPF skeletons if endian mismatches" This reverts commit 51924ae69eea5bc90b5da525fbcf4bbd5f8551b3. We need to better polish building with BPF skels, so revert back to making it an experimental feature that has to be explicitely enabled using BUILD_BPF_SKEL=1. Signed-off-by: Arnaldo Carvalho de Melo commit fc4354c6e5c21257cf4a50b32f7c11c7d65c55b3 Merge: 706ce3caea1cc da9619a30e73b Author: Linus Torvalds Date: Sat May 6 11:43:08 2023 -0700 Merge tag 'mm-stable-2023-05-06-10-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull dmapool updates - again - from Andrew Morton: "Reinstate the dmapool changes which were accidentally removed by a mishap on the last commit in the previous attempt at the series" Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup"). [ The whole old series: def8574308ed..2d55c16c0c54 results in an empty diff because that last commit ended up being just a revert of all that came everything before it. - Linus ] * tag 'mm-stable-2023-05-06-10-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: dmapool: link blocks across pages dmapool: don't memset on free twice dmapool: simplify freeing dmapool: consolidate page initialization dmapool: rearrange page alloc failure handling dmapool: move debug code to own functions dmapool: speedup DMAPOOL_DEBUG with init_on_alloc dmapool: cleanup integer types dmapool: use sysfs_emit() instead of scnprintf() dmapool: remove checks for dev == NULL commit 706ce3caea1cc1dab8c7fd6e7d1389b46ad1570e Merge: 994e2419f1e77 58f5f6698a72a Author: Linus Torvalds Date: Sat May 6 11:25:03 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-05-06-10-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "Five hotfixes. Three are cc:stable, two pertain to merge window changes" * tag 'mm-hotfixes-stable-2023-05-06-10-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: afs: fix the afs_dir_get_folio return value nilfs2: do not write dirty data after degenerating to read-only mm: do not reclaim private data from pinned page nilfs2: fix infinite loop in nilfs_mdt_get_block() mm/mmap/vma_merge: always check invariants commit da9619a30e73b59605ed998bf7bc4359f5c0029a Author: Keith Busch Date: Thu Jan 26 13:51:24 2023 -0800 dmapool: link blocks across pages The allocated dmapool pages are never freed for the lifetime of the pool. There is no need for the two level list+stack lookup for finding a free block since nothing is ever removed from the list. Just use a simple stack, reducing time complexity to constant. The implementation inserts the stack linking elements and the dma handle of the block within itself when freed. This means the smallest possible dmapool block is increased to at most 16 bytes to accommodate these fields, but there are no exisiting users requesting a dma pool smaller than that anyway. Removing the list has a significant change in performance. Using the kernel's micro-benchmarking self test: Before: # modprobe dmapool_test dmapool test: size:16 blocks:8192 time:57282 dmapool test: size:64 blocks:8192 time:172562 dmapool test: size:256 blocks:8192 time:789247 dmapool test: size:1024 blocks:2048 time:371823 dmapool test: size:4096 blocks:1024 time:362237 After: # modprobe dmapool_test dmapool test: size:16 blocks:8192 time:24997 dmapool test: size:64 blocks:8192 time:26584 dmapool test: size:256 blocks:8192 time:33542 dmapool test: size:1024 blocks:2048 time:9022 dmapool test: size:4096 blocks:1024 time:6045 The module test allocates quite a few blocks that may not accurately represent how these pools are used in real life. For a more marco level benchmark, running fio high-depth + high-batched on nvme, this patch shows submission and completion latency reduced by ~100usec each, 1% IOPs improvement, and perf record's time spent in dma_pool_alloc/free were reduced by half. [kbusch@kernel.org: push new blocks in ascending order] Link: https://lkml.kernel.org/r/20230221165400.1595247-1-kbusch@meta.com Link: https://lkml.kernel.org/r/20230126215125.4069751-12-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Tested-by: Bryan O'Donoghue Cc: Matthew Wilcox Cc: Tony Battersby Signed-off-by: Andrew Morton commit 8ecc369554219060367fc589661d2b7ab201e923 Author: Keith Busch Date: Thu Jan 26 13:51:23 2023 -0800 dmapool: don't memset on free twice If debug is enabled, dmapool will poison the range, so no need to clear it to 0 immediately before writing over it. Link: https://lkml.kernel.org/r/20230126215125.4069751-11-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Cc: Tony Battersby Signed-off-by: Andrew Morton commit cc669954ab38866c1aba73c27e17bb07bcb4a194 Author: Keith Busch Date: Thu Jan 26 13:51:22 2023 -0800 dmapool: simplify freeing The actions for busy and not busy are mostly the same, so combine these and remove the unnecessary function. Also, the pool is about to be freed so there's no need to poison the page data since we only check for poison on alloc, which can't be done on a freed pool. Link: https://lkml.kernel.org/r/20230126215125.4069751-10-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Cc: Tony Battersby Signed-off-by: Andrew Morton commit f0bccea6bc0caa0db9c68d28123f242a6295c5dd Author: Keith Busch Date: Thu Jan 26 13:51:21 2023 -0800 dmapool: consolidate page initialization Various fields of the dma pool are set in different places. Move it all to one function. Link: https://lkml.kernel.org/r/20230126215125.4069751-9-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Cc: Tony Battersby Signed-off-by: Andrew Morton commit 5407df10e5754b80d43697a75484bacda048fef8 Author: Keith Busch Date: Thu Jan 26 13:51:20 2023 -0800 dmapool: rearrange page alloc failure handling Handle the error in a condition so the good path can be in the normal flow. Link: https://lkml.kernel.org/r/20230126215125.4069751-8-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Cc: Tony Battersby Signed-off-by: Andrew Morton commit d93e08b7556fcd393b7fd1eb421cb44e5fae314c Author: Keith Busch Date: Thu Jan 26 13:51:19 2023 -0800 dmapool: move debug code to own functions Clean up the normal path by moving the debug code outside it. Link: https://lkml.kernel.org/r/20230126215125.4069751-7-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Cc: Tony Battersby Signed-off-by: Andrew Morton commit 290911c56f98ac7af9354108f3d16da5d6c5189c Author: Tony Battersby Date: Thu Jan 26 13:51:18 2023 -0800 dmapool: speedup DMAPOOL_DEBUG with init_on_alloc Avoid double-memset of the same allocated memory in dma_pool_alloc() when both DMAPOOL_DEBUG is enabled and init_on_alloc=1. Link: https://lkml.kernel.org/r/20230126215125.4069751-6-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Tony Battersby Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 790233528d338f1467662761cf1e871086483ab8 Author: Tony Battersby Date: Thu Jan 26 13:51:17 2023 -0800 dmapool: cleanup integer types To represent the size of a single allocation, dmapool currently uses 'unsigned int' in some places and 'size_t' in other places. Standardize on 'unsigned int' to reduce overhead, but use 'size_t' when counting all the blocks in the entire pool. Link: https://lkml.kernel.org/r/20230126215125.4069751-5-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Tony Battersby Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 08cc96c894848bcd1d15a79b15c56a8bb4f07ff5 Author: Tony Battersby Date: Thu Jan 26 13:51:16 2023 -0800 dmapool: use sysfs_emit() instead of scnprintf() Use sysfs_emit instead of scnprintf, snprintf or sprintf. Link: https://lkml.kernel.org/r/20230126215125.4069751-4-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Tony Battersby Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 67a540c60c39d052d9599aa9909023152200a707 Author: Tony Battersby Date: Thu Jan 26 13:51:15 2023 -0800 dmapool: remove checks for dev == NULL dmapool originally tried to support pools without a device because dma_alloc_coherent() supports allocations without a device. But nobody ended up using dma pools without a device, and trying to do so will result in an oops. So remove the checks for pool->dev == NULL since they are unneeded bloat. [kbusch@kernel.org: add check for null dev on create] Link: https://lkml.kernel.org/r/20230126215125.4069751-3-kbusch@meta.com Fixes: 2d55c16c0c54 ("dmapool: create/destroy cleanup") Signed-off-by: Tony Battersby Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 994e2419f1e77724479f0ffd5ad4eeae060dec95 Author: Linus Torvalds Date: Sat May 6 10:16:19 2023 -0700 nfs: fix mis-merged __filemap_get_folio() error check Fix another case of an incorrect check for the returned 'folio' value from __filemap_get_folio(). The failure case used to return NULL, but was changed by commit 66dabbb65d67 ("mm: return an ERR_PTR from __filemap_get_folio"). But in the meantime, commit ec108d3cc766 ("NFS: Convert readdir page array functions to use a folio") added a new user of that function. And my merge of the two did not fix this up correctly. The ext4 merge had the same issue, but that one had been caught in linux-next and got properly fixed while merging. Fixes: 0127f25b5dfc ("Merge tag 'nfs-for-6.4-1' of git://git.linux-nfs.org/projects/anna/linux-nfs") Cc: Anna Schumaker Cc: Matthew Wilcox Cc: Christoph Hellwig Signed-off-by: Linus Torvalds commit 58f5f6698a72a8af5d7bfc5f49b6df60f378f167 Author: Christoph Hellwig Date: Wed May 3 17:45:26 2023 +0200 afs: fix the afs_dir_get_folio return value Keep returning NULL on failure instead of letting an ERR_PTR escape to callers that don't expect it. Link: https://lkml.kernel.org/r/20230503154526.1223095-2-hch@lst.de Fixes: 66dabbb65d67 ("mm: return an ERR_PTR from __filemap_get_folio") Signed-off-by: Christoph Hellwig Reported-by: Jan Kara Reviewed-by: Jan Kara Reviewed-by: David Howells Tested-by: David Howells Cc: Marc Dionne Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 28a65b49eb53e172d23567005465019658bfdb4d Author: Ryusuke Konishi Date: Thu Apr 27 10:15:26 2023 +0900 nilfs2: do not write dirty data after degenerating to read-only According to syzbot's report, mark_buffer_dirty() called from nilfs_segctor_do_construct() outputs a warning with some patterns after nilfs2 detects metadata corruption and degrades to read-only mode. After such read-only degeneration, page cache data may be cleared through nilfs_clear_dirty_page() which may also clear the uptodate flag for their buffer heads. However, even after the degeneration, log writes are still performed by unmount processing etc., which causes mark_buffer_dirty() to be called for buffer heads without the "uptodate" flag and causes the warning. Since any writes should not be done to a read-only file system in the first place, this fixes the warning in mark_buffer_dirty() by letting nilfs_segctor_do_construct() abort early if in read-only mode. This also changes the retry check of nilfs_segctor_write_out() to avoid unnecessary log write retries if it detects -EROFS that nilfs_segctor_do_construct() returned. Link: https://lkml.kernel.org/r/20230427011526.13457-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Tested-by: Ryusuke Konishi Reported-by: syzbot+2af3bc9585be7f23f290@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=2af3bc9585be7f23f290 Cc: Signed-off-by: Andrew Morton commit d824ec2a154677f63c56cc71ffe4578274f6e32e Author: Jan Kara Date: Fri Apr 28 14:41:40 2023 +0200 mm: do not reclaim private data from pinned page If the page is pinned, there's no point in trying to reclaim it. Furthermore if the page is from the page cache we don't want to reclaim fs-private data from the page because the pinning process may be writing to the page at any time and reclaiming fs private info on a dirty page can upset the filesystem (see link below). Link: https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz Link: https://lkml.kernel.org/r/20230428124140.30166-1-jack@suse.cz Signed-off-by: Jan Kara Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Lorenzo Stoakes Reviewed-by: Christoph Hellwig Reviewed-by: John Hubbard Acked-by: David Hildenbrand Acked-by: Peter Xu Cc: Signed-off-by: Andrew Morton commit a6a491c048882e7e424d407d32cba0b52d9ef2bf Author: Ryusuke Konishi Date: Mon May 1 04:30:46 2023 +0900 nilfs2: fix infinite loop in nilfs_mdt_get_block() If the disk image that nilfs2 mounts is corrupted and a virtual block address obtained by block lookup for a metadata file is invalid, nilfs_bmap_lookup_at_level() may return the same internal return code as -ENOENT, meaning the block does not exist in the metadata file. This duplication of return codes confuses nilfs_mdt_get_block(), causing it to read and create a metadata block indefinitely. In particular, if this happens to the inode metadata file, ifile, semaphore i_rwsem can be left held, causing task hangs in lock_mount. Fix this issue by making nilfs_bmap_lookup_at_level() treat virtual block address translation failures with -ENOENT as metadata corruption instead of returning the error code. Link: https://lkml.kernel.org/r/20230430193046.6769-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Tested-by: Ryusuke Konishi Reported-by: syzbot+221d75710bde87fa0e97@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=221d75710bde87fa0e97 Cc: Signed-off-by: Andrew Morton commit 29417d292bd0fa174d20360326abaf6444a23c3b Author: Lorenzo Stoakes Date: Sun Apr 30 21:19:17 2023 +0100 mm/mmap/vma_merge: always check invariants We may still have inconsistent input parameters even if we choose not to merge and the vma_merge() invariant checks are useful for checking this with no production runtime cost (these are only relevant when CONFIG_DEBUG_VM is specified). Therefore, perform these checks regardless of whether we merge. This is relevant, as a recent issue (addressed in commit "mm/mempolicy: Correctly update prev when policy is equal on mbind") in the mbind logic was only picked up in the 6.2.y stable branch where these assertions are performed prior to determining mergeability. Had this remained the same in mainline this issue may have been picked up faster, so moving forward let's always check them. Link: https://lkml.kernel.org/r/df548a6ae3fa135eec3b446eb3dae8eb4227da97.1682885809.git.lstoakes@gmail.com Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Reviewed-by: David Hildenbrand Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 38a55db9877cae9aa9cc53bb0464b7434fb03e75 Author: Matthew Wilcox Date: Sat May 6 17:04:14 2023 +0100 filemap: Handle error return from __filemap_get_folio() Smatch reports that filemap_fault() was missed in the conversion of __filemap_get_folio() error returns from NULL to ERR_PTR. Fixes: 66dabbb65d67 ("mm: return an ERR_PTR from __filemap_get_folio") Reported-by: Dan Carpenter Reported-by: syzbot+48011b86c8ea329af1b9@syzkaller.appspotmail.com Reported-by: Christoph Hellwig Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Linus Torvalds commit dd9e11d6477a52ede9ebe575c83285e79e823889 Merge: a3b111b046f6c c5749639f2d0a Author: Linus Torvalds Date: Sat May 6 08:37:28 2023 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "Six late arriving patches for the merge window. Five are minor assorted fixes and updates. The IPR driver change removes SATA support, which will now allow a major cleanup in the ATA subsystem because it was the only driver still using the old attachment mechanism. The driver is only used on power systems and SATA was used to support a DVD device, which has long been moved to a different hba. IBM chose this route instead of porting ipr to the newer SATA interfaces" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qedi: Fix use after free bug in qedi_remove() scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue scsi: ipr: Remove several unused variables scsi: pm80xx: Log device registration scsi: ipr: Remove SATA support scsi: scsi_debug: Abort commands from scsi_debug_device_reset() commit a3b111b046f6ce5dff168af203daf2f46f3afb29 Merge: 7644c82319872 c0b79b0ff53be Author: Linus Torvalds Date: Sat May 6 08:28:58 2023 -0700 Merge tag 'for-6.4/block-2023-05-06' of git://git.kernel.dk/linux Pull more block updates from Jens Axboe: - MD pull request via Song: - Improve raid5 sequential IO performance on spinning disks, which fixes a regression since v6.0 (Jan Kara) - Fix bitmap offset types, which fixes an issue introduced in this merge window (Jonathan Derrick) - Cleanup of hweight type used for cgroup writeback (Maxim) - Fix a regression with the "has_submit_bio" changes across partitions (Ming) - Cleanup of QUEUE_FLAG_ADD_RANDOM clearing. We used to set this flag on queues non blk-mq queues, and hence some drivers clear it unconditionally. Since all of these have since been converted to true blk-mq drivers, drop the useless clear as the bit is not set (Chaitanya) - Fix the flags being set in a bio for a flush for drbd (Christoph) - Cleanup and deduplication of the code handling setting block device capacity (Damien) - Fix for ublk handling IO timeouts (Ming) - Fix for a regression in blk-cgroup teardown (Tao) - NBD documentation and code fixes (Eric) - Convert blk-integrity to using device_attributes rather than a second kobject to manage lifetimes (Thomas) * tag 'for-6.4/block-2023-05-06' of git://git.kernel.dk/linux: ublk: add timeout handler drbd: correctly submit flush bio on barrier mailmap: add mailmap entries for Jens Axboe block: Skip destroyed blkg when restart in blkg_destroy_all() writeback: fix call of incorrect macro md: Fix bitmap offset type in sb writer md/raid5: Improve performance for sequential IO docs nbd: userspace NBD now favors github over sourceforge block nbd: use req.cookie instead of req.handle uapi nbd: add cookie alias to handle uapi nbd: improve doc links to userspace spec blk-integrity: register sysfs attributes on struct device blk-integrity: convert to struct device_attribute blk-integrity: use sysfs_emit block/drivers: remove dead clear of random flag block: sync part's ->bd_has_submit_bio with disk's block: Cleanup set_capacity()/bdev_set_nr_sectors() commit 7644c8231987288e7aae378d2ff3c56a980d1988 Merge: 0021b532b2fdd afed6271f5b0d Author: Linus Torvalds Date: Sat May 6 08:15:20 2023 -0700 Merge tag 'pipe-nonblock-2023-05-06' of git://git.kernel.dk/linux Pull nonblocking pipe io_uring support from Jens Axboe: "Here's the revised edition of the FMODE_NOWAIT support for pipes, in which we just flag it as such supporting FMODE_NOWAIT unconditionally, but clear it if we ever end up using splice/vmsplice on the pipe. The pipe read/write side is perfectly fine for nonblocking IO, however splice and vmsplice can potentially wait for IO with the pipe lock held" * tag 'pipe-nonblock-2023-05-06' of git://git.kernel.dk/linux: pipe: set FMODE_NOWAIT on pipes splice: clear FMODE_NOWAIT on file if splice/vmsplice is used commit 0021b532b2fdd6b82cf3ff758191f00d8edd235d Merge: 27e0c8461c0aa ee2dd70347024 Author: Linus Torvalds Date: Sat May 6 08:07:11 2023 -0700 Merge tag 'sound-fix-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes for rc1. The only (LOC-wise) dominant change was ASoC Qualcomm fix, but most of it was merely a code shuffling. Another significant change here is for ALSA PCM core; it received a revert and a series of fixes for PCM auto-silencing where it caused a regression in the previous PR for rc1. Others are all small: ASoC Intel fixes, various quirks for ASoC AMD, HD-audio and USB-audio, the continued legacy emu10k1 code cleanup, and some documentation updates" * tag 'sound-fix-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (23 commits) ALSA: pcm: use exit controlled loop in snd_pcm_playback_silence() ALSA: pcm: simplify top-up mode init in snd_pcm_playback_silence() ALSA: pcm: playback silence - move silence variable updates to separate function ALSA: pcm: playback silence - remove extra code ALSA: pcm: fix playback silence - correct incremental silencing ALSA: pcm: fix playback silence - use the actual new_hw_ptr for the threshold mode ALSA: pcm: Revert "ALSA: pcm: rewrite snd_pcm_playback_silence()" ALSA: hda/realtek: Fix mute and micmute LEDs for an HP laptop ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` ALSA: usb-audio: Add quirk for Pioneer DDJ-800 ALSA: hda/realtek: support HP Pavilion Aero 13-be0xxx Mute LED ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet ASoC: amd: yc: Add Asus VivoBook Pro 14 OLED M6400RC to the quirks list for acp6x ASoC: codecs: wcd938x: fix accessing regmap on unattached devices ALSA: docs: Fix code block indentation in ALSA driver example ALSA: docs: Extend module parameters description ALSA: hda/realtek: Add quirk for ASUS UM3402YAR using CS35L41 ALSA: emu10k1: use more existing defines instead of open-coded numbers ASoC: amd: yc: Add ASUS M3402RA into DMI table ALSA: hda/realtek: Add quirk for ThinkPad P1 Gen 6 ... commit 27e0c8461c0aa2454d236924421e1c078cb77f21 Merge: 2e1e1337881b0 3302212f0384a Author: Linus Torvalds Date: Sat May 6 08:06:09 2023 -0700 Merge tag 'regulator-fix-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A trivial typo fix that came in during the merge window" * tag 'regulator-fix-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: consumer.rst: fix 'regulator_enable' typo. commit 2e1e1337881b0e9844d687982aa54b31b1269b11 Merge: ed23734c23d2f eb307d09fe158 Author: Linus Torvalds Date: Fri May 5 19:16:58 2023 -0700 Merge tag '6.4-rc-ksmbd-server-fixes-part2' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: "Ten ksmbd server fixes, including some important security fixes: - Two use after free fixes - Fix RCU callback race - Deadlock fix - Three patches to prevent session setup attacks - Prevent guest users from establishing multichannel sessions - Fix null pointer dereference in query FS info - Memleak fix" * tag '6.4-rc-ksmbd-server-fixes-part2' of git://git.samba.org/ksmbd: ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: not allow guest user on multichannel ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ksmbd: block asynchronous requests when making a delay on session setup ksmbd: destroy expired sessions ksmbd: fix racy issue from session setup and logoff ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: fix memleak in session setup commit ed23734c23d2fc1e6a1ff80f8c2b82faeed0ed0c Merge: a5e219005aeaf 644bca1d48139 Author: Linus Torvalds Date: Fri May 5 19:12:01 2023 -0700 Merge tag 'net-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter. Current release - regressions: - sched: act_pedit: free pedit keys on bail from offset check Current release - new code bugs: - pds_core: - Kconfig fixes (DEBUGFS and AUXILIARY_BUS) - fix mutex double unlock in error path Previous releases - regressions: - sched: cls_api: remove block_cb from driver_list before freeing - nf_tables: fix ct untracked match breakage - eth: mtk_eth_soc: drop generic vlan rx offload - sched: flower: fix error handler on replace Previous releases - always broken: - tcp: fix skb_copy_ubufs() vs BIG TCP - ipv6: fix skb hash for some RST packets - af_packet: don't send zero-byte data in packet_sendmsg_spkt() - rxrpc: timeout handling fixes after moving client call connection to the I/O thread - ixgbe: fix panic during XDP_TX with > 64 CPUs - igc: RMW the SRRCTL register to prevent losing timestamp config - dsa: mt7530: fix corrupt frames using TRGMII on 40 MHz XTAL MT7621 - r8152: - fix flow control issue of RTL8156A - fix the poor throughput for 2.5G devices - move setting r8153b_rx_agg_chg_indicate() to fix coalescing - enable autosuspend - ncsi: clear Tx enable mode when handling a Config required AEN - octeontx2-pf: macsec: fixes for CN10KB ASIC rev Misc: - 9p: remove INET dependency" * tag 'net-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (69 commits) net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() pds_core: fix mutex double unlock in error path net/sched: flower: fix error handler on replace Revert "net/sched: flower: Fix wrong handle assignment during filter change" net/sched: flower: fix filter idr initialization net: fec: correct the counting of XDP sent frames bonding: add xdp_features support net: enetc: check the index of the SFI rather than the handle sfc: Add back mailing list virtio_net: suppress cpu stall when free_unused_bufs ice: block LAN in case of VF to VF offload net: dsa: mt7530: fix network connectivity with multiple CPU ports net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL MT7621 9p: Remove INET dependency netfilter: nf_tables: fix ct untracked match breakage af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). igc: read before write to SRRCTL register pds_core: add AUXILIARY_BUS and NET_DEVLINK to Kconfig pds_core: remove CONFIG_DEBUG_FS from makefile ionic: catch failure from devlink_alloc ... commit a5e219005aeaf52cb10f9999a61c07a140db7097 Merge: c12753d5fa3ea 1bd922877a084 Author: Linus Torvalds Date: Fri May 5 19:07:17 2023 -0700 Merge tag 'i2c-for-6.4-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: "Some more driver bugfixes and a DT binding conversion" * tag 'i2c-for-6.4-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: brcm,kona-i2c: convert to YAML i2c: gxp: fix build failure without CONFIG_I2C_SLAVE i2c: imx-lpi2c: avoid taking clk_prepare mutex in PM callbacks i2c: omap: Fix standard mode false ACK readings i2c: tegra: Fix PEC support for SMBUS block read commit c12753d5fa3eab636b5ced91d6a2155173c11527 Author: Lukas Bulwahn Date: Sat May 6 00:39:09 2023 +0200 s390: remove the unneeded select GCC12_NO_ARRAY_BOUNDS Commit 0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") makes config GCC11_NO_ARRAY_BOUNDS to be for disabling -Warray-bounds in any gcc version 11 and upwards, and with that, removes the GCC12_NO_ARRAY_BOUNDS config as it is now covered by the semantics of GCC11_NO_ARRAY_BOUNDS. As GCC11_NO_ARRAY_BOUNDS is yes by default, there is no need for the s390 architecture to explicitly select GCC11_NO_ARRAY_BOUNDS. Hence, the select GCC12_NO_ARRAY_BOUNDS in arch/s390/Kconfig can simply be dropped. Remove the unneeded "select GCC12_NO_ARRAY_BOUNDS". Signed-off-by: Lukas Bulwahn Signed-off-by: Linus Torvalds commit 319050d4302ee9b216fb8cea847a9c4427628a98 Author: Chuck Lever Date: Thu May 4 13:43:33 2023 -0400 SUNRPC: Fix error handling in svc_setup_socket() Dan points out that sock_alloc_file() releases @sock on error, but so do all of svc_setup_socket's callers, resulting in a double- release if sock_alloc_file() returns an error. Rather than allocating a struct file for all new sockets, allocate one only for sockets created during a TCP accept. For the moment, those are the only ones that will ever be used with RPC-with-TLS. Reported-by: Dan Carpenter Fixes: ae0d77708aae ("SUNRPC: Ensure server-side sockets have a sock->file") Signed-off-by: Chuck Lever commit 6c73f819b6b6d6f052e8dbe3f66f0693554ddf48 Author: Ian Rogers Date: Fri May 5 13:41:19 2023 -0700 perf metrics: Fix SEGV with --for-each-cgroup Ensure the metric threshold is copied correctly or else a use of uninitialized memory happens. Fixes: d0a3052f6faefffc ("perf metric: Compute and print threshold values") Reported-by: Namhyung Kim Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kajol Jain Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230505204119.3443491-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a887466562b425bd6183bf75b523c1477c9fd22d Author: Arnaldo Carvalho de Melo Date: Thu May 4 19:03:51 2023 -0300 perf bpf skels: Stop using vmlinux.h generated from BTF, use subset of used structs + CO-RE Linus reported a build break due to using a vmlinux without a BTF elf section to generate the vmlinux.h header with bpftool for use in the BPF tools in tools/perf/util/bpf_skel/*.bpf.c. Instead add a vmlinux.h file with the structs needed with the fields the tools need, marking the structs with __attribute__((preserve_access_index)), so that libbpf's CO-RE code can fixup the struct field offsets. In some cases the vmlinux.h file that was being generated by bpftool from the kernel BTF information was not needed at all, just including linux/bpf.h, sometimes linux/perf_event.h was enough as non-UAPI types were not being used. To keep te patch small, include those UAPI headers from the trimmed down vmlinux.h file, that then provides the tools with just the structs and the subset of its fields needed for them. Testing it: # perf lock contention -b find / > /dev/null ^C contended total wait max wait avg wait type caller 7 53.59 us 10.86 us 7.66 us rwlock:R start_this_handle+0xa0 2 30.35 us 21.99 us 15.17 us rwsem:R iterate_dir+0x52 1 9.04 us 9.04 us 9.04 us rwlock:W start_this_handle+0x291 1 8.73 us 8.73 us 8.73 us spinlock raw_spin_rq_lock_nested+0x1e # # perf lock contention -abl find / > /dev/null ^C contended total wait max wait avg wait address symbol 1 262.96 ms 262.96 ms 262.96 ms ffff8e67502d0170 (mutex) 12 244.24 us 39.91 us 20.35 us ffff8e6af56f8070 mmap_lock (rwsem) 7 30.28 us 6.85 us 4.33 us ffff8e6c865f1d40 rq_lock (spinlock) 3 7.42 us 4.03 us 2.47 us ffff8e6c864b1d40 rq_lock (spinlock) 2 3.72 us 2.19 us 1.86 us ffff8e6c86571d40 rq_lock (spinlock) 1 2.42 us 2.42 us 2.42 us ffff8e6c86471d40 rq_lock (spinlock) 4 2.11 us 559 ns 527 ns ffffffff9a146c80 rcu_state (spinlock) 3 1.45 us 818 ns 482 ns ffff8e674ae8384c (rwlock) 1 870 ns 870 ns 870 ns ffff8e68456ee060 (rwlock) 1 663 ns 663 ns 663 ns ffff8e6c864f1d40 rq_lock (spinlock) 1 573 ns 573 ns 573 ns ffff8e6c86531d40 rq_lock (spinlock) 1 472 ns 472 ns 472 ns ffff8e6c86431740 (spinlock) 1 397 ns 397 ns 397 ns ffff8e67413a4f04 (spinlock) # # perf test offcpu 95: perf record offcpu profiling tests : Ok # # perf kwork latency --use-bpf Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (w)flush_memcg_stats_dwork | 0000 | 1056.212 ms | 2 | 2112.345 ms | 550113.229573 s | 550115.341919 s | (w)toggle_allocation_gate | 0000 | 10.144 ms | 62 | 416.389 ms | 550113.453518 s | 550113.869907 s | (w)0xffff8e6748e28080 | 0002 | 0.623 ms | 1 | 0.623 ms | 550110.989841 s | 550110.990464 s | (w)vmstat_shepherd | 0000 | 0.586 ms | 10 | 2.828 ms | 550111.971536 s | 550111.974364 s | (w)vmstat_update | 0007 | 0.363 ms | 5 | 1.634 ms | 550113.222520 s | 550113.224154 s | (w)vmstat_update | 0000 | 0.324 ms | 10 | 2.827 ms | 550111.971526 s | 550111.974354 s | (w)0xffff8e674c5f4a58 | 0002 | 0.102 ms | 5 | 0.134 ms | 550110.989839 s | 550110.989972 s | (w)psi_avgs_work | 0001 | 0.086 ms | 3 | 0.107 ms | 550114.957852 s | 550114.957959 s | (w)psi_avgs_work | 0000 | 0.079 ms | 5 | 0.100 ms | 550118.605668 s | 550118.605768 s | (w)kfree_rcu_monitor | 0006 | 0.079 ms | 1 | 0.079 ms | 550110.925821 s | 550110.925900 s | (w)psi_avgs_work | 0004 | 0.079 ms | 1 | 0.079 ms | 550109.581835 s | 550109.581914 s | (w)psi_avgs_work | 0001 | 0.078 ms | 1 | 0.078 ms | 550109.197809 s | 550109.197887 s | (w)psi_avgs_work | 0002 | 0.077 ms | 5 | 0.086 ms | 550110.669819 s | 550110.669905 s | # strace -e bpf -o perf-stat-bpf-counters.output perf stat -e cycles --bpf-counters sleep 1 Performance counter stats for 'sleep 1': 6,197,983 cycles 1.003922848 seconds time elapsed 0.000000000 seconds user 0.002032000 seconds sys # head -7 perf-stat-bpf-counters.output bpf(BPF_OBJ_GET, {pathname="/sys/fs/bpf/perf_attr_map", bpf_fd=0, file_flags=0}, 16) = 3 bpf(BPF_OBJ_GET_INFO_BY_FD, {info={bpf_fd=3, info_len=88, info=0x7ffcead64990}}, 16) = 0 bpf(BPF_MAP_LOOKUP_ELEM, {map_fd=3, key=0x24129e0, value=0x7ffcead65a48, flags=BPF_ANY}, 32) = 0 bpf(BPF_LINK_GET_FD_BY_ID, {link_id=1252}, 12) = -1 ENOENT (No such file or directory) bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SOCKET_FILTER, insn_cnt=2, insns=0x7ffcead65780, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, +func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0}, 116) = 4 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SOCKET_FILTER, insn_cnt=2, insns=0x7ffcead65920, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, +func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 128) = 4 bpf(BPF_BTF_LOAD, {btf="\237\353\1\0\30\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\5\0\0\0\1\0\0\0\0\0\0\1"..., btf_log_buf=NULL, btf_size=45, btf_log_size=0, btf_log_level=0}, 28) = 4 # Reported-by: Linus Torvalds Suggested-by: Andrii Nakryiko Tested-by: Namhyung Kim Tested-by: Song Liu Cc: Adrian Hunter Cc: Alexei Starovoitov Cc: Ian Rogers Cc: Jiri Olsa Co-developed-by: Jiri Olsa Link: https://lore.kernel.org/lkml/ZFU1PJrn8YtHIqno@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 644bca1d48139ad77570c24d22bafaf8e438cf03 Merge: 93e0401e0fc0c cb9e6e584d584 Author: Jakub Kicinski Date: Fri May 5 13:35:45 2023 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next There's a fix which landed in net-next, pull it in along with the couple of minor cleanups. Signed-off-by: Jakub Kicinski commit ecc68ee216c6c5b2f84915e1441adf436f1b019b Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Wed Apr 12 20:23:16 2023 +0200 perf stat: Separate bperf from bpf_profiler It seems that perf stat -b doesn't produce any results: $ perf stat -e cycles -b 4 -I 10000 -vvv Control descriptor is not initialized cycles: 0 0 0 time counts unit events 10.007641640 cycles Looks like this happens because fentry/fexit progs are getting loaded, but the corresponding perf event is not enabled and not added into the events bpf map. I think there is some mixing up between two type of bpf support, one for bperf and one for bpf_profiler. Both are identified via evsel__is_bpf, based on which perf events are enabled, but for the latter (bpf_profiler) a perf event is required. Using evsel__is_bperf to check only bperf produces expected results: $ perf stat -e cycles -b 4 -I 10000 -vvv Control descriptor is not initialized ------------------------------------------------------------ perf_event_attr: size 136 sample_type IDENTIFIER read_format TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING disabled 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 3 ------------------------------------------------------------ [...perf_event_attr for other CPUs...] ------------------------------------------------------------ cycles: 309426 169009 169009 time counts unit events 10.010091271 309426 cycles The final numbers correspond (at least in the level of magnitude) to the same metric obtained via bpftool. Fixes: 112cb56164bc2108 ("perf stat: Introduce config stat.bpf-counter-events") Reviewed-by: Song Liu Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Tested-by: Song Liu Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Song Liu Link: https://lore.kernel.org/r/20230412182316.11628-1-9erthalion6@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 418d5c98319f67b9ae651babea031b5394425c18 Merge: 647681bfa6784 6997f847cbb72 Author: Linus Torvalds Date: Fri May 5 13:27:59 2023 -0700 Merge tag 'devicetree-fixes-for-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Add Conor Dooley as a DT binding maintainer - Swap the order of parsing /memreserve/ and /reserved-memory nodes so that the /reserved-memory nodes which have more information are handled first - Fix some property dependencies in riscv,pmu binding - Update maintainers entries on a couple of bindings * tag 'devicetree-fixes-for-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: MAINTAINERS: add Conor as a dt-bindings maintainer dt-bindings: perf: riscv,pmu: fix property dependencies dt-bindings: xilinx: Remove Naga from memory and mtd bindings of: fdt: Scan /memreserve/ last dt-bindings: clock: r9a06g032-sysctrl: Change maintainer to Fabrizio Castro dt-bindings: pinctrl: renesas,rzv2m: Change maintainer to Fabrizio Castro dt-bindings: pinctrl: renesas,rzn1: Change maintainer to Fabrizio Castro dt-bindings: i2c: renesas,rzv2m: Change maintainer to Fabrizio Castro commit 647681bfa678400f0117d214313005cbfaf79f48 Merge: e919a3f7057b5 cdc822dda6f82 Author: Linus Torvalds Date: Fri May 5 13:16:42 2023 -0700 Merge tag 'docs-6.4-2' of git://git.lwn.net/linux Pull more documentation updates from Jonathan Corbet: "A handful of late-arriving documentation fixes, plus one Spanish translation that has been ready for some time but got applied late" * tag 'docs-6.4-2' of git://git.lwn.net/linux: docs/sp_SP: Add translation of process/adding-syscalls CREDITS: Update email address for Mat Martineau Documentation: update kernel stack for x86_64 docs: Remove unnecessary unicode character docs: fix "Reviewd" typo Documentation: timers: hrtimers: Make hybrid union historical docs/admin-guide/mm/ksm.rst fix intraface -> interface typo doc:it_IT: fix some typos commit e919a3f7057b5ca918dea98826b39a38eff9bebb Merge: b115d85a9584c 6ce2c04fcbcaa Author: Linus Torvalds Date: Fri May 5 13:11:02 2023 -0700 Merge tag 'trace-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull more tracing updates from Steven Rostedt: - Make buffer_percent read/write. The buffer_percent file is how users can state how long to block on the tracing buffer depending on how much is in the buffer. When it hits the "buffer_percent" it will wake the task waiting on the buffer. For some reason it was set to read-only. This was not noticed because testing was done as root without SELinux, but with SELinux it will prevent even root to write to it without having CAP_DAC_OVERRIDE. - The "touched_functions" was added this merge window, but one of the reasons for adding it was not implemented. That was to show what functions were not only touched, but had either a direct trampoline attached to it, or a kprobe or live kernel patching that can "hijack" the function to run a different function. The point is to know if there's functions in the kernel that may not be behaving as the kernel code shows. This can be used for debugging. TODO: Add this information to kernel oops too. * tag 'trace-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Add MODIFIED flag to show if IPMODIFY or direct was attached tracing: Fix permissions for the buffer_percent file commit b115d85a9584c98f9a7dec209d835462aa1adc09 Merge: d5ed10bb80bb3 ec570320b09f7 Author: Linus Torvalds Date: Fri May 5 12:56:55 2023 -0700 Merge tag 'locking-core-2023-05-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: - Introduce local{,64}_try_cmpxchg() - a slightly more optimal primitive, which will be used in perf events ring-buffer code - Simplify/modify rwsems on PREEMPT_RT, to address writer starvation - Misc cleanups/fixes * tag 'locking-core-2023-05-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/atomic: Correct (cmp)xchg() instrumentation locking/x86: Define arch_try_cmpxchg_local() locking/arch: Wire up local_try_cmpxchg() locking/generic: Wire up local{,64}_try_cmpxchg() locking/atomic: Add generic try_cmpxchg{,64}_local() support locking/rwbase: Mitigate indefinite writer starvation locking/arch: Rename all internal __xchg() names to __arch_xchg() commit d5ed10bb80bb376501cb56015a47457647efaabf Merge: 982365a8f5c45 798dec3304f69 Author: Linus Torvalds Date: Fri May 5 12:29:57 2023 -0700 Merge branch 'x86-uaccess-cleanup': x86 uaccess header cleanups Merge my x86 uaccess updates branch. The LAM ("Linear Address Masking") updates in this release made me unhappy about how "access_ok()" was done, and it actually turned out to have a couple of small bugs in it too. This is my cleanup of the code: - use the sign bit of the __user pointer rather than masking the address and checking it against the TASK_SIZE range. We already did this part for the get/put_user() side, but 'access_ok()' did the naïve "mask and range check" thing, which not only generates nasty code, but also ended up meaning that __access_ok itself didn't do a good job, and so copy_from_user_nmi() didn't get the check right. - move all the code that is 64-bit only into the 64-bit version of the header file, so that we don't unnecessarily pollute the shared x86 code and make it look like LAM might work in 32-bit too. - fix a bug in the address masking (that doesn't end up mattering: in this case the fix was to just remove the buggy code entirely). - a couple of trivial cleanups and added commentary about the access_ok() rules. * x86-uaccess-cleanup: x86-64: mm: clarify the 'positive addresses' user address rules x86: mm: remove 'sign' games from LAM untagged_addr*() macros x86: uaccess: move 32-bit and 64-bit parts into proper header x86: mm: remove architecture-specific 'access_ok()' define x86-64: make access_ok() independent of LAM commit 982365a8f5c453b3ecff131d60f254a7e67c9a2b Merge: 493804a6895d6 c2d3c8441e3dd Author: Linus Torvalds Date: Fri May 5 12:23:33 2023 -0700 Merge tag 'riscv-for-linus-6.4-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Palmer Dabbelt: - Support for hibernation - The .rela.dyn section has been moved to the init area - A fix for the SBI probing to allow for implementation-defined behavior - Various other fixes and cleanups throughout the tree * tag 'riscv-for-linus-6.4-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: include cpufeature.h in cpufeature.c riscv: Move .rela.dyn to the init sections dt-bindings: riscv: explicitly mention assumption of Zicsr & Zifencei support riscv: compat_syscall_table: Fixup compile warning RISC-V: fixup in-flight collision with ARCH_WANT_OPTIMIZE_VMEMMAP rename RISC-V: fix sifive and thead section mismatches in errata RISC-V: Align SBI probe implementation with spec riscv: mm: remove redundant parameter of create_fdt_early_page_table riscv: Adjust dependencies of HAVE_DYNAMIC_FTRACE selection RISC-V: Add arch functions to support hibernation/suspend-to-disk RISC-V: mm: Enable huge page support to kernel_page_present() function RISC-V: Factor out common code of __cpu_resume_enter() RISC-V: Change suspend_save_csrs and suspend_restore_csrs to public function commit 493804a6895d63240fe45d087cd14c4b77d8488b Merge: 7163a2111f6c0 7a8016d95651f Author: Linus Torvalds Date: Fri May 5 12:17:01 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more kvm updates from Paolo Bonzini: "This includes the 6.4 changes for RISC-V, and a few bugfix patches for other architectures. For x86, this closes a longstanding performance issue in the newer and (usually) more scalable page table management code. RISC-V: - ONE_REG interface to enable/disable SBI extensions - Zbb extension for Guest/VM - AIA CSR virtualization x86: - Fix a long-standing TDP MMU flaw, where unloading roots on a vCPU can result in the root being freed even though the root is completely valid and can be reused as-is (with a TLB flush). s390: - A couple of bugfixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: s390: fix race in gmap_make_secure() KVM: s390: pv: fix asynchronous teardown for small VMs KVM: x86: Preserve TDP MMU roots until they are explicitly invalidated RISC-V: KVM: Virtualize per-HART AIA CSRs RISC-V: KVM: Use bitmap for irqs_pending and irqs_pending_mask RISC-V: KVM: Add ONE_REG interface for AIA CSRs RISC-V: KVM: Implement subtype for CSR ONE_REG interface RISC-V: KVM: Initial skeletal support for AIA RISC-V: KVM: Drop the _MASK suffix from hgatp.VMID mask defines RISC-V: Detect AIA CSRs from ISA string RISC-V: Add AIA related CSR defines RISC-V: KVM: Allow Zbb extension for Guest/VM RISC-V: KVM: Add ONE_REG interface to enable/disable SBI extensions RISC-V: KVM: Alphabetize selects KVM: RISC-V: Retry fault if vma_lookup() results become invalid commit 7163a2111f6c030ee39635ac3334bfa1a52a3dd3 Merge: 817e1af1b3723 3db66620ea90b Author: Linus Torvalds Date: Fri May 5 12:10:09 2023 -0700 Merge tag 'acpi-6.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Remove an ACPI backlight quirk for Lenovo ThinkPad W530, added during the 6.3 cycle, that turned out to do more harm than help (Hans de Goede)" * tag 'acpi-6.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: video: Remove acpi_backlight=video quirk for Lenovo ThinkPad W530 commit 817e1af1b37230ef6bb40bec6ccaf9a800ee6610 Merge: b49178e68fc7e 2492ba4cd06dd Author: Linus Torvalds Date: Fri May 5 12:05:00 2023 -0700 Merge tag 'thermal-6.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "These fix a NULL pointer dereference in the Intel powerclamp driver introduced during the 6.3 cycle and update MAINTAINERS to match recent code changes. Specifics: - Fix NULL pointer access in the Intel powerclamp thermal driver that occurs on attempts to set the cooling device state to 0 in the default configuration (Srinivas Pandruvada) - Drop the stale MAINTAINERS entry for the Intel Menlow thermal driver that has been removed recently (Lukas Bulwahn)" * tag 'thermal-6.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: MAINTAINERS: remove section INTEL MENLOW THERMAL DRIVER thermal: intel: powerclamp: Fix NULL pointer access issue commit b49178e68fc7e3333c3d9f96eb09937ca84d05fd Merge: 084f51d473cd5 9d9ff3d2a4a56 Author: Linus Torvalds Date: Fri May 5 11:57:29 2023 -0700 Merge tag 'phy-fixes-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - Fix for mediatek driver warning for variable used uninitialized and for wrong pll math * tag 'phy-fixes-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: mediatek: hdmi: mt8195: fix wrong pll calculus phy: mediatek: hdmi: mt8195: fix uninitialized variable usage in pll_calc commit 084f51d473cd566eab310d5da56fe7b68d0b10be Merge: 78b421b6a7c6d 1bef84af084e9 Author: Linus Torvalds Date: Fri May 5 11:49:22 2023 -0700 Merge tag 'drm-next-2023-05-05' of git://anongit.freedesktop.org/drm/drm Pull more drm fixes from Dave Airlie: "This is the fixes for the last couple of weeks for i915 and last 3 weeks for amdgpu, lots of them but pretty scattered around and all pretty small. amdgpu: - SR-IOV fixes - DCN 3.2 fixes - DC mclk handling fixes - eDP fixes - SubVP fixes - HDCP regression fix - DSC fixes - DC FP fixes - DCN 3.x fixes - Display flickering fix when switching between vram and gtt - Z8 power saving fix - Fix hang when skipping modeset - GPU reset fixes - Doorbell fix when resizing BARs - Fix spurious warnings in gmc - Locking fix for AMDGPU_SCHED IOCTL - SR-IOV fix - DCN 3.1.4 fix - DCN 3.2 fix - Fix job cleanup when CS is aborted i915: - skl pipe source size check - mtl transcoder mask fix - DSI power on sequence fix - GuC versioning corner case fix" * tag 'drm-next-2023-05-05' of git://anongit.freedesktop.org/drm/drm: (48 commits) drm/amdgpu: drop redundant sched job cleanup when cs is aborted drm/amd/display: filter out invalid bits in pipe_fuses drm/amd/display: Change default Z8 watermark values drm/amdgpu: disable SDMA WPTR_POLL_ENABLE for SR-IOV drm/amdgpu: add a missing lock for AMDGPU_SCHED drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini() drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini drm/amdgpu: Enable doorbell selfring after resize FB BAR drm/amdgpu: Use the default reset when loading or reloading the driver drm/amdgpu: Fix mode2 reset for sienna cichlid drm/i915/dsi: Use unconditional msleep() instead of intel_dsi_msleep() drm/i915/mtl: Add the missing CPU transcoder mask in intel_device_info drm/i915/guc: Actually return an error if GuC version range check fails drm/amd/display: Lowering min Z8 residency time drm/amd/display: fix flickering caused by S/G mode drm/amd/display: Set min_width and min_height capability for DCN30 drm/amd/display: Isolate remaining FPU code in DCN32 drm/amd/display: Update bounding box values for DCN321 drm/amd/display: Do not clear GPINT register when releasing DMUB from reset ... commit 978134c4b192ed04ecf699be3e1b4d23b5d20457 Author: Dmitry Torokhov Date: Fri May 5 11:16:07 2023 -0700 Input: fix open count when closing inhibited device Because the kernel increments device's open count in input_open_device() even if device is inhibited, the counter should always be decremented in input_close_device() to keep it balanced. Fixes: a181616487db ("Input: Add "inhibited" property") Reviewed-by: Peter Hutterer Link: https://lore.kernel.org/r/ZFFz0xAdPNSL3PT7@google.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit ee2dd703470242f1672403e83f827391afeca808 Author: Oswald Buddenhagen Date: Fri May 5 17:52:44 2023 +0200 ALSA: pcm: use exit controlled loop in snd_pcm_playback_silence() We already know that `frames` is greater than zero, because we just checked it. So we don't need to check the loop condition on the first iteration. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230505155244.2312199-7-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 6ffa6f397e80bc196ed554e4dabfe43ecc0fe7c1 Author: Oswald Buddenhagen Date: Fri May 5 17:52:43 2023 +0200 ALSA: pcm: simplify top-up mode init in snd_pcm_playback_silence() Inline the remaining call of snd_pcm_playback_hw_avail(). This makes the top-up branch more congruent with the thresholded one, and allows simplifying the handling of the corner cases. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230505155244.2312199-6-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 6d8d56db0cd14c415c26e27d949c615750c40d70 Author: Jaroslav Kysela Date: Fri May 5 17:52:42 2023 +0200 ALSA: pcm: playback silence - move silence variable updates to separate function The code tracking the added samples in thresholded mode and the code tracking the just played samples in top-up mode are semantically identical, so factor it out to a common function to enhance readability. Co-developed-by: Oswald Buddenhagen Signed-off-by: Oswald Buddenhagen Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230505155244.2312199-5-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 190cb66a4ee0ac4419e1f8a9de46074a8c8e4c23 Author: Jaroslav Kysela Date: Fri May 5 17:52:41 2023 +0200 ALSA: pcm: playback silence - remove extra code The removed condition handles de facto only one situation where runtime->silence_filled variable is equal to runtime->buffer_size, because this variable cannot go over the buffer size. This case is implicitly caught by the required comparison of the noise distance with the threshold. Suggested-by: Oswald Buddenhagen Signed-off-by: Jaroslav Kysela Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230505155244.2312199-4-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 781b4da64b9e3dafb356b7365e7ecf273e879602 Author: Jaroslav Kysela Date: Fri May 5 17:52:40 2023 +0200 ALSA: pcm: fix playback silence - correct incremental silencing Commit 9a826ddba6e ("[ALSA] pcm core: fix silence_start calculations") came with exactly the right commit message, but the patch just made things broken in a different way: We'd fill at a too low address if the area was already partially zeroed, so we'd under-fill. This affected both thresholded mode (where it was somewhat less likely) and top-up mode (where it would be the case consistently). Co-developed-by: Oswald Buddenhagen Signed-off-by: Oswald Buddenhagen Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230505155244.2312199-3-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 2fbaa44a59887f9fd70c986f39c4ac9aebd0c8a1 Author: Jaroslav Kysela Date: Fri May 5 17:52:39 2023 +0200 ALSA: pcm: fix playback silence - use the actual new_hw_ptr for the threshold mode The snd_pcm_playback_hw_avail() function uses runtime->status->hw_ptr. Unfortunately, in case when we call this function from snd_pcm_update_hw_ptr0(), this variable contains the previous hardware pointer. Use the new_hw_ptr argument to calculate hw_avail (filled samples by the user space) to correct the threshold comparison. The new_hw_ptr argument may also be set to ULONG_MAX which means the initialization phase. In this case, use runtime->status->hw_ptr. Suggested-by: Oswald Buddenhagen Signed-off-by: Jaroslav Kysela Reviewed-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230505155244.2312199-2-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit d7f5dd9790bbf9c7357672bafb1992ee7aadf45a Author: Jaroslav Kysela Date: Fri May 5 17:52:38 2023 +0200 ALSA: pcm: Revert "ALSA: pcm: rewrite snd_pcm_playback_silence()" This reverts commit 9f656705c5faa18afb26d922cfc64f9fd103c38d. There was a regression (in the top-up mode). Unfortunately, the patch provided from the author of this commit is not easy to review. Keep the updated and new comments in headers. Also add a new comment that documents the missed API constraint which led to the regression. Reported-by: Jeff Chua Link: https://lore.kernel.org/r/CAAJw_ZsbTVd3Es373x_wTNDF7RknGhCD0r+NKUSwAO7HpLAkYA@mail.gmail.com Signed-off-by: Jaroslav Kysela Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230505155244.2312199-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 56fc217f0db4fc78e02a1b8450df06389474a5e5 Author: Kai-Heng Feng Date: Fri May 5 14:59:23 2023 +0200 ALSA: hda/realtek: Fix mute and micmute LEDs for an HP laptop There's another laptop that needs the fixup to enable mute and micmute LEDs. So do it accordingly. Signed-off-by: Kai-Heng Feng Cc: Link: https://lore.kernel.org/r/20230505125925.543601-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai commit 4a2248855fc1053ef191e3412486f05a4cc4d28b Merge: 0d727e1856ef2 ec6f82b4c63cc Author: Takashi Iwai Date: Fri May 5 17:11:08 2023 +0200 Merge tag 'asoc-fix-v6.4-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.4 A small set of fixes and device quirks that have come in during the merge window, the Qualcomm fix seems quite large but it's mainly code motion so looks larger than it is. commit 6ce2c04fcbcaa5eb086e5142ab359be306cbc3e1 Author: Steven Rostedt (Google) Date: Tue May 2 21:32:33 2023 -0400 ftrace: Add MODIFIED flag to show if IPMODIFY or direct was attached If a function had ever had IPMODIFY or DIRECT attached to it, where this is how live kernel patching and BPF overrides work, mark them and display an "M" in the enabled_functions and touched_functions files. This can be used for debugging. If a function had been modified and later there's a bug in the code related to that function, this can be used to know if the cause is possibly from a live kernel patch or a BPF program that changed the behavior of the code. Also update the documentation on the enabled_functions and touched_functions output, as it was missing direct callers and CALL_OPS. And include this new modify attribute. Link: https://lore.kernel.org/linux-trace-kernel/20230502213233.004e3ae4@gandalf.local.home Cc: Mark Rutland Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 2492ba4cd06dd24076f44327174816b04cddde90 Author: Lukas Bulwahn Date: Fri May 5 06:36:05 2023 +0200 MAINTAINERS: remove section INTEL MENLOW THERMAL DRIVER Commit 2b6a7409ac39 ("thermal: intel: menlow: Get rid of this driver") removes the driver drivers/thermal/intel/intel_menlow.c, but misses to remove its reference in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Remove the INTEL MENLOW THERMAL DRIVER section in MAINTAINERS. Fixes: 2b6a7409ac39 ("thermal: intel: menlow: Get rid of this driver") Signed-off-by: Lukas Bulwahn Signed-off-by: Rafael J. Wysocki commit 6997f847cbb72082a2e9aa0fef8ebfcc3bd4ddc5 Author: Conor Dooley Date: Thu May 4 22:58:39 2023 +0100 MAINTAINERS: add Conor as a dt-bindings maintainer Rob asked if I would be interested in helping with the dt-bindings maintenance, and since I am a glutton for punishment I accepted. Signed-off-by: Conor Dooley Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230504-renderer-alive-1c01d431b2a7@spud Signed-off-by: Rob Herring commit 7a8016d95651fecce5708ed93a24a03a9ad91c80 Merge: 29b38e765016e c148dc8e2fa40 Author: Paolo Bonzini Date: Fri May 5 06:15:09 2023 -0400 Merge tag 'kvm-s390-next-6.4-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD For 6.4 commit 29b38e765016e7b99f6ced75b359ee2b44f17269 Merge: d4fba4dfdcce1 edbdb43fc96b1 Author: Paolo Bonzini Date: Fri May 5 06:12:36 2023 -0400 Merge tag 'kvm-x86-mmu-6.4-2' of https://github.com/kvm-x86/linux into HEAD Fix a long-standing flaw in x86's TDP MMU where unloading roots on a vCPU can result in the root being freed even though the root is completely valid and can be reused as-is (with a TLB flush). commit d4fba4dfdcce1e23bc769591bc2e993118391b53 Merge: 1a5304fecee52 2f4d58f7635ae Author: Paolo Bonzini Date: Fri May 5 06:11:48 2023 -0400 Merge tag 'kvm-riscv-6.4-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.4 - ONE_REG interface to enable/disable SBI extensions - Zbb extension for Guest/VM - AIA CSR virtualization commit 9ee04875ae73412f5071f6ec1af01788ec271e7c Author: Yang Li Date: Fri May 5 08:49:25 2023 +0800 cifs: Remove unneeded semicolon ./fs/cifs/smb2pdu.c:4140:2-3: Unneeded semicolon Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4863 Signed-off-by: Yang Li Signed-off-by: Steve French commit 46dd6078dbc7e363a8bb01209da67015a1538929 Author: Randy Dunlap Date: Sun Apr 23 06:48:45 2023 +0100 ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings Fix kernel-doc warnings from the kernel test robot: jornada720_ssp.c:24: warning: Function parameter or member 'jornada_ssp_lock' not described in 'DEFINE_SPINLOCK' jornada720_ssp.c:24: warning: expecting prototype for arch/arm/mac(). Prototype was for DEFINE_SPINLOCK() instead jornada720_ssp.c:34: warning: Function parameter or member 'byte' not described in 'jornada_ssp_reverse' jornada720_ssp.c:57: warning: Function parameter or member 'byte' not described in 'jornada_ssp_byte' jornada720_ssp.c:85: warning: Function parameter or member 'byte' not described in 'jornada_ssp_inout' Link: lore.kernel.org/r/202304210535.tWby3jWF-lkp@intel.com Fixes: 69ebb22277a5 ("[ARM] 4506/1: HP Jornada 7XX: Addition of SSP Platform Driver") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Arnd Bergmann Cc: Kristoffer Ericson Cc: patches@armlinux.org.uk Signed-off-by: Russell King (Oracle) commit fa3eeb638de0c1a9d2d860e5b48259facdd65176 Author: Haibo Li Date: Mon Apr 17 10:17:07 2023 +0100 ARM: 9295/1: unwind:fix unwind abort for uleb128 case When unwind instruction is 0xb2,the subsequent instructions are uleb128 bytes. For now,it uses only the first uleb128 byte in code. For vsp increments of 0x204~0x400,use one uleb128 byte like below: 0xc06a00e4 : 0x80b27fac Compact model index: 0 0xb2 0x7f vsp = vsp + 1024 0xac pop {r4, r5, r6, r7, r8, r14} For vsp increments larger than 0x400,use two uleb128 bytes like below: 0xc06a00e4 : @0xc0cc9e0c Compact model index: 1 0xb2 0x81 0x01 vsp = vsp + 1032 0xac pop {r4, r5, r6, r7, r8, r14} The unwind works well since the decoded uleb128 byte is also 0x81. For vsp increments larger than 0x600,use two uleb128 bytes like below: 0xc06a00e4 : @0xc0cc9e0c Compact model index: 1 0xb2 0x81 0x02 vsp = vsp + 1544 0xac pop {r4, r5, r6, r7, r8, r14} In this case,the decoded uleb128 result is 0x101(vsp=0x204+(0x101<<2)). While the uleb128 used in code is 0x81(vsp=0x204+(0x81<<2)). The unwind aborts at this frame since it gets incorrect vsp. To fix this,add uleb128 decode to cover all the above case. Signed-off-by: Haibo Li Reviewed-by: Linus Walleij Reviewed-by: Alexandre Mergnat Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Russell King (Oracle) commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c Author: Florian Fainelli Date: Thu May 4 16:07:27 2023 -0700 net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() The call to phy_stop() races with the later call to phy_disconnect(), resulting in concurrent phy_suspend() calls being run from different CPUs. The final call to phy_disconnect() ensures that the PHY is stopped and suspended, too. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 1e76f42779d6a2e45107b34d79d86a57b8077630 Author: Shannon Nelson Date: Thu May 4 13:44:59 2023 -0700 pds_core: fix mutex double unlock in error path Fix a double unlock in an error handling path by unlocking as soon as the error is seen and removing unlocks in the error cleanup path. Link: https://lore.kernel.org/kernel-janitors/209a09f6-5ec6-40c7-a5ec-6260d8f54d25@kili.mountain/ Fixes: 523847df1b37 ("pds_core: add devcmd device interfaces") Reported-by: Dan Carpenter Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 1a304495082e7e73a96b9facac1eb93b6b0498a4 Merge: 26312c685ae0b fd741f0d9f702 Author: David S. Miller Date: Fri May 5 10:01:31 2023 +0100 Merge branch 'tc-action-fixes' Vlad Buslov says: ==================== Fixes for miss to tc action series Changes V1 -> V2: - Added new patch reverting Ivan's fix for the same issue. ==================== Signed-off-by: David S. Miller commit fd741f0d9f702c193b2b44225c004f8c5d5be163 Author: Vlad Buslov Date: Thu May 4 20:16:16 2023 +0200 net/sched: flower: fix error handler on replace When replacing a filter (i.e. 'fold' pointer is not NULL) the insertion of new filter to idr is postponed until later in code since handle is already provided by the user. However, the error handling code in fl_change() always assumes that the new filter had been inserted into idr. If error handler is reached when replacing existing filter it may remove it from idr therefore making it unreachable for delete or dump afterwards. Fix the issue by verifying that 'fold' argument wasn't provided by caller before calling idr_remove(). Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier") Signed-off-by: Vlad Buslov Reviewed-by: Pedro Tammela Signed-off-by: David S. Miller commit 5110f3ff6d3c986df9575c8da86630578b7f0846 Author: Vlad Buslov Date: Thu May 4 20:16:15 2023 +0200 Revert "net/sched: flower: Fix wrong handle assignment during filter change" This reverts commit 32eff6bacec2cb574677c15378169a9fa30043ef. Superseded by the following commit in this series. Signed-off-by: Vlad Buslov Signed-off-by: David S. Miller commit dd4f6bbfa646f258e5bcdfac57a5c413d687f588 Author: Vlad Buslov Date: Thu May 4 20:16:14 2023 +0200 net/sched: flower: fix filter idr initialization The cited commit moved idr initialization too early in fl_change() which allows concurrent users to access the filter that is still being initialized and is in inconsistent state, which, in turn, can cause NULL pointer dereference [0]. Since there is no obvious way to fix the ordering without reverting the whole cited commit, alternative approach taken to first insert NULL pointer into idr in order to allocate the handle but still cause fl_get() to return NULL and prevent concurrent users from seeing the filter while providing miss-to-action infrastructure with valid handle id early in fl_change(). [ 152.434728] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN [ 152.436163] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 152.437269] CPU: 4 PID: 3877 Comm: tc Not tainted 6.3.0-rc4+ #5 [ 152.438110] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 152.439644] RIP: 0010:fl_dump_key+0x8b/0x1d10 [cls_flower] [ 152.440461] Code: 01 f2 02 f2 c7 40 08 04 f2 04 f2 c7 40 0c 04 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 84 24 00 01 00 00 48 89 c8 48 c1 e8 03 <0f> b6 04 10 84 c0 74 08 3c 03 0f 8e 98 19 00 00 8b 13 85 d2 74 57 [ 152.442885] RSP: 0018:ffff88817a28f158 EFLAGS: 00010246 [ 152.443851] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 152.444826] RDX: dffffc0000000000 RSI: ffffffff8500ae80 RDI: ffff88810a987900 [ 152.445791] RBP: ffff888179d88240 R08: ffff888179d8845c R09: ffff888179d88240 [ 152.446780] R10: ffffed102f451e48 R11: 00000000fffffff2 R12: ffff88810a987900 [ 152.447741] R13: ffffffff8500ae80 R14: ffff88810a987900 R15: ffff888149b3c738 [ 152.448756] FS: 00007f5eb2a34800(0000) GS:ffff88881ec00000(0000) knlGS:0000000000000000 [ 152.449888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 152.450685] CR2: 000000000046ad19 CR3: 000000010b0bd006 CR4: 0000000000370ea0 [ 152.451641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 152.452628] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 152.453588] Call Trace: [ 152.454032] [ 152.454447] ? netlink_sendmsg+0x7a1/0xcb0 [ 152.455109] ? sock_sendmsg+0xc5/0x190 [ 152.455689] ? ____sys_sendmsg+0x535/0x6b0 [ 152.456320] ? ___sys_sendmsg+0xeb/0x170 [ 152.456916] ? do_syscall_64+0x3d/0x90 [ 152.457529] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.458321] ? ___sys_sendmsg+0xeb/0x170 [ 152.458958] ? __sys_sendmsg+0xb5/0x140 [ 152.459564] ? do_syscall_64+0x3d/0x90 [ 152.460122] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.460852] ? fl_dump_key_options.part.0+0xea0/0xea0 [cls_flower] [ 152.461710] ? _raw_spin_lock+0x7a/0xd0 [ 152.462299] ? _raw_read_lock_irq+0x30/0x30 [ 152.462924] ? nla_put+0x15e/0x1c0 [ 152.463480] fl_dump+0x228/0x650 [cls_flower] [ 152.464112] ? fl_tmplt_dump+0x210/0x210 [cls_flower] [ 152.464854] ? __kmem_cache_alloc_node+0x1a7/0x330 [ 152.465592] ? nla_put+0x15e/0x1c0 [ 152.466160] tcf_fill_node+0x515/0x9a0 [ 152.466766] ? tc_setup_offload_action+0xf0/0xf0 [ 152.467463] ? __alloc_skb+0x13c/0x2a0 [ 152.468067] ? __build_skb_around+0x330/0x330 [ 152.468814] ? fl_get+0x107/0x1a0 [cls_flower] [ 152.469503] tc_del_tfilter+0x718/0x1330 [ 152.470115] ? is_bpf_text_address+0xa/0x20 [ 152.470765] ? tc_ctl_chain+0xee0/0xee0 [ 152.471335] ? __kernel_text_address+0xe/0x30 [ 152.471948] ? unwind_get_return_address+0x56/0xa0 [ 152.472639] ? __thaw_task+0x150/0x150 [ 152.473218] ? arch_stack_walk+0x98/0xf0 [ 152.473839] ? __stack_depot_save+0x35/0x4c0 [ 152.474501] ? stack_trace_save+0x91/0xc0 [ 152.475119] ? security_capable+0x51/0x90 [ 152.475741] rtnetlink_rcv_msg+0x2c1/0x9d0 [ 152.476387] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 152.477042] ? __sys_sendmsg+0xb5/0x140 [ 152.477664] ? do_syscall_64+0x3d/0x90 [ 152.478255] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.479010] ? __stack_depot_save+0x35/0x4c0 [ 152.479679] ? __stack_depot_save+0x35/0x4c0 [ 152.480346] netlink_rcv_skb+0x12c/0x360 [ 152.480929] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 152.481517] ? do_syscall_64+0x3d/0x90 [ 152.482061] ? netlink_ack+0x1550/0x1550 [ 152.482612] ? rhashtable_walk_peek+0x170/0x170 [ 152.483262] ? kmem_cache_alloc_node+0x1af/0x390 [ 152.483875] ? _copy_from_iter+0x3d6/0xc70 [ 152.484528] netlink_unicast+0x553/0x790 [ 152.485168] ? netlink_attachskb+0x6a0/0x6a0 [ 152.485848] ? unwind_next_frame+0x11cc/0x1a10 [ 152.486538] ? arch_stack_walk+0x61/0xf0 [ 152.487169] netlink_sendmsg+0x7a1/0xcb0 [ 152.487799] ? netlink_unicast+0x790/0x790 [ 152.488355] ? iovec_from_user.part.0+0x4d/0x220 [ 152.488990] ? _raw_spin_lock+0x7a/0xd0 [ 152.489598] ? netlink_unicast+0x790/0x790 [ 152.490236] sock_sendmsg+0xc5/0x190 [ 152.490796] ____sys_sendmsg+0x535/0x6b0 [ 152.491394] ? import_iovec+0x7/0x10 [ 152.491964] ? kernel_sendmsg+0x30/0x30 [ 152.492561] ? __copy_msghdr+0x3c0/0x3c0 [ 152.493160] ? do_syscall_64+0x3d/0x90 [ 152.493706] ___sys_sendmsg+0xeb/0x170 [ 152.494283] ? may_open_dev+0xd0/0xd0 [ 152.494858] ? copy_msghdr_from_user+0x110/0x110 [ 152.495541] ? __handle_mm_fault+0x2678/0x4ad0 [ 152.496205] ? copy_page_range+0x2360/0x2360 [ 152.496862] ? __fget_light+0x57/0x520 [ 152.497449] ? mas_find+0x1c0/0x1c0 [ 152.498026] ? sockfd_lookup_light+0x1a/0x140 [ 152.498703] __sys_sendmsg+0xb5/0x140 [ 152.499306] ? __sys_sendmsg_sock+0x20/0x20 [ 152.499951] ? do_user_addr_fault+0x369/0xd80 [ 152.500595] do_syscall_64+0x3d/0x90 [ 152.501185] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.501917] RIP: 0033:0x7f5eb294f887 [ 152.502494] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 152.505008] RSP: 002b:00007ffd2c708f78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 152.506152] RAX: ffffffffffffffda RBX: 00000000642d9472 RCX: 00007f5eb294f887 [ 152.507134] RDX: 0000000000000000 RSI: 00007ffd2c708fe0 RDI: 0000000000000003 [ 152.508113] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 152.509119] R10: 00007f5eb2808708 R11: 0000000000000246 R12: 0000000000000001 [ 152.510068] R13: 0000000000000000 R14: 00007ffd2c70d1b8 R15: 0000000000485400 [ 152.511031] [ 152.511444] Modules linked in: cls_flower sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay zram zsmalloc fuse [last unloaded: mlx5_core] [ 152.515720] ---[ end trace 0000000000000000 ]--- Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier") Signed-off-by: Vlad Buslov Reviewed-by: Pedro Tammela Signed-off-by: David S. Miller commit 26312c685ae0bca61e06ac75ee158b1e69546415 Author: Shenwei Wang Date: Thu May 4 10:35:17 2023 -0500 net: fec: correct the counting of XDP sent frames In the current xdp_xmit implementation, if any single frame fails to transmit due to insufficient buffer descriptors, the function nevertheless reports success in sending all frames. This results in erroneously indicating that frames were transmitted when in fact they were dropped. This patch fixes the issue by ensureing the return value properly indicates the actual number of frames successfully transmitted, rather than potentially reporting success for all frames when some could not transmit. Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support") Signed-off-by: Gagandeep Singh Signed-off-by: Shenwei Wang Signed-off-by: David S. Miller commit cb9e6e584d58420df182102674e636fb841dae4c Author: Lorenzo Bianconi Date: Thu May 4 11:52:49 2023 +0200 bonding: add xdp_features support Introduce xdp_features support for bonding driver according to the slave devices attached to the master one. xdp_features is required whenever we want to xdp_redirect traffic into a bond device and then into selected slaves attached to it. Reviewed-by: Simon Horman Acked-by: Jay Vosburgh Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Signed-off-by: Lorenzo Bianconi Reviewed-by: Jussi Maki Tested-by: Jussi Maki Signed-off-by: David S. Miller commit 299efdc2380aac588557f4d0b2ce7bee05bd0cf2 Author: Wei Fang Date: Thu May 4 16:03:59 2023 +0800 net: enetc: check the index of the SFI rather than the handle We should check whether the current SFI (Stream Filter Instance) table is full before creating a new SFI entry. However, the previous logic checks the handle by mistake and might lead to unpredictable behavior. Fixes: 888ae5a3952b ("net: enetc: add tc flower psfp offload driver") Signed-off-by: Wei Fang Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit c00ce5470a8adeaf681865836085f72633c00a7e Author: Martin Habets Date: Thu May 4 08:28:01 2023 +0100 sfc: Add back mailing list We used to have a mailing list in the MAINTAINERS file, but removed this when we became part of Xilinx as it stopped working. Now inside AMD we have the list again. Add it back so patches will be seen by all sfc developers. Signed-off-by: Martin Habets Signed-off-by: David S. Miller commit f8bb5104394560e29017c25bcade4c6b7aabd108 Author: Wenliang Wang Date: Thu May 4 10:27:06 2023 +0800 virtio_net: suppress cpu stall when free_unused_bufs For multi-queue and large ring-size use case, the following error occurred when free_unused_bufs: rcu: INFO: rcu_sched self-detected stall on CPU. Fixes: 986a4f4d452d ("virtio_net: multiqueue support") Signed-off-by: Wenliang Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit 9f699b71c2f31c51bd1483a20e1c8ddc5986a8c9 Author: Michal Swiatkowski Date: Wed May 3 08:39:35 2023 -0700 ice: block LAN in case of VF to VF offload VF to VF traffic shouldn't go outside. To enforce it, set only the loopback enable bit in case of all ingress type rules added via the tc tool. Fixes: 0d08a441fb1a ("ice: ndo_setup_tc implementation for PF") Reported-by: Sujai Buvaneswaran Signed-off-by: Michal Swiatkowski Tested-by: George Kuruvinakunnel Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 120a56b01beed51ab5956a734adcfd2760307107 Author: Arınç ÜNAL Date: Wed May 3 00:09:47 2023 +0300 net: dsa: mt7530: fix network connectivity with multiple CPU ports On mt753x_cpu_port_enable() there's code that enables flooding for the CPU port only. Since mt753x_cpu_port_enable() runs twice when both CPU ports are enabled, port 6 becomes the only port to forward the frames to. But port 5 is the active port, so no frames received from the user ports will be forwarded to port 5 which breaks network connectivity. Every bit of the BC_FFP, UNM_FFP, and UNU_FFP bits represents a port. Fix this issue by setting the bit that corresponds to the CPU port without overwriting the other bits. Clear the bits beforehand only for the MT7531 switch. According to the documents MT7621 Giga Switch Programming Guide v0.3 and MT7531 Reference Manual for Development Board v1.0, after reset, the BC_FFP, UNM_FFP, and UNU_FFP bits are set to 1 for MT7531, 0 for MT7530. The commit 5e5502e012b8 ("net: dsa: mt7530: fix roaming from DSA user ports") silently changed the method to set the bits on the MT7530_MFC. Instead of clearing the relevant bits before mt7530_cpu_port_enable() which runs under a for loop, the commit started doing it on mt7530_cpu_port_enable(). Back then, this didn't really matter as only a single CPU port could be used since the CPU port number was hardcoded. The driver was later changed with commit 1f9a6abecf53 ("net: dsa: mt7530: get cpu-port via dp->cpu_dp instead of constant") to retrieve the CPU port via dp->cpu_dp. With that, this silent change became an issue for when using multiple CPU ports. Fixes: 5e5502e012b8 ("net: dsa: mt7530: fix roaming from DSA user ports") Signed-off-by: Arınç ÜNAL Signed-off-by: David S. Miller commit 37c218d8021e36e226add4bab93d071d30fe0704 Author: Arınç ÜNAL Date: Wed May 3 00:09:46 2023 +0300 net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL MT7621 The multi-chip module MT7530 switch with a 40 MHz oscillator on the MT7621AT, MT7621DAT, and MT7621ST SoCs forwards corrupt frames using trgmii. This is caused by the assumption that MT7621 SoCs have got 150 MHz PLL, hence using the ncpo1 value, 0x0780. My testing shows this value works on Unielec U7621-06, Bartel's testing shows it won't work on Hi-Link HLK-MT7621A and Netgear WAC104. All devices tested have got 40 MHz oscillators. Using the value for 125 MHz PLL, 0x0640, works on all boards at hand. The definitions for 125 MHz PLL exist on the Banana Pi BPI-R2 BSP source code whilst 150 MHz PLL don't. Forwarding frames using trgmii on the MCM MT7530 switch with a 25 MHz oscillator on the said MT7621 SoCs works fine because the ncpo1 value defined for it is for 125 MHz PLL. Change the 150 MHz PLL comment to 125 MHz PLL, and use the 125 MHz PLL ncpo1 values for both oscillator frequencies. Link: https://github.com/BPI-SINOVOIP/BPI-R2-bsp/blob/81d24bbce7d99524d0771a8bdb2d6663e4eb4faa/u-boot-mt/drivers/net/rt2880_eth.c#L2195 Fixes: 7ef6f6f8d237 ("net: dsa: mt7530: Add MT7621 TRGMII mode support") Tested-by: Bartel Eerdekens Signed-off-by: Arınç ÜNAL Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 78b421b6a7c6dbb6a213877c742af52330f5026d Merge: 3c4aa44343777 10f67d1fd2755 Author: Linus Torvalds Date: Thu May 4 18:33:56 2023 -0700 Merge tag 'linux-watchdog-6.4-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - Add watchdog driver for StarFive JH7100 and JH7110 Soc - Add Rockchip RK3588 devices - Add Qualcom IPQ5332 APSS, QCM2290 KPSS and SM6115 SoC devices - Add Mediatke MT8365 and MT6735 devices - Watchdog-core: Always set WDOG_HW_RUNNING when starting watchdog - Convert watchdog platform drivers to return void on the remove callback - Convert to devm_clk_get_enabled() helpers - ... and other small fixes and improvements * tag 'linux-watchdog-6.4-rc1' of git://www.linux-watchdog.org/linux-watchdog: (72 commits) watchdog: dw_wdt: Simplify clk management watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe() watchdog: starfive: Fix the warning of starfive_wdt_match watchdog: starfive: Fix the probe return error if PM and early_enable are both disabled MAINTAINERS: Add fragment for Xilinx watchdog driver watchdog: menz069_wdt: fix timeout setting watchdog: menz069_wdt: fix watchdog initialisation dt-bindings: watchdog: alphascale-asm9260: convert to DT schema watchdog: loongson1_wdt: Implement restart handler dt-bindings: watchdog: Document Qualcomm SM6115 watchdog dt-bindings: watchdog: realtek,otto-wdt: simplify requiring interrupt-names dt-bindings: watchdog: toshiba,visconti-wdt: simplify with unevaluatedProperties dt-bindings: watchdog: fsl-imx7ulp-wdt: simplify with unevaluatedProperties dt-bindings: watchdog: arm,sp805: drop unneeded minItems dt-bindings: watchdog: drop duplicated GPIO watchdog bindings dt-bindings: reset: Add binding for MediaTek MT6735 TOPRGU/WDT drivers: watchdog: Add StarFive Watchdog driver dt-bindings: watchdog: Add watchdog for StarFive JH7100 and JH7110 dt-bindings: watchdog: indentation, quotes and white-space cleanup watchdog: ebc-c384_wdt: Mark status as orphaned ... commit 1bef84af084e981550d9ecc3359baa22533d7b99 Merge: f4c41a7fd7f99 c8c2969bfcba5 Author: Dave Airlie Date: Fri May 5 11:27:25 2023 +1000 Merge tag 'drm-intel-next-fixes-2023-05-04-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-next Add missing GPU transcoder masks for MTL and fix DSI power on sequence for Nextbook Ares 8A. Fix GuC version corner case. Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZFOskabVuN45dNaA@jlahtine-mobl.ger.corp.intel.com commit f4c41a7fd7f99329e5af0ac0a236504a60bfb17c Merge: fa0d9c066dee8 1253685f0d3eb Author: Dave Airlie Date: Fri May 5 11:27:08 2023 +1000 Merge tag 'amd-drm-fixes-6.4-2023-05-03' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.4-2023-05-03: amdgpu: - GPU reset fixes - Doorbell fix when resizing BARs - Fix spurious warnings in gmc - Locking fix for AMDGPU_SCHED IOCTL - SR-IOV fix - DCN 3.1.4 fix - DCN 3.2 fix - Fix job cleanup when CS is aborted Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230504034018.7950-1-alexander.deucher@amd.com commit fa0d9c066dee8f52eabcb8416459aa0568b832f9 Merge: 6f5a5e8670587 d944eafed618a Author: Dave Airlie Date: Fri May 5 11:23:11 2023 +1000 Merge tag 'drm-intel-next-fixes-2023-04-27' of git://anongit.freedesktop.org/drm/drm-intel into drm-next One cc stable for pipe source size check on SKL+ Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZEpbSG1ZOSVqzGLx@jlahtine-mobl.ger.corp.intel.com commit 6f5a5e8670587d5066aacd0235071a166ee458fc Merge: cf03e2956af30 d893f39320e12 Author: Dave Airlie Date: Fri May 5 09:13:21 2023 +1000 Merge tag 'amd-drm-fixes-6.4-2023-04-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.4-2023-04-26: amdgpu: - SR-IOV fixes - DCN 3.2 fixes - DC mclk handling fixes - eDP fixes - SubVP fixes - HDCP regression fix - DSC fixes - DC FP fixes - DCN 3.x fixes - Display flickering fix when switching between vram and gtt - Z8 power saving fix - Fix hang when skipping modeset Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230427033012.7668-1-alexander.deucher@amd.com commit 4d276e4d3bb4a503e75086faab54f92c0a8fd368 Author: Conor Dooley Date: Tue Apr 4 19:03:22 2023 +0100 dt-bindings: perf: riscv,pmu: fix property dependencies Seemingly I mis-implemented the dependencies here. The OpenSBI docs only point out that the "riscv,event-to-mhpmcounters property is mandatory if riscv,event-to-mhpmevent is present". It never claims that riscv,event-to-mhpmcounters requires riscv,event-to-mhpmevent. Drop the dependency of riscv,event-to-mhpmcounters on riscv,event-to-mhpmevent. Fixes: 7e38085d9c59 ("dt-bindings: riscv: add SBI PMU event mappings") Signed-off-by: Conor Dooley Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20230404-tractor-confusing-8852e552539a@spud Signed-off-by: Rob Herring commit 8e3554150d6c80a84b3cb046615d1a0e943811dc Author: Paulo Alcantara Date: Sun Apr 23 23:26:51 2023 -0300 cifs: fix sharing of DFS connections When matching DFS connections, we can't rely on the values set in cifs_sb_info::prepath and cifs_tcon::tree_name as they might change during DFS failover. The DFS referrals related to a specific DFS tcon are already matched earlier in match_server(), therefore we can safely skip those checks altogether as the connection is guaranteed to be unique for the DFS tcon. Besides, when creating or finding an SMB session, make sure to also refcount any DFS root session related to it (cifs_ses::dfs_root_ses), so if a new DFS mount ends up reusing the connection from the old mount while there was an umount(2) still in progress (e.g. umount(2) -> cifs_umount() -> reconnect -> cifs_put_tcon()), the connection could potentially be put right after the umount(2) finished. Patch has minor update to include fix for unused variable issue noted by the kernel test robot Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202305041040.j7W2xQSy-lkp@intel.com/ Cc: stable@vger.kernel.org # v6.2+ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 3c4aa44343777844e425c28f1427127f3e55826f Merge: 8e15605be8bae db2993a423e3f Author: Linus Torvalds Date: Thu May 4 14:48:02 2023 -0700 Merge tag 'ceph-for-6.4-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "A few filesystem improvements, with a rather nasty use-after-free fix from Xiubo intended for stable" * tag 'ceph-for-6.4-rc1' of https://github.com/ceph/ceph-client: ceph: reorder fields in 'struct ceph_snapid_map' ceph: pass ino# instead of old_dentry if it's disconnected ceph: fix potential use-after-free bug when trimming caps ceph: implement writeback livelock avoidance using page tagging ceph: do not print the whole xattr value if it's too long commit 8e15605be8baeb9e3957c268c7d6f901c327ad5c Merge: a1fd058b07d58 21e26d5e54ab7 Author: Linus Torvalds Date: Thu May 4 14:37:53 2023 -0700 Merge tag '9p-6.4-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs Pull 9p updates from Eric Van Hensbergen: "This includes a number of patches that didn't quite make the cut last merge window while we addressed some outstanding issues and review comments. It includes some new caching modes for those that only want readahead caches and reworks how we do writeback caching so we are not keeping extra references around which both causes performance problems and uses lots of additional resources on the server. It also includes a new flag to force disabling of xattrs which can also cause major performance issues, particularly if the underlying filesystem on the server doesn't support them. Finally it adds a couple of additional mount options to better support directio and enabling caches when the server doesn't support qid.version. There was one late-breaking bug report that has also been included as its own patch where I forgot to propagate an embarassing bit-logic fix to the various variations of open" * tag '9p-6.4-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: fs/9p: Fix bit operation logic error fs/9p: Rework cache modes and add new options to Documentation fs/9p: remove writeback fid and fix per-file modes fs/9p: Add new mount modes 9p: Add additional debug flags and open modes fs/9p: allow disable of xattr support on mount fs/9p: Remove unnecessary superblock flags fs/9p: Consolidate file operations and add readahead and writeback commit d7385ba137711ea71527a605cac162610a621de8 Author: Jason Andryuk Date: Thu May 4 15:47:23 2023 -0400 9p: Remove INET dependency 9pfs can run over assorted transports, so it doesn't have an INET dependency. Drop it and remove the includes of linux/inet.h. NET_9P_FD/trans_fd.o builds without INET or UNIX and is usable over plain file descriptors. However, tcp and unix functionality is still built and would generate runtime failures if used. Add imply INET and UNIX to NET_9P_FD, so functionality is enabled by default but can still be explicitly disabled. This allows configuring 9pfs over Xen with INET and UNIX disabled. Signed-off-by: Jason Andryuk Signed-off-by: David S. Miller commit a1fd058b07d58c3372c1aba25dd65f1c9c9b65f1 Merge: 15fb96a35db7a 6152e53d9671b Author: Linus Torvalds Date: Thu May 4 13:21:16 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-05-03-16-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hitfixes from Andrew Morton: "Five hotfixes. Three are cc:stable, two for this -rc cycle" * tag 'mm-hotfixes-stable-2023-05-03-16-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: change per-VMA lock statistics to be disabled by default MAINTAINERS: update Michal Simek's email mm/mempolicy: correctly update prev when policy is equal on mbind relayfs: fix out-of-bounds access in relay_file_read kasan: hw_tags: avoid invalid virt_to_page() commit 37f225ecc2e06e21276700b42f682b0f2fe565e4 Author: Michal Simek Date: Wed May 3 10:40:55 2023 +0200 dt-bindings: xilinx: Remove Naga from memory and mtd bindings Naga is no longer works for AMD/Xilinx and there is no activity from him to continue to maintain Xilinx related drivers. Two drivers have Miquel as maintainer and for the last one add myself instead to be kept in a loop if there is any change required. Signed-off-by: Michal Simek Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/6b4cdc7158599b4a38409a03eda56e38975b6233.1683103250.git.michal.simek@amd.com Signed-off-by: Rob Herring commit 15fb96a35db7aad8eb7cf98206b10e50a966e388 Merge: 671e148d079f4 245f092268936 Author: Linus Torvalds Date: Thu May 4 13:09:43 2023 -0700 Merge tag 'mm-stable-2023-05-03-16-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - Some DAMON cleanups from Kefeng Wang - Some KSM work from David Hildenbrand, to make the PR_SET_MEMORY_MERGE ioctl's behavior more similar to KSM's behavior. [ Andrew called these "final", but I suspect we'll have a series fixing up the fact that the last commit in the dmapools series in the previous pull seems to have unintentionally just reverted all the other commits in the same series.. - Linus ] * tag 'mm-stable-2023-05-03-16-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: hwpoison: coredump: support recovery from dump_user_range() mm/page_alloc: add some comments to explain the possible hole in __pageblock_pfn_to_page() mm/ksm: move disabling KSM from s390/gmap code to KSM code selftests/ksm: ksm_functional_tests: add prctl unmerge test mm/ksm: unmerge and clear VM_MERGEABLE when setting PR_SET_MEMORY_MERGE=0 mm/damon/paddr: fix missing folio_sz update in damon_pa_young() mm/damon/paddr: minor refactor of damon_pa_mark_accessed_or_deactivate() mm/damon/paddr: minor refactor of damon_pa_pageout() commit 671e148d079f4d4eca0a98f7dadf1fe69d856374 Merge: 611c9d88302cb 0fddb79bf283a Author: Linus Torvalds Date: Thu May 4 12:45:32 2023 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "A few arm64 fixes that came in during the merge window for -rc1. The main thing is restoring the pointer authentication hwcaps, which disappeared during some recent refactoring - Fix regression in CPU erratum workaround when disabling the MMU - Fix detection of pointer authentication hwcaps - Avoid writeable, executable ELF sections in vmlinux" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: lds: move .got section out of .text arm64: kernel: remove SHF_WRITE|SHF_EXECINSTR from .idmap.text arm64: cpufeature: Fix pointer auth hwcaps arm64: Fix label placement in record_mmu_state() commit 611c9d88302cb9ac3b0f58f4a06c0ffb98345bd2 Merge: a1f749de8a610 2fa5ebe3bc4e3 Author: Linus Torvalds Date: Thu May 4 12:40:16 2023 -0700 Merge tag 'loongarch-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Better backtraces for humanization - Relay BCE exceptions to userland as SIGSEGV - Provide kernel fpu functions - Optimize memory ops (memset/memcpy/memmove) - Optimize checksum and crc32(c) calculation - Add ARCH_HAS_FORTIFY_SOURCE selection - Add function error injection support - Add ftrace with direct call support - Add basic perf tools support * tag 'loongarch-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (24 commits) tools/perf: Add basic support for LoongArch LoongArch: ftrace: Add direct call trampoline samples support LoongArch: ftrace: Add direct call support LoongArch: ftrace: Implement ftrace_find_callable_addr() to simplify code LoongArch: ftrace: Fix build error if DYNAMIC_FTRACE_WITH_REGS is not set LoongArch: ftrace: Abstract DYNAMIC_FTRACE_WITH_ARGS accesses LoongArch: Add support for function error injection LoongArch: Add ARCH_HAS_FORTIFY_SOURCE selection LoongArch: crypto: Add crc32 and crc32c hw acceleration LoongArch: Add checksum optimization for 64-bit system LoongArch: Optimize memory ops (memset/memcpy/memmove) LoongArch: Provide kernel fpu functions LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR LoongArch: Tweak the BADV and CPUCFG.PRID lines in show_regs() LoongArch: Humanize the ESTAT line when showing registers LoongArch: Humanize the ECFG line when showing registers LoongArch: Humanize the EUEN line when showing registers LoongArch: Humanize the PRMD line when showing registers LoongArch: Humanize the CRMD line when showing registers LoongArch: Fix format of CSR lines during show_regs() ... commit a1f749de8a610096ca0dd9a40d89c8fa4098c8eb Merge: 1a5304fecee52 1f62ed00a56bf Author: Linus Torvalds Date: Thu May 4 12:25:05 2023 -0700 Merge tag 'csky-for-linus-6.4' of https://github.com/c-sky/csky-linux Pull arch/csky updates from Guo Ren: - Remove CPU_TLB_SIZE config - Prevent spurious page faults * tag 'csky-for-linus-6.4' of https://github.com/c-sky/csky-linux: csky: mmu: Prevent spurious page faults csky: remove obsolete config CPU_TLB_SIZE commit b5d68f84f4c62c78bc3d004911d80da5aa22df8b Author: Srinivas Pandruvada Date: Wed May 3 16:38:50 2023 -0700 thermal: intel: powerclamp: Fix NULL pointer access issue If cur_state for the powerclamp cooling device is set to the default minimum state of 0, without setting first to cur_state > 0, this results in NULL pointer access. This NULL pointer access happens in the powercap core idle-inject function idle_inject_set_duration() as there is no NULL check for idle_inject_device pointer. This pointer must be allocated by calling idle_inject_register() or idle_inject_register_full(). In the function powerclamp_set_cur_state(), idle_inject_device pointer is allocated only when the cur_state > 0. But setting 0 without changing to any other state, idle_inject_set_duration() will be called with a NULL idle_inject_device pointer. To address this, just return from powerclamp_set_cur_state() if the current cooling device state is the same as the last one. Since the power-up default cooling device state is 0, changing the state to 0 again here will return without calling idle_inject_set_duration(). Signed-off-by: Srinivas Pandruvada Fixes: 8526eb7fc75a ("thermal: intel: powerclamp: Use powercap idle-inject feature") Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=217386 Tested-by: Risto A. Paju Cc: 6.3+ # 6.3+ Signed-off-by: Rafael J. Wysocki commit 3db66620ea90b0fd4134b31eabfec16d7b07d7e3 Author: Hans de Goede Date: Fri Apr 28 15:23:50 2023 +0200 ACPI: video: Remove acpi_backlight=video quirk for Lenovo ThinkPad W530 Remove the acpi_backlight=video quirk for Lenovo ThinkPad W530. This was intended to help users of the (unsupported) Nvidia binary driver, but this has been reported to cause backlight control issues for users who have the gfx configured in hybrid (dual-GPU) mode, so drop this. The Nvidia binary driver should call acpi_video_register_backlight() when necessary and this has been reported to Nvidia. Until this is fixed Nvidia binary driver users can work around this by passing "acpi_backlight=video" on the kernel commandline (with the latest 6.1.y or newer stable series, kernels < 6.1.y don't need this). Fixes: a5b2781dcab2 ("ACPI: video: Add acpi_backlight=video quirk for Lenovo ThinkPad W530") Reported-by: Русев Путин Link: https://lore.kernel.org/linux-acpi/CAK4BXn0ngZRmzx1bodAF8nmYj0PWdUXzPGHofRrsyZj8MBpcVA@mail.gmail.com/ Cc: 6.1+ # 6.1+ Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 9d9ff3d2a4a567b543b71c2967d2ccc5e0ac6816 Author: Guillaume Ranquet Date: Fri Apr 14 18:07:47 2023 +0200 phy: mediatek: hdmi: mt8195: fix wrong pll calculus The clock rate calculus in mtk_hdmi_pll_calc() was wrong when it has been replaced by 'div_u64'. Fix the issue by multiplying the values in the denominator instead of dividing them. Fixes: 45810d486bb44 ("phy: mediatek: add support for phy-mtk-hdmi-mt8195") Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Guillaume Ranquet Link: https://lore.kernel.org/r/20230413-fixes-for-mt8195-hdmi-phy-v2-2-bbad62e64321@baylibre.com Signed-off-by: Vinod Koul commit 714dd3c29a2241fb799586a5b03773103ca50fe5 Author: Guillaume Ranquet Date: Fri Apr 14 18:07:46 2023 +0200 phy: mediatek: hdmi: mt8195: fix uninitialized variable usage in pll_calc The ret variable in mtk_hdmi_pll_calc() was used unitialized as reported by the kernel test robot. Fix the issue by removing the variable altogether and testing out the return value of mtk_hdmi_pll_set_hw() Fixes: 45810d486bb44 ("phy: mediatek: add support for phy-mtk-hdmi-mt8195") Reported-by: kernel test robot Signed-off-by: Guillaume Ranquet Reviewed-by: Nathan Chancellor Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230413-fixes-for-mt8195-hdmi-phy-v2-1-bbad62e64321@baylibre.com Signed-off-by: Vinod Koul commit c148dc8e2fa403be501612ee409db866eeed35c0 Author: Claudio Imbrenda Date: Fri Apr 28 11:27:53 2023 +0200 KVM: s390: fix race in gmap_make_secure() Fix a potential race in gmap_make_secure() and remove the last user of follow_page() without FOLL_GET. The old code is locking something it doesn't have a reference to, and as explained by Jason and David in this discussion: https://lore.kernel.org/linux-mm/Y9J4P%2FRNvY1Ztn0Q@nvidia.com/ it can lead to all kind of bad things, including the page getting unmapped (MADV_DONTNEED), freed, reallocated as a larger folio and the unlock_page() would target the wrong bit. There is also another race with the FOLL_WRITE, which could race between the follow_page() and the get_locked_pte(). The main point is to remove the last use of follow_page() without FOLL_GET or FOLL_PIN, removing the races can be considered a nice bonus. Link: https://lore.kernel.org/linux-mm/Y9J4P%2FRNvY1Ztn0Q@nvidia.com/ Suggested-by: Jason Gunthorpe Fixes: 214d9bbcd3a6 ("s390/mm: provide memory management functions for protected KVM guests") Reviewed-by: Jason Gunthorpe Signed-off-by: Claudio Imbrenda Message-Id: <20230428092753.27913-2-imbrenda@linux.ibm.com> commit 292a7d6fca33df70ca4b8e9b0d0e74adf87582dc Author: Claudio Imbrenda Date: Fri Apr 21 10:50:36 2023 +0200 KVM: s390: pv: fix asynchronous teardown for small VMs On machines without the Destroy Secure Configuration Fast UVC, the topmost level of page tables is set aside and freed asynchronously as last step of the asynchronous teardown. Each gmap has a host_to_guest radix tree mapping host (userspace) addresses (with 1M granularity) to gmap segment table entries (pmds). If a guest is smaller than 2GB, the topmost level of page tables is the segment table (i.e. there are only 2 levels). Replacing it means that the pointers in the host_to_guest mapping would become stale and cause all kinds of nasty issues. This patch fixes the issue by disallowing asynchronous teardown for guests with only 2 levels of page tables. Userspace should (and already does) try using the normal destroy if the asynchronous one fails. Update s390_replace_asce so it refuses to replace segment type ASCEs. This is still needed in case the normal destroy VM fails. Fixes: fb491d5500a7 ("KVM: s390: pv: asynchronous destroy for reboot") Reviewed-by: Marc Hartmayer Reviewed-by: Janosch Frank Signed-off-by: Claudio Imbrenda Message-Id: <20230421085036.52511-2-imbrenda@linux.ibm.com> commit d2b7fa6174bc4260e496cbf84375c73636914641 Author: Breno Leitao Date: Thu May 4 05:18:56 2023 -0700 io_uring: Remove unnecessary BUILD_BUG_ON In the io_uring_cmd_prep_async() there is an unnecessary compilation time check to check if cmd is correctly placed at field 48 of the SQE. This is unnecessary, since this check is already in place at io_uring_init(): BUILD_BUG_SQE_ELEM(48, __u64, addr3); Remove it and the uring_cmd_pdu_size() function, which is not used anymore. Keith started a discussion about this topic in the following thread: Link: https://lore.kernel.org/lkml/ZDBmQOhbyU0iLhMw@kbusch-mbp.dhcp.thefacebook.com/ Signed-off-by: Breno Leitao Reviewed-by: Christoph Hellwig Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20230504121856.904491-4-leitao@debian.org Signed-off-by: Jens Axboe commit fd9b8547bc5c34186dc42ea05fb4380d21695374 Author: Breno Leitao Date: Thu May 4 05:18:55 2023 -0700 io_uring: Pass whole sqe to commands Currently uring CMD operation relies on having large SQEs, but future operations might want to use normal SQE. The io_uring_cmd currently only saves the payload (cmd) part of the SQE, but, for commands that use normal SQE size, it might be necessary to access the initial SQE fields outside of the payload/cmd block. So, saves the whole SQE other than just the pdu. This changes slightly how the io_uring_cmd works, since the cmd structures and callbacks are not opaque to io_uring anymore. I.e, the callbacks can look at the SQE entries, not only, in the cmd structure. The main advantage is that we don't need to create custom structures for simple commands. Creates io_uring_sqe_cmd() that returns the cmd private data as a null pointer and avoids casting in the callee side. Also, make most of ublk_drv's sqe->cmd priv structure into const, and use io_uring_sqe_cmd() to get the private structure, removing the unwanted cast. (There is one case where the cast is still needed since the header->{len,addr} is updated in the private structure) Suggested-by: Pavel Begunkov Signed-off-by: Breno Leitao Reviewed-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20230504121856.904491-3-leitao@debian.org Signed-off-by: Jens Axboe commit 96c7d4f81db0fea05c0792f7563ae0cb4ad5f022 Author: Breno Leitao Date: Thu May 4 05:18:54 2023 -0700 io_uring: Create a helper to return the SQE size Create a simple helper that returns the size of the SQE. The SQE could have two size, depending of the flags. If IO_URING_SETUP_SQE128 flag is set, then return a double SQE, otherwise returns the sizeof of io_uring_sqe (64 bytes). Signed-off-by: Breno Leitao Reviewed-by: Christoph Hellwig Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20230504121856.904491-2-leitao@debian.org Signed-off-by: Jens Axboe commit b9850ec0027ca7639141706101bce09b8e3224e6 Merge: 6a341729fb31b f057b63bc11d8 Author: Paolo Abeni Date: Thu May 4 10:48:10 2023 +0200 Merge tag 'nf-23-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains one Netfilter fix: 1) Restore 'ct state untracked' matching with CONFIG_RETPOLINE=y, from Florian Westphal. * tag 'nf-23-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: fix ct untracked match breakage ==================== Link: https://lore.kernel.org/r/20230503201143.12310-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 0d727e1856ef22dd9337199430258cb64cbbc658 Author: Ruliang Lin Date: Thu May 4 14:50:53 2023 +0800 ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` Smatch complains that: snd_usb_caiaq_input_init() warn: missing error code 'ret' This patch adds a new case to handle the situation where the device does not support any input methods in the `snd_usb_caiaq_input_init` function. It returns an `-EINVAL` error code to indicate that no input methods are supported on the device. Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") Signed-off-by: Ruliang Lin Reviewed-by: Dongliang Mu Acked-by: Daniel Mack Link: https://lore.kernel.org/r/20230504065054.3309-1-u202112092@hust.edu.cn Signed-off-by: Takashi Iwai commit a26cc2934331b57b5a7164bff344f0a2ec245fc0 Author: Saravana Kannan Date: Thu Mar 9 22:39:09 2023 -0800 drm/mipi-dsi: Set the fwnode for mipi_dsi_device After commit 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust"), fw_devlink prints an error when consumer devices don't have their fwnode set. This used to be ignored silently. Set the fwnode mipi_dsi_device so fw_devlink can find them and properly track their dependencies. This fixes errors like this: [ 0.334054] nwl-dsi 30a00000.mipi-dsi: Failed to create device link with regulator-lcd-1v8 [ 0.346964] nwl-dsi 30a00000.mipi-dsi: Failed to create device link with backlight-dsi Reported-by: Martin Kepplinger Link: https://lore.kernel.org/lkml/2a8e407f4f18c9350f8629a2b5fa18673355b2ae.camel@puri.sm/ Fixes: 068a00233969 ("drm: Add MIPI DSI bus support") Signed-off-by: Saravana Kannan Tested-by: Martin Kepplinger Link: https://lore.kernel.org/r/20230310063910.2474472-1-saravanak@google.com Signed-off-by: Maxime Ripard commit 7501f472977df233d039d86c6981e0641708e1ca Author: Geraldo Nascimento Date: Wed May 3 18:02:06 2023 -0300 ALSA: usb-audio: Add quirk for Pioneer DDJ-800 One more Pioneer quirk, this time for DDJ-800, which is quite similar like other DJ DDJ models but with slightly different EPs or channels. Signed-off-by: Geraldo Nascimento Tested-by: Grégory Desor Cc: Link: https://lore.kernel.org/r/ZFLLzgEcsSF5aIHG@geday Signed-off-by: Takashi Iwai commit e7477cb97607b373d175a759c8c0270a640ab3f2 Author: Caleb Harper Date: Wed May 3 12:50:26 2023 -0500 ALSA: hda/realtek: support HP Pavilion Aero 13-be0xxx Mute LED This patch adds support for the mute LED on the HP Pavilion Aero Laptop 13-be0xxx. The current behavior is that the LED does not turn on at any time and does not indicate to the user whether the sound is muted. The solution is to add a PCI quirk to properly recognize and support the LED on this device. This change has been tested on the device in question using modified versions of kernels 6.0.7-6.2.12 on Arch Linux. Signed-off-by: Caleb Harper Cc: Link: https://lore.kernel.org/r/20230503175026.6796-1-calebharp2005@gmail.com Signed-off-by: Takashi Iwai commit d396133dced4cbaa52581d0e9c4aea8e04b8db10 Author: Devi Priya Date: Thu Apr 6 11:43:12 2023 +0530 dt-bindings: mailbox: qcom: add compatible for IPQ9574 SoC Add the mailbox compatible for IPQ9574 SoC. Acked-by: Krzysztof Kozlowski Signed-off-by: Devi Priya Signed-off-by: Jassi Brar commit e17225887005f5cc6f18cb0fe9519849856b01b5 Author: Krzysztof Kozlowski Date: Mon Mar 27 16:07:49 2023 +0200 mailbox: qcom-apcs-ipc: do not grow the of_device_id Re-organize the compatible devices and add a comment to avoid unneeded of_device_id growth with every new SoC. These devices have quite a lot of similarities and they can use only one compatible fallback for driver binding. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 34d8775a0edc479644414c0dd2d880fb8aad55b0 Author: Krzysztof Kozlowski Date: Thu May 4 00:57:33 2023 -0500 dt-bindings: mailbox: qcom,apcs-kpss-global: use fallbacks for few variants Rework the compatibles of IPQ8074, SC7180, SC8180X and SM8150 as compatible devices (same from Linux driver point of view). This allows smaller of_device_id table in the Linux driver and smaller allOf:if:then: constraints. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Jassi Brar commit 26e02e6c1012793248096028287ae7296029cd29 Author: AngeloGioacchino Del Regno Date: Mon Mar 27 10:36:37 2023 +0200 dt-bindings: mailbox: mediatek,gce-mailbox: Add support for MT6795 Add a compatible string for the MT6795 Helio X10 SoC using MT8173 binding and add a header for the MT6795's GCE mailbox. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 5f84a056cf437c4ee5f7ca5bc6928cc56ea5206c Author: Conor Dooley Date: Thu Mar 9 20:44:50 2023 +0000 mailbox: mpfs: convert SOC_MICROCHIP_POLARFIRE to ARCH_MICROCHIP_POLARFIRE As part of converting RISC-V SOC_FOO symbols to ARCH_FOO to match the use of such symbols on other architectures, convert the Microchip FPGA mailbox driver to use the new symbol. Signed-off-by: Conor Dooley Signed-off-by: Jassi Brar commit e2aa7993115cfab8a1e6efa7cae05b6817ea69be Author: Krzysztof Kozlowski Date: Sat Mar 11 12:17:39 2023 +0100 mailbox: bcm-pdc: drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). drivers/mailbox/bcm-pdc-mailbox.c:1474:34: error: ‘pdc_mbox_of_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 7490b8fb98848df2e7ac5c4a0fc2e898146695d1 Author: Krzysztof Kozlowski Date: Sat Mar 11 12:17:38 2023 +0100 mailbox: rockchip: drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). drivers/mailbox/rockchip-mailbox.c:158:34: error: ‘rockchip_mbox_of_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 2d1e952a2b8e5e92d8d55ac88a7cf7ca5ea591ad Author: Lee Jones Date: Thu Apr 20 08:27:18 2023 +0100 mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() If a user can make copy_from_user() fail, there is a potential for UAF/DF due to a lack of locking around the allocation, use and freeing of the data buffers. This issue is not theoretical. I managed to author a POC for it: BUG: KASAN: double-free in kfree+0x5c/0xac Free of addr ffff29280be5de00 by task poc/356 CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x64/0x80 print_report+0x188/0x48c kasan_report_invalid_free+0xa0/0xc0 ____kasan_slab_free+0x174/0x1b0 __kasan_slab_free+0x18/0x24 __kmem_cache_free+0x130/0x2e0 kfree+0x5c/0xac mbox_test_message_write+0x208/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Allocated by task 356: kasan_save_stack+0x3c/0x70 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xc0 kmalloc_trace+0x58/0x70 mbox_test_message_write+0x6c/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Freed by task 357: kasan_save_stack+0x3c/0x70 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c ____kasan_slab_free+0x13c/0x1b0 __kasan_slab_free+0x18/0x24 __kmem_cache_free+0x130/0x2e0 kfree+0x5c/0xac mbox_test_message_write+0x208/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Signed-off-by: Lee Jones Signed-off-by: Jassi Brar commit be884585852e7d8336e765504399972b3034a89f Author: Lee Jones Date: Thu Apr 20 08:27:17 2023 +0100 mailbox: mailbox-test: Explicitly include header for spinlock support Presently the support appears to be implied. Signed-off-by: Lee Jones Signed-off-by: Jassi Brar commit 6be2ea33a4093402252724a00c4af8033725184c Author: Paulo Alcantara Date: Thu Apr 27 04:40:08 2023 -0300 cifs: avoid potential races when handling multiple dfs tcons Now that a DFS tcon manages its own list of DFS referrals and sessions, there is no point in having a single worker to refresh referrals of all DFS tcons. Make it faster and less prone to race conditions when having several mounts by queueing a worker per DFS tcon that will take care of refreshing only the DFS referrals related to it. Cc: stable@vger.kernel.org # v6.2+ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 3dc9c433c9dde15477d02b609ccb4328e2adb6dc Author: Paulo Alcantara Date: Wed Apr 26 13:43:53 2023 -0300 cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath Protect access of TCP_Server_Info::{origin,leaf}_fullpath when matching DFS connections, and get rid of TCP_Server_Info::current_fullpath while we're at it. Cc: stable@vger.kernel.org # v6.2+ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit ee20d7c6100752eaf2409d783f4f1449c29ea33d Author: Paulo Alcantara Date: Tue Apr 25 02:42:56 2023 -0300 cifs: fix potential race when tree connecting ipc Protect access of TCP_Server_Info::hostname when building the ipc tree name as it might get freed in cifsd thread and thus causing an use-after-free bug in __tree_connect_dfs_target(). Also, while at it, update status of IPC tcon on success and then avoid any extra tree connects. Cc: stable@vger.kernel.org # v6.2+ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit eb307d09fe15844fdaebeb8cc8c9b9e925430aa5 Author: Namjae Jeon Date: Wed May 3 08:51:51 2023 +0900 ksmbd: call rcu_barrier() in ksmbd_server_exit() racy issue is triggered the bug by racing between closing a connection and rmmod. In ksmbd, rcu_barrier() is not called at module unload time, so nothing prevents ksmbd from getting unloaded while it still has RCU callbacks pending. It leads to trigger unintended execution of kernel code locally and use to defeat protections such as Kernel Lockdown Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20477 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 30210947a343b6b3ca13adc9bfc88e1543e16dd5 Author: Namjae Jeon Date: Wed May 3 08:51:12 2023 +0900 ksmbd: fix racy issue under cocurrent smb2 tree disconnect There is UAF issue under cocurrent smb2 tree disconnect. This patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent access. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20592 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit abcc506a9a71976a8b4c9bf3ee6efd13229c1e19 Author: Namjae Jeon Date: Wed May 3 14:03:40 2023 +0900 ksmbd: fix racy issue from smb2 close and logoff with multichannel When smb client send concurrent smb2 close and logoff request with multichannel connection, It can cause racy issue. logoff request free tcon and can cause UAF issues in smb2 close. When receiving logoff request with multichannel, ksmbd should wait until all remaning requests complete as well as ones in the current connection, and then make session expired. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20796 ZDI-CAN-20595 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3353ab2df5f68dab7da8d5ebb427a2d265a1f2b2 Author: Namjae Jeon Date: Wed May 3 08:45:08 2023 +0900 ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if binding session is guest. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20480 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 7b4323373d844954bb76e0e9f39c4e5fc785fa7b Author: Namjae Jeon Date: Wed May 3 08:44:14 2023 +0900 ksmbd: fix deadlock in ksmbd_find_crypto_ctx() Deadlock is triggered by sending multiple concurrent session setup requests. It should be reused after releasing when getting ctx for crypto. Multiple consecutive ctx uses cause deadlock while waiting for releasing due to the limited number of ctx. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20591 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit b096d97f47326b1e2dbdef1c91fab69ffda54d17 Author: Namjae Jeon Date: Wed May 3 08:43:30 2023 +0900 ksmbd: block asynchronous requests when making a delay on session setup ksmbd make a delay of 5 seconds on session setup to avoid dictionary attacks. But the 5 seconds delay can be bypassed by using asynchronous requests. This patch block all requests on current connection when making a delay on sesstion setup failure. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20482 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit ea174a91893956450510945a0c5d1a10b5323656 Author: Namjae Jeon Date: Wed May 3 08:42:21 2023 +0900 ksmbd: destroy expired sessions client can indefinitely send smb2 session setup requests with the SessionId set to 0, thus indefinitely spawning new sessions, and causing indefinite memory usage. This patch limit to the number of sessions using expired timeout and session state. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20478 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit f5c779b7ddbda30866cf2a27c63e34158f858c73 Author: Namjae Jeon Date: Wed May 3 16:45:00 2023 +0900 ksmbd: fix racy issue from session setup and logoff This racy issue is triggered by sending concurrent session setup and logoff requests. This patch does not set connection status as KSMBD_SESS_GOOD if state is KSMBD_SESS_NEED_RECONNECT in session setup. And relookup session to validate if session is deleted in logoff. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20481, ZDI-CAN-20590, ZDI-CAN-20596 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3ac00a2ab69b34189942afa9e862d5170cdcb018 Author: Namjae Jeon Date: Wed May 3 08:38:33 2023 +0900 ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() If share is , share->path is NULL and it cause NULL pointer dereference issue. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20479 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 6d7cb549c2ca20e1f07593f15e936fd54b763028 Author: Namjae Jeon Date: Wed May 3 08:26:45 2023 +0900 ksmbd: fix memleak in session setup If client send session setup request with unknown NTLMSSP message type, session that does not included channel can be created. It will cause session memleak. because ksmbd_sessions_deregister() does not destroy session if channel is not included. This patch return error response if client send the request unknown NTLMSSP message type. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20593 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 1253685f0d3eb3eab0bfc4bf15ab341a5f3da0c8 Author: Guchun Chen Date: Wed Apr 26 09:46:54 2023 +0800 drm/amdgpu: drop redundant sched job cleanup when cs is aborted Once command submission failed due to userptr invalidation in amdgpu_cs_submit, legacy code will perform cleanup of scheduler job. However, it's not needed at all, as former commit has integrated job cleanup stuff into amdgpu_job_free. Otherwise, because of double free, a NULL pointer dereference will occur in such scenario. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2457 Fixes: f7d66fb2ea43 ("drm/amdgpu: cleanup scheduler job initialization v2") Signed-off-by: Guchun Chen Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 682439fffad9fa9a38d37dd1b1318e9374232213 Author: Samson Tam Date: Wed Apr 19 18:17:14 2023 -0400 drm/amd/display: filter out invalid bits in pipe_fuses [Why] Reading pipe_fuses from register may have invalid bits set, which may affect the num_pipes erroneously. [How] Add read_pipes_fuses() call and filter bits based on expected number of pipes. Reviewed-by: Alvin Lee Acked-by: Alan Liu Signed-off-by: Samson Tam Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 8f586cc16c1fc3c2202c9d54563db8c7ed365f82 Author: Leo Chen Date: Thu Apr 13 17:34:24 2023 -0400 drm/amd/display: Change default Z8 watermark values [Why & How] Previous Z8 watermark values were causing flickering and OTC underflow. Updating Z8 watermark values based on the measurement. Reviewed-by: Nicholas Kazlauskas Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Acked-by: Alan Liu Signed-off-by: Leo Chen Signed-off-by: Alex Deucher commit 100bd00881f8553d0ccfc99a575966d990c455eb Author: Horace Chen Date: Tue Apr 25 13:15:32 2023 +0800 drm/amdgpu: disable SDMA WPTR_POLL_ENABLE for SR-IOV [Why] This WPTR_POLL_ENABLE is a hardware contigious polling which will cause FCLK and UCLK to keep on a high level. Mostly its case can be covered by F32_WPTR_POLL_ENABLE which polls by firmware. So to save power, SR-IOV also needs to disable this bit Signed-off-by: Horace Chen Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 2397e3d8d2e120355201a8310b61929f5a8bd2c0 Author: Chia-I Wu Date: Wed Apr 26 15:54:55 2023 -0700 drm/amdgpu: add a missing lock for AMDGPU_SCHED mgr->ctx_handles should be protected by mgr->lock. v2: improve commit message v3: add a Fixes tag Signed-off-by: Chia-I Wu Reviewed-by: Christian König Fixes: 52c6a62c64fa ("drm/amdgpu: add interface for editing a foreign process's priority v3") Signed-off-by: Alex Deucher commit 922a76ba31adf84e72bc947267385be420c689ee Author: Hamza Mahfooz Date: Tue May 2 11:59:08 2023 -0400 drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini() As made mention of in commit 08c677cb0b43 ("drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini") and commit 13af556104fa ("drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini"). It is meaningless to call amdgpu_irq_put() for gmc.ecc_irq. So, remove it from gmc_v9_0_hw_fini(). Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2522 Fixes: 3029c855d79f ("drm/amdgpu: Fix desktop freezed after gpu-reset") Reviewed-by: Mario Limonciello Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 08c677cb0b436a96a836792bb35a8ec5de4999c2 Author: Horatio Zhang Date: Tue Apr 25 10:52:28 2023 +0800 drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini The gmc.ecc_irq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. So, it is meaningless to use the amdgpu_irq_put function in gmc_v10_0_hw_fini, which also leads to the call trace. [ 82.340264] Call Trace: [ 82.340265] [ 82.340269] gmc_v10_0_hw_fini+0x83/0xa0 [amdgpu] [ 82.340447] gmc_v10_0_suspend+0xe/0x20 [amdgpu] [ 82.340623] amdgpu_device_ip_suspend_phase2+0x127/0x1c0 [amdgpu] [ 82.340789] amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu] [ 82.340955] amdgpu_device_pre_asic_reset+0xdd/0x2b0 [amdgpu] [ 82.341122] amdgpu_device_gpu_recover.cold+0x4dd/0xbb2 [amdgpu] [ 82.341359] amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu] [ 82.341529] process_one_work+0x21d/0x3f0 [ 82.341535] worker_thread+0x1fa/0x3c0 [ 82.341538] ? process_one_work+0x3f0/0x3f0 [ 82.341540] kthread+0xff/0x130 [ 82.341544] ? kthread_complete_and_exit+0x20/0x20 [ 82.341547] ret_from_fork+0x22/0x30 Signed-off-by: Horatio Zhang Reviewed-by: Hawking Zhang Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2522 Fixes: c8b5a95b5709 ("drm/amdgpu: Fix desktop freezed after gpu-reset") Cc: stable@vger.kernel.org commit 13af556104fa93b1945c70bbf8a0a62cd2c92879 Author: Horatio Zhang Date: Tue Apr 25 13:16:32 2023 +0800 drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini The gmc.ecc_irq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. So, it is meaningless to use the amdgpu_irq_put function in gmc_v11_0_hw_fini, which also leads to the call trace. [ 102.980303] Call Trace: [ 102.980303] [ 102.980304] gmc_v11_0_hw_fini+0x54/0x90 [amdgpu] [ 102.980357] gmc_v11_0_suspend+0xe/0x20 [amdgpu] [ 102.980409] amdgpu_device_ip_suspend_phase2+0x240/0x460 [amdgpu] [ 102.980459] amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu] [ 102.980520] amdgpu_device_pre_asic_reset+0xd9/0x490 [amdgpu] [ 102.980573] amdgpu_device_gpu_recover.cold+0x548/0xce6 [amdgpu] [ 102.980687] amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu] [ 102.980740] process_one_work+0x21f/0x3f0 [ 102.980741] worker_thread+0x200/0x3e0 [ 102.980742] ? process_one_work+0x3f0/0x3f0 [ 102.980743] kthread+0xfd/0x130 [ 102.980743] ? kthread_complete_and_exit+0x20/0x20 [ 102.980744] ret_from_fork+0x22/0x30 Signed-off-by: Horatio Zhang Reviewed-by: Hawking Zhang Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2522 Fixes: c8b5a95b5709 ("drm/amdgpu: Fix desktop freezed after gpu-reset") Cc: stable@vger.kernel.org commit b03f38b9bd90d9eb29951e56f5a4375984c8dffb Author: Shane Xiao Date: Tue Apr 25 22:39:08 2023 +0800 drm/amdgpu: Enable doorbell selfring after resize FB BAR [Why] The selfring doorbell aperture will change when resize FB BAR successfully during gmc sw init, we should reorder the sequence of enabling doorbell selfring aperture. [How] Move enable_doorbell_selfring_aperture from *_common_hw_init to *_common_late_init. This fixes the potential issue that GPU ring its own doorbell when this device is in translated mode when iommu is on. v2: Remove *_enable_doorbell_aperture functions (Christian) v3: Add comments to note that why we need enable doorbell selfring late (Christian) Signed-off-by: Shane Xiao Signed-off-by: Aaron Liu Tested-by: Xiaomeng Hou Reviewed-by: Christian K�nig Signed-off-by: Alex Deucher commit 4eea7fb980dc44545a32eec92e2662053b34cd9d Author: lyndonli Date: Sun Apr 23 17:05:15 2023 +0800 drm/amdgpu: Use the default reset when loading or reloading the driver Below call trace and errors are observed when reloading amdgpu driver with the module parameter reset_method=3. It should do a default reset when loading or reloading the driver, regardless of the module parameter reset_method. v2: add comments inside and modify commit messages. [ +2.180243] [drm] psp gfx command ID_LOAD_TOC(0x20) failed and response status is (0x0) [ +0.000011] [drm:psp_hw_start [amdgpu]] *ERROR* Failed to load toc [ +0.000890] [drm:psp_hw_start [amdgpu]] *ERROR* PSP tmr init failed! [ +0.020683] [drm:amdgpu_fill_buffer [amdgpu]] *ERROR* Trying to clear memory with ring turned off. [ +0.000003] RIP: 0010:amdgpu_bo_release_notify+0x1ef/0x210 [amdgpu] [ +0.000004] Call Trace: [ +0.000003] [ +0.000008] ttm_bo_release+0x2c4/0x330 [amdttm] [ +0.000026] amdttm_bo_put+0x3c/0x70 [amdttm] [ +0.000020] amdgpu_bo_free_kernel+0xe6/0x140 [amdgpu] [ +0.000728] psp_v11_0_ring_destroy+0x34/0x60 [amdgpu] [ +0.000826] psp_hw_init+0xe7/0x2f0 [amdgpu] [ +0.000813] amdgpu_device_fw_loading+0x1ad/0x2d0 [amdgpu] [ +0.000731] amdgpu_device_init.cold+0x108e/0x2002 [amdgpu] [ +0.001071] ? do_pci_enable_device+0xe1/0x110 [ +0.000011] amdgpu_driver_load_kms+0x1a/0x160 [amdgpu] [ +0.000729] amdgpu_pci_probe+0x179/0x3a0 [amdgpu] Signed-off-by: lyndonli Signed-off-by: Yunxiang Li Reviewed-by: Feifei Xu Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 74a49415144035f171751d55b11ba04c9f348f9f Author: lyndonli Date: Sun Apr 23 16:46:30 2023 +0800 drm/amdgpu: Fix mode2 reset for sienna cichlid Before this change, sienna_cichlid_get_reset_handler will always return NULL, although the module parameter reset_method is 3 when loading amdgpu driver. Signed-off-by: lyndonli Signed-off-by: Yunxiang Li Reviewed-by: Feifei Xu Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 1a5304fecee523060f26e2778d9d8e33c0562df3 Merge: b4082428727b5 6e3220ba3323a Author: Linus Torvalds Date: Wed May 3 19:41:59 2023 -0700 Merge tag 'parisc-for-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Two important fixes in here: - The argument pointer register was wrong when calling 64-bit firmware functions, which may cause random memory corruption or crashes. - Ensure page alignment in cache flush functions, otherwise not all memory might get flushed. The rest are cleanups (mmap implementation, panic path) and usual smaller updates. Summary: - Calculate correct argument pointer in real64_call_asm() - Cleanup mmap implementation regarding color alignment (John David Anglin) - Spinlock fixes in panic path (Guilherme G. Piccoli) - build doc update for parisc64 (Randy Dunlap) - Ensure page alignment in flush functions" * tag 'parisc-for-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix argument pointer in real64_call_asm() parisc: Cleanup mmap implementation regarding color alignment parisc: Drop HP-UX constants and structs from grfioctl.h parisc: Ensure page alignment in flush functions parisc: Replace regular spinlock with spin_trylock on panic path parisc: update kbuild doc. aliases for parisc64 parisc: Limit amount of kgdb breakpoints on parisc commit b4082428727b58f223661278974527ef9a9661e0 Merge: 049a18f232887 0b891c83d8c54 Author: Linus Torvalds Date: Wed May 3 19:19:34 2023 -0700 Merge tag 'modules-6.4-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull modules fix from Luis Chamberlain: "One fix by Arnd far for modules which came in after the first pull request. The issue was found as part of some late compile tests with 0-day. I take it 0-day does some secondary late builds with after some initial ones" * tag 'modules-6.4-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module: include internal.h in module/dups.c commit 049a18f232887834fc77e7cee46f06b5043aea22 Merge: 342528ff00e8a 0199849acd07d Author: Linus Torvalds Date: Wed May 3 19:08:20 2023 -0700 Merge tag 'sysctl-6.4-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull more sysctl updates from Luis Chamberlain: "As mentioned on my first pull request for sysctl-next, for v6.4-rc1 we're very close to being able to deprecating register_sysctl_paths(). I was going to assess the situation after the first week of the merge window. That time is now and things are looking good. We only have one which had already an ACK for so I'm picking this up here now and the last patch is the one that uses an axe. I have boot tested the last patch and 0-day build completed successfully" * tag 'sysctl-6.4-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: sysctl: remove register_sysctl_paths() kernel: pid_namespace: simplify sysctls with register_sysctl() commit 342528ff00e8a7dd31c1ea0c0093c2289d769b39 Merge: 9f2692326b9c6 6032aca0deb9c Author: Linus Torvalds Date: Wed May 3 19:02:03 2023 -0700 Merge tag 'uml-for-linus-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull uml updates from Richard Weinberger: - Make stub data pages configurable - Make it harder to mix user and kernel code by accident * tag 'uml-for-linus-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: make stub data pages size tweakable um: prevent user code in modules um: further clean up user_syms um: don't export printf() um: hostfs: define our own API boundary um: add __weak for exported functions commit 9f2692326b9c6db8d0e866d555606b12a507a363 Merge: fa31fc82fb775 b5fda08ef2133 Author: Linus Torvalds Date: Wed May 3 18:58:59 2023 -0700 Merge tag 'ubifs-for-linus-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI and UBIFS updates from Richard Weinberger: "UBI: - Fix error value for try_write_vid_and_data() - Minor cleanups UBIFS: - Fixes for various memory leaks - Minor cleanups" * tag 'ubifs-for-linus-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubifs: Fix memleak when insert_old_idx() failed Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" ubifs: Fix memory leak in do_rename ubifs: Free memory for tmpfile name ubi: Fix return value overwrite issue in try_write_vid_and_data() ubifs: Remove return in compr_exit() ubi: Simplify bool conversion commit ec6f82b4c63cc68f8dc03316e725106d242706be Author: Hans de Goede Date: Sat Apr 29 12:47:21 2023 +0200 ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet The Nextbook Ares 8A tablet which has Android as factory OS, has a buggy DSDT with both ESSX8316 and 10EC5651 ACPI devices. This tablet actually uses an rt5651 codec, but the matching code ends up picking the ESSX8316 device, add a quirk to ignote the ESSX8316 device on this tablet. Signed-off-by: Hans de Goede Acked-by: Pierre-Louis Bossart Message-Id: <20230429104721.7176-1-hdegoede@redhat.com> Signed-off-by: Mark Brown commit 4a1b5bc73e9ce8373d50fdb8f74badd2b4bf324e Author: Andrey Rakhmatullin Date: Mon May 1 22:51:34 2023 +0400 ASoC: amd: yc: Add Asus VivoBook Pro 14 OLED M6400RC to the quirks list for acp6x This is needed (and enough) to get the internal mic visible and working. Signed-off-by: Andrey Rakhmatullin Message-Id: <20230501185134.34591-1-wrar@wrar.name> Signed-off-by: Mark Brown commit 84822215acd15bd86a7759a835271e63bba83a7b Author: Krzysztof Kozlowski Date: Wed May 3 16:41:02 2023 +0200 ASoC: codecs: wcd938x: fix accessing regmap on unattached devices The WCD938x comes with three devices on two Linux drivers: 1. RX Soundwire device (wcd938x-sdw.c driver), 2. TX Soundwire device, which is used to access devices via regmap (also wcd938x-sdw.c driver), 3. platform device (wcd938x.c driver) - glue and component master, actually having most of the code using TX Soundwire device regmap. When RX and TX Soundwire devices probe, the component master (platform device) bind tries to write micbias configuration via TX Soundwire regmap. This might happen before TX Soundwire enumerates, so the regmap access fails. On Qualcomm SM8550 board with WCD9385: qcom-soundwire 6d30000.soundwire-controller: Qualcomm Soundwire controller v2.0.0 Registered wcd938x_codec audio-codec: bound sdw:0:0217:010d:00:4 (ops wcd938x_sdw_component_ops) wcd938x_codec audio-codec: bound sdw:0:0217:010d:00:3 (ops wcd938x_sdw_component_ops) qcom-soundwire 6ad0000.soundwire-controller: swrm_wait_for_wr_fifo_avail err write overflow Fix the issue by: 1. Moving the regmap creation from platform device to TX Soundwire device. The regmap settings are moved as-is with one difference: making the wcd938x_regmap_config const. 2. Using regmap in cache only mode till the actual TX Soundwire device enumerates and then sync the regmap cache. Cc: # v3.14+ Signed-off-by: Krzysztof Kozlowski Reviewed-by: Pierre-Louis Bossart Message-Id: <20230503144102.242240-1-krzysztof.kozlowski@linaro.org> Signed-off-by: Mark Brown commit fa31fc82fb775445c176e576304c4098222f47f2 Merge: 0153d8e695255 57ea3ab21c14e Author: Linus Torvalds Date: Wed May 3 12:01:05 2023 -0700 Merge tag 'pm-6.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These fix a hibernation test mode regression and clean up the intel_idle driver. Specifics: - Make test_resume work again after the changes that made hibernation open the snapshot device in exclusive mode (Chen Yu) - Clean up code in several places in intel_idle (Artem Bityutskiy)" * tag 'pm-6.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: intel_idle: mark few variables as __read_mostly intel_idle: do not sprinkle module parameter definitions around intel_idle: fix confusing message intel_idle: improve C-state flags handling robustness intel_idle: further intel_idle_init_cstates_icpu() cleanup intel_idle: clean up intel_idle_init_cstates_icpu() intel_idle: use pr_info() instead of printk() PM: hibernate: Do not get block device exclusively in test_resume mode PM: hibernate: Turn snapshot_test into global variable commit 0153d8e695255cdf3faa5cfa9f18b57158dc2764 Merge: 667de5c684407 2e70a47ceafe4 Author: Linus Torvalds Date: Wed May 3 11:49:57 2023 -0700 Merge tag 'acpi-6.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These add two ACPI-related quirks and extend support for Apple device properties supplied via ACPI _DSM. Specifics: - Do not turn off unused power resources during initialization on the Toshiba Click Mini (Hans de Goede) - Support strings in device properties supplied by ACPI _DSM on Apple platforms (Hector Martin) - Add an ACPI device ID quirk for Lenovo Yoga Tablet 2 (Marius Hoch)" * tag 'acpi-6.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: property: Support strings in Apple _DSM props ACPI: x86: utils: Remove Lenovo Yoga Tablet 2's MAGN0001 ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini commit 667de5c68440732373f571f7eac4ff44b1b93ee7 Merge: 89b7fd5d7f3ce 53389edd40205 Author: Linus Torvalds Date: Wed May 3 11:46:01 2023 -0700 Merge tag 'thermal-6.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more thermal control updates from Rafael Wysocki: "These are mostly cleanups on top of the previously merged thermal control changes plus some driver fixes and the removal of the Intel Menlow thermal driver. Specifics: - Add compatible DT bindings for imx6sll and imx6ul to fix a dtbs check warning (Stefan Wahren) - Update the example in the DT bindings to reflect changes with the ADC node name for QCom TM and TM5 (Marijn Suijten) - Fix comments for the cpuidle_cooling_register() function to match the function prototype (Chenggang Wang) - Fix inconsistent temperature read and some Mediatek variant board reboot by reverting a change and handling the temperature differently (AngeloGioacchino Del Regno) - Fix a memory leak in the initialization error path for the Mediatek driver (Kang Chen) - Use of_address_to_resource() in the Mediatek driver (Rob Herring) - Fix unit address in the QCom tsens driver DT bindings (Krzysztof Kozlowski) - Clean up the step-wise thermal governor (Zhang Rui) - Introduce thermal_zone_device() for accessing the device field of struct thermal_zone_device and two drivers use it (Daniel Lezcano) - Clean up the ACPI thermal driver a bit (Daniel Lezcano) - Delete the thermal driver for Intel Menlow platforms that is not expected to have any users (Rafael Wysocki)" * tag 'thermal-6.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: menlow: Get rid of this driver ACPI: thermal: Move to dedicated function sysfs extra attr creation ACPI: thermal: Use thermal_zone_device() thermal: intel: pch_thermal: Use thermal driver device to write a trace thermal: core: Encapsulate tz->device field thermal: gov_step_wise: Adjust code logic to match comment thermal: gov_step_wise: Delete obsolete comment dt-bindings: thermal: qcom-tsens: Correct unit address thermal/drivers/mediatek: Use of_address_to_resource() thermal/drivers/mediatek: Change clk_prepare_enable to devm_clk_get_enabled in mtk_thermal_probe thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe thermal/drivers/mediatek: Add temperature constraints to validate read Revert "thermal/drivers/mediatek: Add delay after thermal banks initialization" thermal/drivers/cpuidle_cooling: Delete unmatched comments dt-bindings: thermal: Use generic ADC node name in examples dt-bindings: imx-thermal: Add imx6sll and imx6ul compatible commit 89b7fd5d7f3ceda236cc1d0026986a5f57ecaf4a Merge: 4c9818d8652b9 247ee6c780406 Author: Linus Torvalds Date: Wed May 3 11:25:01 2023 -0700 Merge tag 'pwm/for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "The bulk of this is trivial conversions to the new .remove_new() callback for drivers as part of Uwe's effort to clean that up. Other than that a driver is added for Apple devices and various small fixes are included for existing drivers. Last but not least, this finally gets rid of the old pwm_request() and pwm_free() APIs are removed since the last user was dropped in v6.3" * tag 'pwm/for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (44 commits) pwm: Remove unused radix tree pwm: Delete deprecated functions pwm_request() and pwm_free() pwm: meson: Fix g12a ao clk81 name pwm: meson: Fix axg ao mux parents pwm: stm32: Enforce settings for PWM capture MAINTAINERS: Add entries for Apple PWM driver pwm: Add Apple PWM controller dt-bindings: pwm: Add Apple PWM controller pwm: mtk-disp: Configure double buffering before reading in .get_state() pwm: mtk-disp: Disable shadow registers before setting backlight values pwm: stm32-lp: Drop of_match_ptr for ID table pwm: rcar: Drop of_match_ptr for ID table dt-bindings: pwm: Convert Amlogic Meson PWM binding dt-bindings: pwm: mediatek: Add mediatek,mt7986 compatible pwm: xilinx: Convert to platform remove callback returning void pwm: vt8500: Convert to platform remove callback returning void pwm: tiehrpwm: Convert to platform remove callback returning void pwm: tiecap: Convert to platform remove callback returning void pwm: tegra: Convert to platform remove callback returning void pwm: sun4i: Convert to platform remove callback returning void ... commit 4c9818d8652b9824c73e456dd0d73ffba1d0e64d Merge: 54bdf8a39931c 67572c8dc6441 Author: Linus Torvalds Date: Wed May 3 11:21:07 2023 -0700 Merge tag 'soundwire-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: "This features AMD soundwire controller driver, a bunch of Intel changes for future platform support, sdw API updates etc: - Support for AMD soundwire controller - Intel driver updates to support future platforms - Core API sdw_nread/nwrite_no_pm updates to handle page boundaries" * tag 'soundwire-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: (38 commits) soundwire: intel_auxdevice: improve pm_prepare step soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow soundwire: intel: don't save hw_params for use in prepare soundwire: bus: Update sdw_nread/nwrite_no_pm to handle page boundaries soundwire: bus: Update kernel doc for no_pm functions soundwire: bus: Remove now outdated comments on no_pm IO soundwire: stream: uniquify dev_err() logs soundwire: stream: remove bus->dev from logs on multiple buses soundwire: amd: add pm_prepare callback and pm ops support soundwire: amd: handle SoundWire wake enable interrupt soundwire: amd: add runtime pm ops for AMD SoundWire manager driver soundwire: amd: add SoundWire manager interrupt handling soundwire: amd: enable build for AMD SoundWire manager driver soundwire: amd: register SoundWire manager dai ops soundwire: amd: Add support for AMD Manager driver soundwire: export sdw_compute_slave_ports() function soundwire: stream: restore cumulative bus bandwidth when compute_params callback failed soundwire: bandwidth allocation: Use hweight32() to calculate set bits soundwire: qcom: gracefully handle too many ports in DT soundwire: qcom: define hardcoded version magic numbers ... commit 54bdf8a39931cf8fe2c74432e715353d9a1c1107 Merge: 7994beabfbb9a a010613237212 Author: Linus Torvalds Date: Wed May 3 11:17:34 2023 -0700 Merge tag 'phy-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "New support: - UFS PHY for Qualcomm SA8775p, SM7150 - PCIe 2 lane phy support for sc8180x and PCIe PHY for SDX65 - Mediatke hdmi phy support for mt8195 - rockchip naneng combo phy support for RK358 Updates: - Drop Thunder Bay eMMC PHY driver - RC support for PCIe phy for Qualcomm SDX55 - SGMII support in WIZ driver for J721E - PCIe and multilink SGMII PHY support in cadence driver - Big pile of platform remove callback returning void conversions" * tag 'phy-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (77 commits) phy: cadence: cdns-dphy-rx: Add common module reset support phy: ti: j721e-wiz: Add SGMII support in WIZ driver for J721E dt-bindings: phy: ti: phy-gmii-sel: Add support for J784S4 CPSW9G phy: ti: j721e-wiz: Fix unreachable code in wiz_mode_select() phy: cadence: Sierra: Add PCIe + SGMII PHY multilink configuration phy: mediatek: add support for phy-mtk-hdmi-mt8195 phy: phy-mtk-hdmi: Add generic phy configure callback dt-bindings: phy: mediatek: hdmi-phy: Add mt8195 compatible phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port dt-bindings: phy: ti,phy-j721e-wiz: document clock-output-names dt-bindings: phy: ti,phy-j721e-wiz: drop assigned-clocks dt-bindings: phy: ti,phy-am654-serdes: drop assigned-clocks type dt-bindings: phy: cadence-torrent: drop assigned-clocks dt-bindings: phy: cadence-sierra: drop assigned-clocks phy: rockchip: remove unused hw_to_inno function phy: qualcomm: phy-qcom-qmp-ufs: add definitions for sa8775p dt-bindings: phy: qmp-ufs: describe the UFS PHY for sa8775p phy: qcom-qmp-pcie: drop sdm845_qhp_pcie_rx_tbl phy: qcom-qmp-pcie: sc8180x PCIe PHY has 2 lanes phy: qcom-qmp-ufs: Add SM7150 support ... commit 7994beabfbb9a15c069eba7833a00f5ff4da1172 Merge: 29ee463d6fe45 f2dc327131b5c Author: Linus Torvalds Date: Wed May 3 11:11:56 2023 -0700 Merge tag 'dmaengine-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "New support: - Apple admac t8112 device support - StarFive JH7110 DMA controller Updates: - Big pile of idxd updates to support IAA 2.0 device capabilities, DSA 2.0 Event Log and completion record faulting features and new DSA operations - at_xdmac supend & resume updates and driver code cleanup - k3-udma supend & resume support - k3-psil thread support for J784s4" * tag 'dmaengine-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (57 commits) dmaengine: idxd: add per wq PRS disable dmaengine: idxd: add pid to exported sysfs attribute for opened file dmaengine: idxd: expose fault counters to sysfs dmaengine: idxd: add a device to represent the file opened dmaengine: idxd: add per file user counters for completion record faults dmaengine: idxd: process batch descriptor completion record faults dmaengine: idxd: add descs_completed field for completion record dmaengine: idxd: process user page faults for completion record dmaengine: idxd: add idxd_copy_cr() to copy user completion record during page fault handling dmaengine: idxd: create kmem cache for event log fault items dmaengine: idxd: add per DSA wq workqueue for processing cr faults dmanegine: idxd: add debugfs for event log dump dmaengine: idxd: add interrupt handling for event log dmaengine: idxd: setup event log configuration dmaengine: idxd: add event log size sysfs attribute dmaengine: idxd: make misc interrupt one shot dt-bindings: dma: snps,dw-axi-dmac: constrain the items of resets for JH7110 dma dt-bindings: dma: Drop unneeded quotes dmaengine: at_xdmac: align declaration of ret with the rest of variables dmaengine: at_xdmac: add a warning message regarding for unpaused channels ... commit 29ee463d6fe45adde02098b3aa1166cd65fd2739 Merge: 348551ddaf311 ca3d1a4b419ac Author: Linus Torvalds Date: Wed May 3 11:00:27 2023 -0700 Merge tag 'for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux Pull hardware timestamp engine updates from Dipen Patel: "The changes for the hte subsystem include: - Add Tegra234 HTE provider and relevant DT bindings - Update MAINTAINERS file for the HTE subsystem" * tag 'for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux: hte: tegra-194: Use proper includes hte: Use device_match_of_node() hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id() hte: tegra: fix 'struct of_device_id' build error hte: Use of_property_present() for testing DT property presence gpio: tegra186: Add Tegra234 hte support hte: handle nvidia,gpio-controller property hte: Deprecate nvidia,slices property hte: Add Tegra234 provider hte: Re-phrase tegra API document arm64: tegra: Add Tegra234 GTE nodes dt-bindings: timestamp: Deprecate nvidia,slices property dt-bindings: timestamp: Add Tegra234 support MAINTAINERS: Add HTE/timestamp subsystem details commit 798dec3304f69b97cdf78f485473fb5653fc22d1 Author: Linus Torvalds Date: Wed May 3 10:13:41 2023 -0700 x86-64: mm: clarify the 'positive addresses' user address rules Dave Hansen found the "(long) addr >= 0" code in the x86-64 access_ok checks somewhat confusing, and suggested using a helper to clarify what the code is doing. So this does exactly that: clarifying what the sign bit check is all about, by adding a helper macro that makes it clear what it is testing. This also adds some explicit comments talking about how even with LAM enabled, any addresses with the sign bit will still GP-fault in the non-canonical region just above the sign bit. This is all what allows us to do the user address checks with just the sign bit, and furthermore be a bit cavalier about accesses that might be done with an additional offset even past that point. (And yes, this talks about 'positive' even though zero is also a valid user address and so technically we should call them 'non-negative'. But I don't think using 'non-negative' ends up being more understandable). Suggested-by: Dave Hansen Signed-off-by: Linus Torvalds commit 1dbc0a9515fdf1f0b9d6c9b1954a347c94e5f5f9 Author: Linus Torvalds Date: Wed May 3 09:38:58 2023 -0700 x86: mm: remove 'sign' games from LAM untagged_addr*() macros The intent of the sign games was to not modify kernel addresses when untagging them. However, that had two issues: (a) it didn't actually work as intended, since the mask was calculated as 'addr >> 63' on an _unsigned_ address. So instead of getting a mask of all ones for kernel addresses, you just got '1'. (b) untagging a kernel address isn't actually a valid operation anyway. Now, (a) had originally been true for both 'untagged_addr()' and the remote version of it, but had accidentally been fixed for the regular version of untagged_addr() by commit e0bddc19ba95 ("x86/mm: Reduce untagged_addr() overhead for systems without LAM"). That one rewrote the shift to be part of the alternative asm code, and in the process changed the unsigned shift into a signed 'sar' instruction. And while it is true that we don't want to turn what looks like a kernel address into a user address by masking off the high bit, that doesn't need these sign masking games - all it needs is that the mm context 'untag_mask' value has the high bit set. Which it always does. So simplify the code by just removing the superfluous (and in the case of untagged_addr_remote(), still buggy) sign bit games in the address masking. Acked-by: Dave Hansen Signed-off-by: Linus Torvalds commit b9bd9f605c4a6f04a83e6640a7d1d6dda80f17ca Author: Linus Torvalds Date: Tue May 2 16:39:59 2023 -0700 x86: uaccess: move 32-bit and 64-bit parts into proper header The x86 file has grown features that are specific to x86-64 like LAM support and the related access_ok() changes. They really should be in the file and not pollute the generic x86 header. Signed-off-by: Linus Torvalds commit 6ccdc91d6af922f3ded5de494ff27daedeb6d6c9 Author: Linus Torvalds Date: Tue May 2 12:35:01 2023 -0700 x86: mm: remove architecture-specific 'access_ok()' define There's already a generic definition of 'access_ok()' in the asm-generic/access_ok.h header file, and the only difference bwteen that and the x86-specific one is the added check for WARN_ON_IN_IRQ(). And it turns out that the reason for that check is long gone: it used to use a "user_addr_max()" inline function that depended on the current thread, and caused problems in non-thread contexts. For details, see commits 7c4788950ba5 ("x86/uaccess, sched/preempt: Verify access_ok() context") and in particular commit ae31fe51a3cc ("perf/x86: Restore TASK_SIZE check on frame pointer") about how and why this came to be. But that "current task" issue was removed in the big set_fs() removal by Christoph Hellwig in commit 47058bb54b57 ("x86: remove address space overrides using set_fs()"). So the reason for the test and the architecture-specific access_ok() define no longer exists, and is actually harmful these days. For example, it led various 'copy_from_user_nmi()' games (eg using __range_not_ok() instead, and then later converted to __access_ok() when that became ok). And that in turn meant that LAM was broken for the frame following before this series, because __access_ok() used to not do the address untagging. Accessing user state still needs care in many contexts, but access_ok() is not the place for this test. Acked-by: Peter Zijlstra (Intel) Signed-off-by: Linus Torvalds torvalds@linux-foundation.org> commit 6014bc27561f2cc63e0acc18adbc4ed810834e32 Author: Linus Torvalds Date: Fri Apr 28 12:55:10 2023 -0700 x86-64: make access_ok() independent of LAM The linear address masking (LAM) code made access_ok() more complicated, in that it now needs to untag the address in order to verify the access range. See commit 74c228d20a51 ("x86/uaccess: Provide untagged_addr() and remove tags before address check"). We were able to avoid that overhead in the get_user/put_user code paths by simply using the sign bit for the address check, and depending on the GP fault if the address was non-canonical, which made it all independent of LAM. And we can do the same thing for access_ok(): simply check that the user pointer range has the high bit clear. No need to bother with any address bit masking. In fact, we can go a bit further, and just check the starting address for known small accesses ranges: any accesses that overflow will still be in the non-canonical area and will still GP fault. To still make syzkaller catch any potentially unchecked user addresses, we'll continue to warn about GP faults that are caused by accesses in the non-canonical range. But we'll limit that to purely "high bit set and past the one-page 'slop' area". We could probably just do that "check only starting address" for any arbitrary range size: realistically all kernel accesses to user space will be done starting at the low address. But let's leave that kind of optimization for later. As it is, this already allows us to generate simpler code and not worry about any tag bits in the address. The one thing to look out for is the GUP address check: instead of actually copying data in the virtual address range (and thus bad addresses being caught by the GP fault), GUP will look up the page tables manually. As a result, the page table limits need to be checked, and that was previously implicitly done by the access_ok(). With the relaxed access_ok() check, we need to just do an explicit check for TASK_SIZE_MAX in the GUP code instead. The GUP code already needs to do the tag bit unmasking anyway, so there this is all very straightforward, and there are no LAM issues. Cc: Kirill A. Shutemov Cc: Dave Hansen Cc: Peter Zijlstra (Intel) Signed-off-by: Linus Torvalds commit 4f94559f40ad06d627c0fdfc3319cec778a2845b Author: Ondrej Mosnacek Date: Wed May 3 16:01:14 2023 +0200 tracing: Fix permissions for the buffer_percent file This file defines both read and write operations, yet it is being created as read-only. This means that it can't be written to without the CAP_DAC_OVERRIDE capability. Fix the permissions to allow root to write to it without the need to override DAC perms. Link: https://lore.kernel.org/linux-trace-kernel/20230503140114.3280002-1-omosnace@redhat.com Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Fixes: 03329f993978 ("tracing: Add tracefs file buffer_percentage") Signed-off-by: Ondrej Mosnacek Signed-off-by: Steven Rostedt (Google) commit 3710e2b056cb92ad816e4d79fa54a6a5b6ad8cbd Author: Adrian Huang Date: Fri Apr 21 16:08:00 2023 +0800 nvme-pci: clamp max_hw_sectors based on DMA optimized limitation When running the fio test on a 448-core AMD server + a NVME disk, a soft lockup or a hard lockup call trace is shown: [soft lockup] watchdog: BUG: soft lockup - CPU#126 stuck for 23s! [swapper/126:0] RIP: 0010:_raw_spin_unlock_irqrestore+0x21/0x50 ... Call Trace: fq_flush_timeout+0x7d/0xd0 ? __pfx_fq_flush_timeout+0x10/0x10 call_timer_fn+0x2e/0x150 run_timer_softirq+0x48a/0x560 ? __pfx_fq_flush_timeout+0x10/0x10 ? clockevents_program_event+0xaf/0x130 __do_softirq+0xf1/0x335 irq_exit_rcu+0x9f/0xd0 sysvec_apic_timer_interrupt+0xb4/0xd0 asm_sysvec_apic_timer_interrupt+0x1f/0x30 ... Obvisouly, fq_flush_timeout spends over 20 seconds. Here is ftrace log: | fq_flush_timeout() { | fq_ring_free() { | put_pages_list() { 0.170 us | free_unref_page_list(); 0.810 us | } | free_iova_fast() { | free_iova() { * 85622.66 us | _raw_spin_lock_irqsave(); 2.860 us | remove_iova(); 0.600 us | _raw_spin_unlock_irqrestore(); 0.470 us | lock_info_report(); 2.420 us | free_iova_mem.part.0(); * 85638.27 us | } * 85638.84 us | } | put_pages_list() { 0.230 us | free_unref_page_list(); 0.470 us | } ... ... $ 31017069 us | } Most of cores are under lock contention for acquiring iova_rbtree_lock due to the iova flush queue mechanism. [hard lockup] NMI watchdog: Watchdog detected hard LOCKUP on cpu 351 RIP: 0010:native_queued_spin_lock_slowpath+0x2d8/0x330 Call Trace: _raw_spin_lock_irqsave+0x4f/0x60 free_iova+0x27/0xd0 free_iova_fast+0x4d/0x1d0 fq_ring_free+0x9b/0x150 iommu_dma_free_iova+0xb4/0x2e0 __iommu_dma_unmap+0x10b/0x140 iommu_dma_unmap_sg+0x90/0x110 dma_unmap_sg_attrs+0x4a/0x50 nvme_unmap_data+0x5d/0x120 [nvme] nvme_pci_complete_batch+0x77/0xc0 [nvme] nvme_irq+0x2ee/0x350 [nvme] ? __pfx_nvme_pci_complete_batch+0x10/0x10 [nvme] __handle_irq_event_percpu+0x53/0x1a0 handle_irq_event_percpu+0x19/0x60 handle_irq_event+0x3d/0x60 handle_edge_irq+0xb3/0x210 __common_interrupt+0x7f/0x150 common_interrupt+0xc5/0xf0 asm_common_interrupt+0x2b/0x40 ... ftrace shows fq_ring_free spends over 10 seconds [1]. Again, most of cores are under lock contention for acquiring iova_rbtree_lock due to the iova flush queue mechanism. [Root Cause] The root cause is that the max_hw_sectors_kb of nvme disk (mdts=10) is 4096kb, which streaming DMA mappings cannot benefit from the scalable IOVA mechanism introduced by the commit 9257b4a206fc ("iommu/iova: introduce per-cpu caching to iova allocation") if the length is greater than 128kb. To fix the lock contention issue, clamp max_hw_sectors based on DMA optimized limitation in order to leverage scalable IOVA mechanism. Note: The issue does not happen with another NVME disk (mdts = 5 and max_hw_sectors_kb = 128) [1] https://gist.github.com/AdrianHuang/bf8ec7338204837631fbdaed25d19cc4 Suggested-by: Keith Busch Reported-and-tested-by: Jiwei Sun Signed-off-by: Adrian Huang Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit bd375feeaf3408ed00e08c3bc918d6be15f691ad Author: Hristo Venev Date: Tue Apr 25 22:58:54 2023 +0300 nvme-pci: add quirk for missing secondary temperature thresholds On Kingston KC3000 and Kingston FURY Renegade (both have the same PCI IDs) accessing temp3_{min,max} fails with an invalid field error (note that there is no problem setting the thresholds for temp1). This contradicts the NVM Express Base Specification 2.0b, page 292: The over temperature threshold and under temperature threshold features shall be implemented for all implemented temperature sensors (i.e., all Temperature Sensor fields that report a non-zero value). Define NVME_QUIRK_NO_SECONDARY_TEMP_THRESH that disables the thresholds for all but the composite temperature and set it for this device. Signed-off-by: Hristo Venev Reviewed-by: Guenter Roeck Signed-off-by: Christoph Hellwig commit 1616d6c3717bae9041a4240d381ec56ccdaafedc Author: Sagi Grimberg Date: Wed May 3 18:57:33 2023 +0300 nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G Add a quirk to fix HS-SSD-FUTURE 2048G SSD drives reporting duplicate nsids. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217384 Reported-by: Andrey God Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 6e3220ba3323a2c24be834aebf5d6e9f89d0993f Author: Helge Deller Date: Wed May 3 16:39:56 2023 +0200 parisc: Fix argument pointer in real64_call_asm() Fix the argument pointer (ap) to point to real-mode memory instead of virtual memory. It's interesting that this issue hasn't shown up earlier, as this could have happened with any 64-bit PDC ROM code. I just noticed it because I suddenly faced a HPMC while trying to execute the 64-bit STI ROM code of an Visualize-FXe graphics card for the STI text console. Signed-off-by: Helge Deller Cc: commit 567b35159e76997e95b643b9a8a5d9d2198f2522 Author: John David Anglin Date: Sun Feb 26 18:03:33 2023 +0000 parisc: Cleanup mmap implementation regarding color alignment This change simplifies the randomization of file mapping regions. It reworks the code to remove duplication. The flow is now similar to that for mips. Finally, we consistently use the do_color_align variable to determine when color alignment is needed. Tested on rp3440. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 653f3ea73bf3e03070d370300805eee4f2a47bd9 Author: Helge Deller Date: Sun Apr 23 21:37:47 2023 +0200 parisc: Drop HP-UX constants and structs from grfioctl.h Signed-off-by: Helge Deller commit d755bd2caeb47fd806e12399fe8b56798fa5d2cc Author: Helge Deller Date: Wed Mar 15 19:25:15 2023 +0100 parisc: Ensure page alignment in flush functions Matthew Wilcox noticed, that if ARCH_HAS_FLUSH_ON_KUNMAP is defined (which is the case for PA-RISC), __kunmap_local() calls kunmap_flush_on_unmap(), which may call the parisc flush functions with a non-page-aligned address and thus the page might not be fully flushed. This patch ensures that flush_kernel_dcache_page_asm() and flush_kernel_dcache_page_asm() will always operate on page-aligned addresses. Signed-off-by: Helge Deller Cc: # v6.0+ commit 829632dae8321787525ee37dc4828bbe6edafdae Author: Guilherme G. Piccoli Date: Mon Feb 20 18:11:05 2023 -0300 parisc: Replace regular spinlock with spin_trylock on panic path The panic notifiers' callbacks execute in an atomic context, with interrupts/preemption disabled, and all CPUs not running the panic function are off, so it's very dangerous to wait on a regular spinlock, there's a risk of deadlock. Refactor the panic notifier of parisc/power driver to make use of spin_trylock - for that, we've added a second version of the soft-power function. Also, some comments were reorganized and trailing white spaces, useless header inclusion and blank lines were removed. Cc: "James E.J. Bottomley" Cc: Jeroen Roovers Acked-by: Helge Deller # parisc Signed-off-by: Guilherme G. Piccoli Signed-off-by: Helge Deller commit e0838a99289e013d17496ed9464c3cf71d49b977 Author: Randy Dunlap Date: Sun Feb 5 08:37:52 2023 -0800 parisc: update kbuild doc. aliases for parisc64 ARCH=parisc64 is now supported for 64-bit parisc builds, so add this alias to the kbuild.rst documentation. Fixes: 3dcfb729b5f4 ("parisc: Make CONFIG_64BIT available for ARCH=parisc64 only") Signed-off-by: Randy Dunlap Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: linux-parisc@vger.kernel.org Cc: Masahiro Yamada Cc: linux-kbuild@vger.kernel.org Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Acked-by: Masahiro Yamada Signed-off-by: Helge Deller commit 82da62abe56263319a974a4d77c1e6fa19355de1 Author: Helge Deller Date: Wed Dec 28 08:41:54 2022 +0100 parisc: Limit amount of kgdb breakpoints on parisc kgdb is rarely used and 40 breakpoints seems enough to debug parisc specific bugs. Signed-off-by: Helge Deller commit c0b79b0ff53be5b05be98e3caaa6a39de1fe9520 Author: Ming Lei Date: Tue May 2 10:42:31 2023 +0800 ublk: add timeout handler Add timeout handler, so that we can provide forward progress guarantee for unprivileged ublk, which can't be trusted. One thing is that sync() calls sync_bdevs(wait) for all block devices after running sync_bdevs(no_wait), and if one device can't move on, the sync() won't return any more. Add timeout for unprivileged ublk to avoid such affect for other users which call sync() syscall. Meantime clear UBLK_F_USER_RECOVERY_REISSUE for unprivileged ublk since that feature may cause IO hang too. Fixes: 4093cb5a0634 ("ublk_drv: add mechanism for supporting unprivileged ublk device") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230502024231.888498-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 1bd922877a084c1c6c1d0cb1bb9c3700fa0f6c61 Author: Stanislav Jakubek Date: Sun Apr 23 14:40:18 2023 +0200 dt-bindings: i2c: brcm,kona-i2c: convert to YAML Changes during conversion: - add used, but previously undocumented SoC-specific compatibles - drop references to SoCs that are not upstream - add supported clock frequencies Signed-off-by: Stanislav Jakubek Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 3899d94e3831ee07ea6821c032dc297aec80586a Author: Christoph Böhmwalder Date: Wed May 3 14:19:37 2023 +0200 drbd: correctly submit flush bio on barrier When we receive a flush command (or "barrier" in DRBD), we currently use a REQ_OP_FLUSH with the REQ_PREFLUSH flag set. The correct way to submit a flush bio is by using a REQ_OP_WRITE without any data, and set the REQ_PREFLUSH flag. Since commit b4a6bb3a67aa ("block: add a sanity check for non-write flush/fua bios"), this triggers a warning in the block layer, but this has been broken for quite some time before that. So use the correct set of flags to actually make the flush happen. Cc: Christoph Hellwig Cc: stable@vger.kernel.org Fixes: f9ff0da56437 ("drbd: allow parallel flushes for multi-volume resources") Reported-by: Thomas Voegtle Signed-off-by: Christoph Böhmwalder Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230503121937.17232-1-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe commit 5d388143fa6c351d985ffd23ea50c91c8839141b Author: Arnd Bergmann Date: Mon Apr 3 09:49:13 2023 +0200 i2c: gxp: fix build failure without CONFIG_I2C_SLAVE The gxp_i2c_slave_irq_handler() is hidden in an #ifdef, but the caller uses an IS_ENABLED() check: drivers/i2c/busses/i2c-gxp.c: In function 'gxp_i2c_irq_handler': drivers/i2c/busses/i2c-gxp.c:467:29: error: implicit declaration of function 'gxp_i2c_slave_irq_handler'; did you mean 'gxp_i2c_irq_handler'? [-Werror=implicit-function-declaration] It has to consistently use one method or the other to avoid warnings, so move to IS_ENABLED() here for readability and build coverage, and move the #ifdef in linux/i2c.h to allow building it as dead code. Fixes: 4a55ed6f89f5 ("i2c: Add GXP SoC I2C Controller") Signed-off-by: Arnd Bergmann Reviewed-by: Nick Hawkins Signed-off-by: Wolfram Sang commit fa39065833dbdb2059ffe25d071e722c31fbbb6c Author: Alexander Stein Date: Mon Apr 24 10:06:27 2023 +0200 i2c: imx-lpi2c: avoid taking clk_prepare mutex in PM callbacks This is unsafe, as the runtime PM callbacks are called from the PM workqueue, so this may deadlock when handling an i2c attached clock, which may already hold the clk_prepare mutex from another context. Signed-off-by: Alexander Stein Signed-off-by: Wolfram Sang commit c770657bd2611b077ec1e7b1fe6aa92f249399bd Author: Reid Tonking Date: Wed Apr 26 14:49:56 2023 -0500 i2c: omap: Fix standard mode false ACK readings Using standard mode, rare false ACK responses were appearing with i2cdetect tool. This was happening due to NACK interrupt triggering ISR thread before register access interrupt was ready. Removing the NACK interrupt's ability to trigger ISR thread lets register access ready interrupt do this instead. Cc: # v3.7+ Fixes: 3b2f8f82dad7 ("i2c: omap: switch to threaded IRQ support") Signed-off-by: Reid Tonking Acked-by: Vignesh Raghavendra Reviewed-by: Tony Lindgren Signed-off-by: Wolfram Sang commit 776617db78c6d208780e7c69d4d68d1fa82913de Author: Tobias Holl Date: Wed May 3 08:59:50 2023 -0600 io_uring/rsrc: check for nonconsecutive pages Pages that are from the same folio do not necessarily need to be consecutive. In that case, we cannot consolidate them into a single bvec entry. Before applying the huge page optimization from commit 57bebf807e2a ("io_uring/rsrc: optimise registered huge pages"), check that the memory is actually consecutive. Cc: stable@vger.kernel.org Fixes: 57bebf807e2a ("io_uring/rsrc: optimise registered huge pages") Signed-off-by: Tobias Holl [axboe: formatting] Signed-off-by: Jens Axboe commit d246331b78cbef86237f9c22389205bc9b4e1cc1 Author: Josef Bacik Date: Tue May 2 16:00:06 2023 -0400 btrfs: don't free qgroup space unless specified Boris noticed in his simple quotas testing that he was getting a leak with Sweet Tea's change to subvol create that stopped doing a transaction commit. This was just a side effect of that change. In the delayed inode code we have an optimization that will free extra reservations if we think we can pack a dir item into an already modified leaf. Previously this wouldn't be triggered in the subvolume create case because we'd commit the transaction, it was still possible but much harder to trigger. It could actually be triggered if we did a mkdir && subvol create with qgroups enabled. This occurs because in btrfs_insert_delayed_dir_index(), which gets called when we're adding the dir item, we do the following: btrfs_block_rsv_release(fs_info, trans->block_rsv, bytes, NULL); if we're able to skip reserving space. The problem here is that trans->block_rsv points at the temporary block rsv for the subvolume create, which has qgroup reservations in the block rsv. This is a problem because btrfs_block_rsv_release() will do the following: if (block_rsv->qgroup_rsv_reserved >= block_rsv->qgroup_rsv_size) { qgroup_to_release = block_rsv->qgroup_rsv_reserved - block_rsv->qgroup_rsv_size; block_rsv->qgroup_rsv_reserved = block_rsv->qgroup_rsv_size; } The temporary block rsv just has ->qgroup_rsv_reserved set, ->qgroup_rsv_size == 0. The optimization in btrfs_insert_delayed_dir_index() sets ->qgroup_rsv_reserved = 0. Then later on when we call btrfs_subvolume_release_metadata() which has btrfs_block_rsv_release(fs_info, rsv, (u64)-1, &qgroup_to_release); btrfs_qgroup_convert_reserved_meta(root, qgroup_to_release); qgroup_to_release is set to 0, and we do not convert the reserved metadata space. The problem here is that the block rsv code has been unconditionally messing with ->qgroup_rsv_reserved, because the main place this is used is delalloc, and any time we call btrfs_block_rsv_release() we do it with qgroup_to_release set, and thus do the proper accounting. The subvolume code is the only other code that uses the qgroup reservation stuff, but it's intermingled with the above optimization, and thus was getting its reservation freed out from underneath it and thus leaking the reserved space. The solution is to simply not mess with the qgroup reservations if we don't have qgroup_to_release set. This works with the existing code as anything that messes with the delalloc reservations always have qgroup_to_release set. This fixes the leak that Boris was observing. Reviewed-by: Qu Wenruo CC: stable@vger.kernel.org # 5.4+ Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 57ea3ab21c14e6f04db2b0878e8a5be644fa3769 Merge: bd4468295e7a3 5904de0d735bb Author: Rafael J. Wysocki Date: Wed May 3 16:04:43 2023 +0200 Merge branch 'pm-sleep' Merge hibernation test mode fix for 6.4-rc1. * pm-sleep: PM: hibernate: Do not get block device exclusively in test_resume mode PM: hibernate: Turn snapshot_test into global variable commit 1f85d016768ff19f060f3cce014a43c761de8259 Author: Thomas Richter Date: Wed May 3 10:12:55 2023 +0200 perf test record+probe_libc_inet_pton: Fix call chain match on x86_64 The test case probe libc's inet_pton & backtrace it with ping fails with Fedora 38 on x86_64. Function getaddrinfo() does not show up in the call chain anymore: # ./perf script ping 1803 [000] 728.567146: probe_libc:inet_pton: (7f5275afc840) 133840 __GI___inet_pton+0x0 (/usr/lib64/libc.so.6) 27b4a __libc_start_call_main+0x7a (/usr/lib64/libc.so.6) 27c0b __libc_start_main@@GLIBC_2.34+0x8b (/usr/lib64/libc.so.6) ping 1803 [000] 728.567184: probe_libc:inet_pton: (7f5275afc840) 133840 __GI___inet_pton+0x0 (/usr/lib64/libc.so.6) 493e main+0xcde (/usr/bin/ping) 27b4a __libc_start_call_main+0x7a (/usr/lib64/libc.so.6) # which causes the test case to fail. Remove function getaddrinfo() from list of expected functions. Output before: # ./perf test 'libc' 91: probe libc's inet_pton & backtrace it with ping : FAILED! # Output after: # ./perf test 'libc' 91: probe libc's inet_pton & backtrace it with ping : Ok # Signed-off-by: Thomas Richter Tested-by: Arnaldo Carvalho de Melo Cc: Heiko Carstens Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20230503081255.3372986-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 311693ce81c9da3724d4294a4c3769a3b30b6a7f Author: Thomas Richter Date: Wed May 3 10:11:34 2023 +0200 perf test record+probe_libc_inet_pton: Fix call chain match on s390 With Fedora 38 the perf test 86 probe libc's inet_pton fails on s390. The call chain of the ping command changed. The functions text_to_binary_address() and gaih_inet() do not show up in the call chain anymore. Output before: # ./perf test -v 86 86: probe libc's inet_pton & backtrace it with ping : --- start --- test child forked, pid 541050 fgrep: warning: fgrep is obsolescent; using grep -F fgrep: warning: fgrep is obsolescent; using grep -F BFD: DWARF error: could not find variable specification at offset 0x22011 ... ping 541078 [002] 348826.679581: probe_libc:inet_pton_1: (3ffad84b940) 14b940 __GI___inet_pton+0x0 (/usr/lib64/libc.so.6) 10e9c3 __GI_getaddrinfo+0xeb3 (inlined) 4397 main+0x737 (/usr/bin/ping) FAIL: expected backtrace entry "gaih_inet.*\+0x[[:xdigit:]]\ +[[:space:]]\(/usr/lib64/libc.so.6|inlined\)$" got "4397 main+0x737 (/usr/bin/ping)" test child finished with -1 ---- end ---- probe libc's inet_pton & backtrace it with ping: FAILED! # Output after: # ./perf test -v 86 86: probe libc's inet_pton & backtrace it with ping : --- start --- test child forked, pid 541098 fgrep: warning: fgrep is obsolescent; using grep -F fgrep: warning: fgrep is obsolescent; using grep -F BFD: DWARF error: could not find variable specification at offset 0x309d1 ... ping 541126 [006] 349309.099067: probe_libc:inet_pton_1: (3ffb7f4b940) 14b940 __GI___inet_pton+0x0 (/usr/lib64/libc.so.6) 10e9c3 __GI_getaddrinfo+0xeb3 (inlined) 4397 main+0x737 (/usr/bin/ping) test child finished with 0 ---- end ---- probe libc's inet_pton & backtrace it with ping: Ok # Signed-off-by: Thomas Richter Cc: Heiko Carstens Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20230503081134.3372415-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 2e70a47ceafe4d71a4a402b2f7c5123cb4bf33f6 Merge: 61711941d8515 9b04d99788cf4 9bde7fb8940f6 Author: Rafael J. Wysocki Date: Wed May 3 15:55:19 2023 +0200 Merge branches 'acpi-pm' and 'acpi-properties' Merge an ACPI power management quirk and a change related to the handling of ACPI device properties for 6.4-rc1: - Do not turn off unused power resources during initialization on the Toshiba Click Mini (Hans de Goede). - Support strings in device properties supplied by ACPI _DSM on Apple platforms (Hector Martin). * acpi-pm: ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini * acpi-properties: ACPI: property: Support strings in Apple _DSM props commit 53389edd4020514b876b01d05e851fb7d46eb51f Merge: dd2358321e1aa 2b6a7409ac390 Author: Rafael J. Wysocki Date: Wed May 3 15:44:35 2023 +0200 Merge branch 'thermal-core' Merge additional thermal core and ACPI thermal changes for 6.4-rc1: - Clean up the step-wise thermal governor (Zhang Rui). - Introduce thermal_zone_device() for accessing the device field of struct thermal_zone_device and two drivers use it (Daniel Lezcano). - Clean up the ACPI thermal driver a bit (Daniel Lezcano). - Delete the thermal driver for Intel Menlow platforms that is not expected to have any users (Rafael Wysocki). * thermal-core: thermal: intel: menlow: Get rid of this driver ACPI: thermal: Move to dedicated function sysfs extra attr creation ACPI: thermal: Use thermal_zone_device() thermal: intel: pch_thermal: Use thermal driver device to write a trace thermal: core: Encapsulate tz->device field thermal: gov_step_wise: Adjust code logic to match comment thermal: gov_step_wise: Delete obsolete comment commit 29cd2927fb914cc53b5ba4f67d2b74695c994ba4 Author: Chuck Lever Date: Tue May 2 14:59:10 2023 -0400 SUNRPC: Fix encoding of accepted but unsuccessful RPC replies Jiri Slaby says: > I bisected to this ... as it breaks nfs3-only servers in 6.3. > I.e. /etc/nfs.conf containing: > [nfsd] > vers4=no > > The client sees: > mount("10.0.2.15:/tmp", "/mnt", "nfs", 0, "vers=4.2,addr=10.0.2.15,clientad"...) = -1 EIO (Input/output error) > write(2, "mount.nfs: mount system call fai"..., 45 > mount.nfs: mount system call failed for /mnt > > And the kernel says: > nfs4_discover_server_trunking unhandled error -5. Exiting with error EIO Reported-by: Jiri Slaby Link: https://bugzilla.suse.com/show_bug.cgi?id=1210995 Fixes: 4bcf0343e8a6 ("SUNRPC: Set rq_accept_statp inside ->accept methods") Tested-by: Jiri Slaby Signed-off-by: Chuck Lever commit f057b63bc11d86a98176de31b437e46789f44d8f Author: Florian Westphal Date: Wed May 3 12:00:18 2023 +0200 netfilter: nf_tables: fix ct untracked match breakage "ct untracked" no longer works properly due to erroneous NFT_BREAK. We have to check ctinfo enum first. Fixes: d9e789147605 ("netfilter: nf_tables: avoid retpoline overhead for some ct expression calls") Reported-by: Rvfg Link: https://marc.info/?l=netfilter&m=168294996212038&w=2 Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 6a341729fb31b4c5df9f74f24b4b1c98410c9b87 Author: Kuniyuki Iwashima Date: Mon May 1 13:28:57 2023 -0700 af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). syzkaller reported a warning below [0]. We can reproduce it by sending 0-byte data from the (AF_PACKET, SOCK_PACKET) socket via some devices whose dev->hard_header_len is 0. struct sockaddr_pkt addr = { .spkt_family = AF_PACKET, .spkt_device = "tun0", }; int fd; fd = socket(AF_PACKET, SOCK_PACKET, 0); sendto(fd, NULL, 0, 0, (struct sockaddr *)&addr, sizeof(addr)); We have a similar fix for the (AF_PACKET, SOCK_RAW) socket as commit dc633700f00f ("net/af_packet: check len when min_header_len equals to 0"). Let's add the same test for the SOCK_PACKET socket. [0]: skb_assert_len WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 skb_assert_len include/linux/skbuff.h:2552 [inline] WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 __dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159 Modules linked in: CPU: 1 PID: 19945 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:skb_assert_len include/linux/skbuff.h:2552 [inline] RIP: 0010:__dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159 Code: 89 de e8 1d a2 85 fd 84 db 75 21 e8 64 a9 85 fd 48 c7 c6 80 2a 1f 86 48 c7 c7 c0 06 1f 86 c6 05 23 cf 27 04 01 e8 fa ee 56 fd <0f> 0b e8 43 a9 85 fd 0f b6 1d 0f cf 27 04 31 ff 89 de e8 e3 a1 85 RSP: 0018:ffff8880217af6e0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90001133000 RDX: 0000000000040000 RSI: ffffffff81186922 RDI: 0000000000000001 RBP: ffff8880217af8b0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff888030045640 R13: ffff8880300456b0 R14: ffff888030045650 R15: ffff888030045718 FS: 00007fc5864da640(0000) GS:ffff88806cd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020005740 CR3: 000000003f856003 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: dev_queue_xmit include/linux/netdevice.h:3085 [inline] packet_sendmsg_spkt+0xc4b/0x1230 net/packet/af_packet.c:2066 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x1b4/0x200 net/socket.c:747 ____sys_sendmsg+0x331/0x970 net/socket.c:2503 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2557 __sys_sendmmsg+0x18c/0x430 net/socket.c:2643 __do_sys_sendmmsg net/socket.c:2672 [inline] __se_sys_sendmmsg net/socket.c:2669 [inline] __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fc58791de5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007fc5864d9cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007fc58791de5d RDX: 0000000000000001 RSI: 0000000020005740 RDI: 0000000000000004 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fc58797e530 R15: 0000000000000000 ---[ end trace 0000000000000000 ]--- skb len=0 headroom=16 headlen=0 tailroom=304 mac=(16,0) net=(16,-1) trans=-1 shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0)) csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0) hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0 dev name=sit0 feat=0x00000006401d7869 sk family=17 type=10 proto=0 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 3ce29c17dc847bf4245e16aad78a7617afa96297 Author: Song Yoong Siang Date: Tue May 2 08:48:06 2023 -0700 igc: read before write to SRRCTL register igc_configure_rx_ring() function will be called as part of XDP program setup. If Rx hardware timestamp is enabled prio to XDP program setup, this timestamp enablement will be overwritten when buffer size is written into SRRCTL register. Thus, this commit read the register value before write to SRRCTL register. This commit is tested by using xdp_hw_metadata bpf selftest tool. The tool enables Rx hardware timestamp and then attach XDP program to igc driver. It will display hardware timestamp of UDP packet with port number 9092. Below are detail of test steps and results. Command on DUT: sudo ./xdp_hw_metadata Command on Link Partner: echo -n skb | nc -u -q1 9092 Result before this patch: skb hwtstamp is not found! Result after this patch: found skb hwtstamp = 1677800973.642836757 Optionally, read PHC to confirm the values obtained are almost the same: Command: sudo ./testptp -d /dev/ptp0 -g Result: clock time: 1677800973.913598978 or Fri Mar 3 07:49:33 2023 Fixes: fc9df2a0b520 ("igc: Enable RX via AF_XDP zero-copy") Cc: # 5.14+ Signed-off-by: Song Yoong Siang Reviewed-by: Jacob Keller Reviewed-by: Jesper Dangaard Brouer Tested-by: Jesper Dangaard Brouer Tested-by: Naama Meir Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 1eeb807ffd8da5180f8d64d89ce332876acb5dbd Author: Shannon Nelson Date: Tue May 2 13:40:32 2023 -0700 pds_core: add AUXILIARY_BUS and NET_DEVLINK to Kconfig Add selecting of AUXILIARY_BUS and NET_DEVLINK to the pds_core Kconfig. Link: https://lore.kernel.org/netdev/ZE%2FduNH3lBLreNkJ@corigine.com/ Fixes: ddbcb22055d1 ("pds_core: Kconfig and pds_core.rst") Suggested-by: Simon Horman Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit ec788f7e96ad4cd30338a09d466d9368acd73c26 Author: Shannon Nelson Date: Tue May 2 13:27:52 2023 -0700 pds_core: remove CONFIG_DEBUG_FS from makefile This cruft from previous drafts should have been removed when the code was updated to not use the old style dummy helpers. Fixes: 55435ea7729a ("pds_core: initial framework for pds_core PF driver") Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 4a54903ff68ddb33b6463c94b4eb37fc584ef760 Author: Shannon Nelson Date: Tue May 2 11:35:36 2023 -0700 ionic: catch failure from devlink_alloc Add a check for NULL on the alloc return. If devlink_alloc() fails and we try to use devlink_priv() on the NULL return, the kernel gets very unhappy and panics. With this fix, the driver load will still fail, but at least it won't panic the kernel. Fixes: df69ba43217d ("ionic: Add basic framework for IONIC Network device driver") Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 9ad685dbfe7e856bbf17a7177b64676d324d6ed7 Author: Ido Schimmel Date: Tue May 2 15:20:50 2023 +0300 ethtool: Fix uninitialized number of lanes It is not possible to set the number of lanes when setting link modes using the legacy IOCTL ethtool interface. Since 'struct ethtool_link_ksettings' is not initialized in this path, drivers receive an uninitialized number of lanes in 'struct ethtool_link_ksettings::lanes'. When this information is later queried from drivers, it results in the ethtool code making decisions based on uninitialized memory, leading to the following KMSAN splat [1]. In practice, this most likely only happens with the tun driver that simply returns whatever it got in the set operation. As far as I can tell, this uninitialized memory is not leaked to user space thanks to the 'ethtool_ops->cap_link_lanes_supported' check in linkmodes_prepare_data(). Fix by initializing the structure in the IOCTL path. Did not find any more call sites that pass an uninitialized structure when calling 'ethtool_ops::set_link_ksettings()'. [1] BUG: KMSAN: uninit-value in ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline] BUG: KMSAN: uninit-value in ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333 ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline] ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333 ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640 genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555 __sys_sendmsg net/socket.c:2584 [inline] __do_sys_sendmsg net/socket.c:2593 [inline] __se_sys_sendmsg net/socket.c:2591 [inline] __x64_sys_sendmsg+0x36b/0x540 net/socket.c:2591 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: tun_get_link_ksettings+0x37/0x60 drivers/net/tun.c:3544 __ethtool_get_link_ksettings+0x17b/0x260 net/ethtool/ioctl.c:441 ethnl_set_linkmodes+0xee/0x19d0 net/ethtool/linkmodes.c:327 ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640 genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555 __sys_sendmsg net/socket.c:2584 [inline] __do_sys_sendmsg net/socket.c:2593 [inline] __se_sys_sendmsg net/socket.c:2591 [inline] __x64_sys_sendmsg+0x36b/0x540 net/socket.c:2591 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: tun_set_link_ksettings+0x37/0x60 drivers/net/tun.c:3553 ethtool_set_link_ksettings+0x600/0x690 net/ethtool/ioctl.c:609 __dev_ethtool net/ethtool/ioctl.c:3024 [inline] dev_ethtool+0x1db9/0x2a70 net/ethtool/ioctl.c:3078 dev_ioctl+0xb07/0x1270 net/core/dev_ioctl.c:524 sock_do_ioctl+0x295/0x540 net/socket.c:1213 sock_ioctl+0x729/0xd90 net/socket.c:1316 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0x222/0x400 fs/ioctl.c:856 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Local variable link_ksettings created at: ethtool_set_link_ksettings+0x54/0x690 net/ethtool/ioctl.c:577 __dev_ethtool net/ethtool/ioctl.c:3024 [inline] dev_ethtool+0x1db9/0x2a70 net/ethtool/ioctl.c:3078 Fixes: 012ce4dd3102 ("ethtool: Extend link modes settings uAPI with lanes") Reported-and-tested-by: syzbot+ef6edd9f1baaa54d6235@syzkaller.appspotmail.com Link: https://lore.kernel.org/netdev/0000000000004bb41105fa70f361@google.com/ Reviewed-by: Danielle Ratson Signed-off-by: Ido Schimmel Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 0fbd79c01a9a657348f7032df70c57a406468c86 Author: Hayes Wang Date: Tue May 2 11:36:27 2023 +0800 r8152: fix the autosuspend doesn't work Set supports_autosuspend = 1 for the rtl8152_cfgselector_driver. Fixes: ec51fbd1b8a2 ("r8152: add USB device driver for config selection") Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 3711d44fac1f80ea69ecb7315fed05b3812a7401 Author: Shannon Nelson Date: Tue May 2 11:47:40 2023 -0700 ionic: remove noise from ethtool rxnfc error msg It seems that ethtool is calling into .get_rxnfc more often with ETHTOOL_GRXCLSRLCNT which ionic doesn't know about. We don't need to log a message about it, just return not supported. Fixes: aa3198819bea6 ("ionic: Add RSS support") Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2dce08ab7a32b15ee75be6a31084f78e41d2936a Merge: 9e08dcef60baa 99ae1260fdb5f Author: David S. Miller Date: Wed May 3 09:03:00 2023 +0100 Merge branch 'octeontx2-af-fixes' Sai Krishna says: ==================== octeontx2: Miscellaneous fixes This patchset includes following fixes. Patch #1 Fix for the race condition while updating APR table Patch #2 Fix end bit position in NPC scan config Patch #3 Fix depth of CAM, MEM table entries Patch #4 Fix in increase the size of DMAC filter flows Patch #5 Fix driver crash resulting from invalid interface type information retrieved from firmware Patch #6 Fix incorrect mask used while installing filters involving fragmented packets Patch #7 Fixes for NPC field hash extract w.r.t IPV6 hash reduction, IPV6 filed hash configuration. Patch #8 Fix for NPC hardware parser configuration destination address hash, IPV6 endianness issues. Patch #9 Fix for skipping mbox initialization for PFs disabled by firmware. Patch #10 Fix disabling packet I/O in case of mailbox timeout. Patch #11 Fix detaching LF resources in case of VF probe fail. ==================== Signed-off-by: David S. Miller commit 99ae1260fdb5f15beab8a3adfb93a9041c87a2c1 Author: Subbaraya Sundeep Date: Wed May 3 12:39:44 2023 +0530 octeontx2-vf: Detach LF resources on probe cleanup When a VF device probe fails due to error in MSIX vector allocation then the resources NIX and NPA LFs were not detached. Fix this by detaching the LFs when MSIX vector allocation fails. Fixes: 3184fb5ba96e ("octeontx2-vf: Virtual function driver support") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Signed-off-by: David S. Miller commit c926252205c424c4842dbdbe02f8e3296f623204 Author: Subbaraya Sundeep Date: Wed May 3 12:39:43 2023 +0530 octeontx2-pf: Disable packet I/O for graceful exit At the stage of enabling packet I/O in otx2_open, If mailbox timeout occurs then interface ends up in down state where as hardware packet I/O is enabled. Hence disable packet I/O also before bailing out. Fixes: 1ea0166da050 ("octeontx2-pf: Fix the device state on error") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Signed-off-by: David S. Miller commit 5eb1b7220948a69298a436148a735f32ec325289 Author: Ratheesh Kannoth Date: Wed May 3 12:39:42 2023 +0530 octeontx2-af: Skip PFs if not enabled Firmware enables PFs and allocate mbox resources for each of the PFs. Currently PF driver configures mbox resources without checking whether PF is enabled or not. This results in crash. This patch fixes this issue by skipping disabled PF's mbox initialization. Fixes: 9bdc47a6e328 ("octeontx2-af: Mbox communication support btw AF and it's VFs") Signed-off-by: Ratheesh Kannoth Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Signed-off-by: David S. Miller commit f66155905959076619c9c519fb099e8ae6cb6f7b Author: Ratheesh Kannoth Date: Wed May 3 12:39:41 2023 +0530 octeontx2-af: Fix issues with NPC field hash extract 1. Allow field hash configuration for both source and destination IPv6. 2. Configure hardware parser based on hash extract feature enable flag for IPv6. 3. Fix IPv6 endianness issue while updating the source/destination IP address via ntuple rule. Fixes: 56d9f5fd2246 ("octeontx2-af: Use hashed field in MCAM key") Signed-off-by: Ratheesh Kannoth Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 406bed11fb91a0b35c26fe633d8700febaec6439 Author: Ratheesh Kannoth Date: Wed May 3 12:39:40 2023 +0530 octeontx2-af: Update/Fix NPC field hash extract feature 1. As per previous implementation, mask and control parameter to generate the field hash value was not passed to the caller program. Updated the secret key mbox to share that information as well, as a part of the fix. 2. Earlier implementation did not consider hash reduction of both source and destination IPv6 addresses. Only source IPv6 address was considered. This fix solves that and provides option to hash Fixes: 56d9f5fd2246 ("octeontx2-af: Use hashed field in MCAM key") Signed-off-by: Ratheesh Kannoth Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2075bf150ddf320df02c05e242774dc0f73be1a1 Author: Suman Ghosh Date: Wed May 3 12:39:39 2023 +0530 octeontx2-af: Update correct mask to filter IPv4 fragments During the initial design, the IPv4 ip_flag mask was set to 0xff. Which results to filter only fragmets with (fragment_offset == 0). As part of the fix, updated the mask to 0x20 to filter all the fragmented packets irrespective of the fragment_offset value. Fixes: c672e3727989 ("octeontx2-pf: Add support to filter packet based on IP fragment") Signed-off-by: Suman Ghosh Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit cb5edce271764524b88b1a6866b3e626686d9a33 Author: Hariprasad Kelam Date: Wed May 3 12:39:38 2023 +0530 octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field. Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180 Fixes: 61071a871ea6 ("octeontx2-af: Forward CGX link notifications to PFs") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2a6eecc592b4d59a04d513aa25fc0f30d52100cd Author: Ratheesh Kannoth Date: Wed May 3 12:39:37 2023 +0530 octeontx2-pf: Increase the size of dmac filter flows CN10kb supports large number of dmac filter flows to be inserted. Increase the field size to accommodate the same Fixes: b747923afff8 ("octeontx2-af: Exact match support") Signed-off-by: Ratheesh Kannoth Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 60999cb83554ebcf6cfff8894bc2c3d99ea858ba Author: Ratheesh Kannoth Date: Wed May 3 12:39:36 2023 +0530 octeontx2-af: Fix depth of cam and mem table. In current driver, NPC cam and mem table sizes are read from wrong register offset. This patch fixes the register offset so that correct values are populated on read. Fixes: b747923afff8 ("octeontx2-af: Exact match support") Signed-off-by: Ratheesh Kannoth Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit c60a6b90e7890453f09e0d2163d6acadabe3415b Author: Ratheesh Kannoth Date: Wed May 3 12:39:35 2023 +0530 octeontx2-af: Fix start and end bit for scan config In the current driver, NPC exact match feature was not getting enabled as configured bit was not read properly. for_each_set_bit_from() need end bit as one bit post position in the bit map to read NPC exact nibble enable bits properly. This patch fixes the same. Fixes: b747923afff8 ("octeontx2-af: Exact match support") Signed-off-by: Ratheesh Kannoth Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Signed-off-by: David S. Miller commit 048486f81d01db4d100af021ee2ea211d19732a0 Author: Geetha sowjanya Date: Wed May 3 12:39:34 2023 +0530 octeontx2-af: Secure APR table update with the lock APR table contains the lmtst base address of PF/VFs. These entries are updated by the PF/VF during the device probe. The lmtst address is fetched from HW using "TXN_REQ" and "ADDR_RSP_STS" registers. The lock tries to protect these registers from getting overwritten when multiple PFs invokes rvu_get_lmtaddr() simultaneously. For example, if PF1 submit the request and got permitted before it reads the response and PF2 got scheduled submit the request then the response of PF1 is overwritten by the PF2 response. Fixes: 893ae97214c3 ("octeontx2-af: cn10k: Support configurable LMTST regions") Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 9e08dcef60baa3125d10077ce5e9b3b5cf28a169 Merge: c6d96df9fa2c1 c1592a89942e9 Author: David S. Miller Date: Wed May 3 08:55:12 2023 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neir Ayuso says: ==================== The following patchset contains Netfilter fixes for net: 1) Hit ENOENT when trying to update an unexisting base chain. 2) Fix libmnl pkg-config usage in selftests, from Jeremy Sowden. 3) KASAN reports use-after-free when deleting a set element for an anonymous set that was already removed in the same transaction, reported by P. Sondej and P. Krysiuk. ==================== Signed-off-by: David S. Miller commit c1592a89942e9678f7d9c8030efa777c0d57edab Author: Pablo Neira Ayuso Date: Tue May 2 10:25:24 2023 +0200 netfilter: nf_tables: deactivate anonymous set from preparation phase Toggle deleted anonymous sets as inactive in the next generation, so users cannot perform any update on it. Clear the generation bitmask in case the transaction is aborted. The following KASAN splat shows a set element deletion for a bound anonymous set that has been already removed in the same transaction. [ 64.921510] ================================================================== [ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables] [ 64.924745] Write of size 8 at addr dead000000000122 by task test/890 [ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253 [ 64.931120] Call Trace: [ 64.932699] [ 64.934292] dump_stack_lvl+0x33/0x50 [ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables] [ 64.937551] kasan_report+0xda/0x120 [ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables] [ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables] [ 64.942452] ? __kasan_slab_alloc+0x2d/0x60 [ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables] [ 64.945710] ? kasan_set_track+0x21/0x30 [ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink] [ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink] Signed-off-by: Pablo Neira Ayuso commit de4773f0235acf74554f6a64ea60adc0d7b01895 Author: Jeremy Sowden Date: Tue Apr 25 22:11:39 2023 +0100 selftests: netfilter: fix libmnl pkg-config usage 1. Don't hard-code pkg-config 2. Remove distro-specific default for CFLAGS 3. Use pkg-config for LDLIBS Fixes: a50a88f026fb ("selftests: netfilter: fix a build error on openSUSE") Suggested-by: Jan Engelhardt Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso commit 8509f62b0b07ae8d6dec5aa9613ab1b250ff632f Author: Pablo Neira Ayuso Date: Tue Apr 25 16:50:32 2023 +0200 netfilter: nf_tables: hit ENOENT on unexisting chain/flowtable update with missing attributes If user does not specify hook number and priority, then assume this is a chain/flowtable update. Therefore, report ENOENT which provides a better hint than EINVAL. Set on extended netlink error report to refer to the chain name. Fixes: 5b6743fb2c2a ("netfilter: nf_tables: skip flowtable hooknum and priority on device updates") Fixes: 5efe72698a97 ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") Signed-off-by: Pablo Neira Ayuso commit e4212ed0ba58264fbe7706c5493b9600339f60ae Author: Bagas Sanjaya Date: Wed May 3 10:54:16 2023 +0700 ALSA: docs: Fix code block indentation in ALSA driver example Sphinx reports htmldocs warnings: Documentation/sound/kernel-api/writing-an-alsa-driver.rst:3997: WARNING: Literal block expected; none found. Documentation/sound/kernel-api/writing-an-alsa-driver.rst:4004: WARNING: Literal block expected; none found. Documentation/sound/kernel-api/writing-an-alsa-driver.rst:4009: WARNING: Unexpected indentation. Documentation/sound/kernel-api/writing-an-alsa-driver.rst:4035: WARNING: Literal block expected; none found. These are due to indentation of example driver snippets which is outside the code block scope. Fix these by indenting code blocks in question to the scope. Fixes: 4d421eebe1465d ("ALSA: docs: writing-an-alsa-driver.rst: polishing") Reported-by: kernel test robot Closes: https://lore.kernel.org/linux-doc/202305021822.4U6XOvGf-lkp@intel.com/ Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20230503035416.62722-1-bagasdotme@gmail.com Signed-off-by: Takashi Iwai commit 1604f51b401bfd881ab5c6401eaedac97f2166ca Author: Ivan Orlov Date: Mon May 1 14:16:34 2023 +0400 ALSA: docs: Extend module parameters description Common ALSA module parameters look a little bit confusing because of the description lacking, and it took me a while to understand the purpose of their existence. To figure it out I asked the question about them to the "alsa-devel" mailing list, and Takashi Iwai answered me with the text I appended to the ALSA documentation in this patch. These common module parameters aren't used a lot nowadays, but as I understand they are important for providing compatibility with some existing user-space apps. So in my opinion it is a good idea to document why we need them. Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230501101634.476297-1-ivan.orlov0322@gmail.com Signed-off-by: Takashi Iwai commit c8c2969bfcba5fcba3a5b078315c1b586d927d9f Author: Hans de Goede Date: Tue Apr 25 21:44:41 2023 +0200 drm/i915/dsi: Use unconditional msleep() instead of intel_dsi_msleep() The intel_dsi_msleep() helper skips sleeping if the MIPI-sequences have a version of 3 or newer and the panel is in vid-mode. This is based on the big comment around line 730 which starts with "Panel enable/disable sequences from the VBT spec.", where the "v3 video mode seq" column does not have any wait t# entries. Checking the Windows driver shows that it does always honor the VBT delays independent of the version of the VBT sequences. Commit 6fdb335f1c9c ("drm/i915/dsi: Use unconditional msleep for the panel_on_delay when there is no reset-deassert MIPI-sequence") switched to a direct msleep() instead of intel_dsi_msleep() when there is no MIPI_SEQ_DEASSERT_RESET sequence, to fix the panel on an Acer Aspire Switch 10 E SW3-016 not turning on. And now testing on a Nextbook Ares 8A shows that panel_on_delay must always be honored otherwise the panel will not turn on. Instead of only always using regular msleep() for panel_on_delay do as Windows does and always use regular msleep() everywhere were intel_dsi_msleep() is used and drop the intel_dsi_msleep() helper. Changes in v2: - Replace all intel_dsi_msleep() calls instead of just the intel_dsi_msleep(panel_on_delay) call Cc: stable@vger.kernel.org Fixes: 6fdb335f1c9c ("drm/i915/dsi: Use unconditional msleep for the panel_on_delay when there is no reset-deassert MIPI-sequence") Signed-off-by: Hans de Goede Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230425194441.68086-1-hdegoede@redhat.com (cherry picked from commit fa83c12132f71302f7d4b02758dc0d46048d3f5f) Signed-off-by: Joonas Lahtinen commit 6ece90e3665a9b7fb2637fcca26cebd42991580b Author: Radhakrishna Sripada Date: Thu Apr 20 15:12:47 2023 -0700 drm/i915/mtl: Add the missing CPU transcoder mask in intel_device_info CPU transcoder mask is used to iterate over the available CPU transcoders in the macro for_each_cpu_transcoder(). The macro is broken on MTL and got highlighted when audio state was being tracked for each transcoder added in [1]. Add the missing CPU transcoder mask which is similar to ADL-P mask but without DSI transcoders. [1]: https://patchwork.freedesktop.org/patch/523723/ Fixes: 7835303982d1 ("drm/i915/mtl: Add MeteorLake PCI IDs") Cc: Ville Syrjälä Signed-off-by: Radhakrishna Sripada Acked-by: Haridhar Kalvala Reviewed-by: Gustavo Sousa Link: https://patchwork.freedesktop.org/patch/msgid/20230420221248.2511314-1-radhakrishna.sripada@intel.com (cherry picked from commit bddc18913bd44adae5c828fd514d570f43ba1576) Signed-off-by: Joonas Lahtinen commit 1816f4a17f54a01afa2f06d6571c39890b97d282 Author: John Harrison Date: Fri Apr 21 15:47:42 2023 -0700 drm/i915/guc: Actually return an error if GuC version range check fails Dan Carpenter pointed out that 'err' was not being set in the case where the GuC firmware version range check fails. Fix that. Note that while this is a bug fix for a previous patch (see Fixes tag below). It is an exceedingly low risk bug. The range check is asserting that the GuC firmware version is within spec. So it should not be possible to ever have a firmware file that fails this check. If larger version numbers are required in the future, that would be a backwards breaking spec change and thus require a major version bump, in which case an old i915 driver would not load that new version anyway. Fixes: 9bbba0667f37 ("drm/i915/guc: Use GuC submission API version number") Reported-by: Dan Carpenter Signed-off-by: John Harrison Cc: John Harrison Cc: Daniele Ceraolo Spurio Cc: Alan Previn Cc: Umesh Nerlige Ramappa Cc: Rodrigo Vivi Cc: Matthew Brost Cc: Andi Shyti Cc: Matthew Auld Cc: Tvrtko Ursulin Cc: Lucas De Marchi Cc: Jani Nikula Reviewed-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20230421224742.2357198-1-John.C.Harrison@Intel.com (cherry picked from commit 80ab31799002166ac7c660bacfbff4f85bc29107) Signed-off-by: Joonas Lahtinen commit 0b891c83d8c54cb70e186456c2191adb5fd98c56 Author: Arnd Bergmann Date: Sat Apr 29 22:36:04 2023 +0200 module: include internal.h in module/dups.c Two newly introduced functions are declared in a header that is not included before the definition, causing a warning with sparse or 'make W=1': kernel/module/dups.c:118:6: error: no previous prototype for 'kmod_dup_request_exists_wait' [-Werror=missing-prototypes] 118 | bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/module/dups.c:220:6: error: no previous prototype for 'kmod_dup_request_announce' [-Werror=missing-prototypes] 220 | void kmod_dup_request_announce(char *module_name, int ret) | ^~~~~~~~~~~~~~~~~~~~~~~~~ Add an explicit include to ensure the prototypes match. Fixes: 8660484ed1cf ("module: add debugging auto-load duplicate module support") Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304141440.DYO4NAzp-lkp@intel.com/ Signed-off-by: Arnd Bergmann Signed-off-by: Luis Chamberlain commit c6d96df9fa2c1d19525239d4262889cce594ce6c Author: Felix Fietkau Date: Wed Apr 26 19:21:53 2023 +0200 net: ethernet: mtk_eth_soc: drop generic vlan rx offload, only use DSA untagging Through testing I found out that hardware vlan rx offload support seems to have some hardware issues. At least when using multiple MACs and when receiving tagged packets on the secondary MAC, the hardware can sometimes start to emit wrong tags on the first MAC as well. In order to avoid such issues, drop the feature configuration and use the offload feature only for DSA hardware untagging on MT7621/MT7622 devices where this feature works properly. Fixes: 08666cbb7dd5 ("net: ethernet: mtk_eth_soc: add support for configuring vlan rx offload") Tested-by: Frank Wunderlich Signed-off-by: Felix Fietkau Signed-off-by: Frank Wunderlich Tested-by: Arınç ÜNAL Acked-by: Arınç ÜNAL Link: https://lore.kernel.org/r/20230426172153.8352-1-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 0199849acd07d07e2a8e42757653ca8b14a122f5 Author: Luis Chamberlain Date: Tue May 2 18:30:04 2023 -0700 sysctl: remove register_sysctl_paths() The deprecation for register_sysctl_paths() is over. We can rejoice as we nuke register_sysctl_paths(). The routine register_sysctl_table() was the only user left of register_sysctl_paths(), so we can now just open code and move the implementation over to what used to be to __register_sysctl_paths(). The old dynamic struct ctl_table_set *set is now the point to sysctl_table_root.default_set. The old dynamic const struct ctl_path *path was being used in the routine register_sysctl_paths() with a static: static const struct ctl_path null_path[] = { {} }; Since this is a null path we can now just simplfy the old routine and remove its use as its always empty. This saves us a total of 230 bytes. $ ./scripts/bloat-o-meter vmlinux.old vmlinux add/remove: 2/7 grow/shrink: 1/1 up/down: 1015/-1245 (-230) Function old new delta register_leaf_sysctl_tables.constprop - 524 +524 register_sysctl_table 22 497 +475 __pfx_register_leaf_sysctl_tables.constprop - 16 +16 null_path 8 - -8 __pfx_register_sysctl_paths 16 - -16 __pfx_register_leaf_sysctl_tables 16 - -16 __pfx___register_sysctl_paths 16 - -16 __register_sysctl_base 29 12 -17 register_sysctl_paths 18 - -18 register_leaf_sysctl_tables 534 - -534 __register_sysctl_paths 620 - -620 Total: Before=21259666, After=21259436, chg -0.00% Signed-off-by: Luis Chamberlain commit 9e7c73c0b9f49bc73818e08e6282a32b94d96168 Author: Luis Chamberlain Date: Thu Mar 2 12:28:23 2023 -0800 kernel: pid_namespace: simplify sysctls with register_sysctl() register_sysctl_paths() is only required if your child (directories) have entries and pid_namespace does not. So use register_sysctl_init() instead where we don't care about the return value and use register_sysctl() where we do. Signed-off-by: Luis Chamberlain Acked-by: Jeff Xu Link: https://lore.kernel.org/r/20230302202826.776286-9-mcgrof@kernel.org commit 31c6ed4e89187beef8fe2f979c8881ca94839427 Author: Hal Feng Date: Tue Apr 18 20:37:56 2023 +0800 clk: starfive: Fix RESET_STARFIVE_JH7110 can't be selected in a specified case When (ARCH_STARFIVE [=n] && COMPILE_TEST [=y] && RESET_CONTROLLER [=n]), RESET_STARFIVE_JH7110 can't be selected by CLK_STARFIVE_JH7110_SYS and CLK_STARFIVE_JH7110_AON. Add a condition `if RESET_CONTROLLER` to fix it. Also, delete redundant selected options of CLK_STARFIVE_JH7110_AON because these options are already selected by the dependency. Fixes: edab7204afe5 ("clk: starfive: Add StarFive JH7110 system clock driver") Fixes: b2ab3c94f41f ("clk: starfive: Add StarFive JH7110 always-on clock driver") Signed-off-by: Hal Feng Link: https://lore.kernel.org/r/20230418123756.62495-2-hal.feng@starfivetech.com Reviewed-by: Conor Dooley Signed-off-by: Stephen Boyd commit 5c667d5a5a3ec16609229dddf25a46654186b52b Author: Nathan Chancellor Date: Mon May 1 14:34:47 2023 -0700 clk: sp7021: Adjust width of _m in HWM_FIELD_PREP() When building with clang + W=1, there is a warning around an internal comparison check within the FIELD_PREP() macro, due to a 32-bit variable comparison against ~0ull: drivers/clk/clk-sp7021.c:316:8: error: result of comparison of constant 18446744073709551615 with expression of type 'typeof (_Generic((_m), ...' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] r0 |= HWM_FIELD_PREP(MASK_SEL_FRA, clk->p[SEL_FRA]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/clk/clk-sp7021.c:45:15: note: expanded from macro 'HWM_FIELD_PREP' (_m << 16) | FIELD_PREP(_m, value); \ ^~~~~~~~~~~~~~~~~~~~~ include/linux/bitfield.h:114:3: note: expanded from macro 'FIELD_PREP' __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_PREP: "); \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/bitfield.h:71:53: note: expanded from macro '__BF_FIELD_CHECK' BUILD_BUG_ON_MSG(__bf_cast_unsigned(_mask, _mask) > \ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:397:22: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/compiler_types.h:385:23: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/compiler_types.h:377:9: note: expanded from macro '__compiletime_assert' if (!(condition)) \ ^~~~~~~~~ This is expected given the types of the input. Increase the size of the temporary variable in HWM_FIELD_PREP() to eliminate the warning, which follows the logic of commit cfd6fb45cfaf ("crypto: ccree - avoid out-of-range warnings from clang") for the same reasons. Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230501-sp7021-field_prep-warning-v1-1-5b36d71feefe@kernel.org Reported-by: kernel test robot Link: https://lore.kernel.org/202303221947.pXP2v4xJ-lkp@intel.com/ Reviewed-by: Nick Desaulniers Signed-off-by: Stephen Boyd commit 690dccc4a0bf8b6b4eeb160882ec584d3d0bb642 Author: Adam Ford Date: Sun Apr 23 07:38:27 2023 -0500 Revert "clk: imx: composite-8m: Add support to determine_rate" This reverts commit 156e96ff2172518b6f83e97d8f11f677bc668e22. This patch was found to cause some division issues on the i.MX8MP which causes the video clocks to not properly divide when division was greate than 8. This causes video failures on disp1_pix and disp2_pix clocks. Until a better solution is found, we'll have to revert this. Signed-off-by: Adam Ford Link: https://lore.kernel.org/r/20230423123828.1346511-1-aford173@gmail.com Acked-by: Peng Fan Signed-off-by: Stephen Boyd commit 6152e53d9671b0ccc21c1bca842617b32ccfc5d8 Author: Suren Baghdasaryan Date: Fri Apr 28 10:35:33 2023 -0700 mm: change per-VMA lock statistics to be disabled by default Change CONFIG_PER_VMA_LOCK_STATS to be disabled by default, as most users don't need it. Add configuration help to clarify its usage. Link: https://lkml.kernel.org/r/20230428173533.18158-1-surenb@google.com Fixes: 52f238653e45 ("mm: introduce per-VMA lock statistics") Signed-off-by: Suren Baghdasaryan Suggested-by: Linus Torvalds Reviewed-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton commit 3628d2bb155b0e4dfc1922a99de0631d3e2095d3 Author: Michal Simek Date: Tue May 2 15:55:00 2023 +0200 MAINTAINERS: update Michal Simek's email @xilinx.com is still working but better to switch to new amd.com after AMD/Xilinx acquisition. Link: https://lkml.kernel.org/r/bd073d026f8c367a9cfb45d26d39f26e40c665dc.1683035692.git.michal.simek@amd.com Signed-off-by: Michal Simek Cc: Colin Ian King Cc: Jakub Kicinski Cc: Kirill Tkhai Cc: Konrad Dybcio Cc: Qais Yousef Cc: Michal Simek Signed-off-by: Andrew Morton commit 00ca0f2e86bf40b016a646e6323a8941a09cf106 Author: Lorenzo Stoakes Date: Sun Apr 30 16:07:07 2023 +0100 mm/mempolicy: correctly update prev when policy is equal on mbind The refactoring in commit f4e9e0e69468 ("mm/mempolicy: fix use-after-free of VMA iterator") introduces a subtle bug which arises when attempting to apply a new NUMA policy across a range of VMAs in mbind_range(). The refactoring passes a **prev pointer to keep track of the previous VMA in order to reduce duplication, and in all but one case it keeps this correctly updated. The bug arises when a VMA within the specified range has an equivalent policy as determined by mpol_equal() - which unlike other cases, does not update prev. This can result in a situation where, later in the iteration, a VMA is found whose policy does need to change. At this point, vma_merge() is invoked with prev pointing to a VMA which is before the previous VMA. Since vma_merge() discovers the curr VMA by looking for the one immediately after prev, it will now be in a situation where this VMA is incorrect and the merge will not proceed correctly. This is checked in the VM_WARN_ON() invariant case with end > curr->vm_end, which, if a merge is possible, results in a warning (if CONFIG_DEBUG_VM is specified). I note that vma_merge() performs these invariant checks only after merge_prev/merge_next are checked, which is debatable as it hides this issue if no merge is possible even though a buggy situation has arisen. The solution is simply to update the prev pointer even when policies are equal. This caused a bug to arise in the 6.2.y stable tree, and this patch resolves this bug. Link: https://lkml.kernel.org/r/83f1d612acb519d777bebf7f3359317c4e7f4265.1682866629.git.lstoakes@gmail.com Fixes: f4e9e0e69468 ("mm/mempolicy: fix use-after-free of VMA iterator") Signed-off-by: Lorenzo Stoakes Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202304292203.44ddeff6-oliver.sang@intel.com Cc: Liam R. Howlett Cc: Mel Gorman Cc: Signed-off-by: Andrew Morton commit 43ec16f1450f4936025a9bdf1a273affdb9732c1 Author: Zhang Zhengming Date: Wed Apr 19 12:02:03 2023 +0800 relayfs: fix out-of-bounds access in relay_file_read There is a crash in relay_file_read, as the var from point to the end of last subbuf. The oops looks something like: pc : __arch_copy_to_user+0x180/0x310 lr : relay_file_read+0x20c/0x2c8 Call trace: __arch_copy_to_user+0x180/0x310 full_proxy_read+0x68/0x98 vfs_read+0xb0/0x1d0 ksys_read+0x6c/0xf0 __arm64_sys_read+0x20/0x28 el0_svc_common.constprop.3+0x84/0x108 do_el0_svc+0x74/0x90 el0_svc+0x1c/0x28 el0_sync_handler+0x88/0xb0 el0_sync+0x148/0x180 We get the condition by analyzing the vmcore: 1). The last produced byte and last consumed byte both at the end of the last subbuf 2). A softirq calls function(e.g __blk_add_trace) to write relay buffer occurs when an program is calling relay_file_read_avail(). relay_file_read relay_file_read_avail relay_file_read_consume(buf, 0, 0); //interrupted by softirq who will write subbuf .... return 1; //read_start point to the end of the last subbuf read_start = relay_file_read_start_pos //avail is equal to subsize avail = relay_file_read_subbuf_avail //from points to an invalid memory address from = buf->start + read_start //system is crashed copy_to_user(buffer, from, avail) Link: https://lkml.kernel.org/r/20230419040203.37676-1-zhang.zhengming@h3c.com Fixes: 8d62fdebdaf9 ("relay file read: start-pos fix") Signed-off-by: Zhang Zhengming Reviewed-by: Zhao Lei Reviewed-by: Zhou Kete Reviewed-by: Pengcheng Yang Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton commit 29083fd84da576bfb3563d044f98d38e6b338f00 Author: Mark Rutland Date: Tue Apr 18 17:42:12 2023 +0100 kasan: hw_tags: avoid invalid virt_to_page() When booting with 'kasan.vmalloc=off', a kernel configured with support for KASAN_HW_TAGS will explode at boot time due to bogus use of virt_to_page() on a vmalloc adddress. With CONFIG_DEBUG_VIRTUAL selected this will be reported explicitly, and with or without CONFIG_DEBUG_VIRTUAL the kernel will dereference a bogus address: | ------------[ cut here ]------------ | virt_to_phys used for non-linear address: (____ptrval____) (0xffff800008000000) | WARNING: CPU: 0 PID: 0 at arch/arm64/mm/physaddr.c:15 __virt_to_phys+0x78/0x80 | Modules linked in: | CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.3.0-rc3-00073-g83865133300d-dirty #4 | Hardware name: linux,dummy-virt (DT) | pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __virt_to_phys+0x78/0x80 | lr : __virt_to_phys+0x78/0x80 | sp : ffffcd076afd3c80 | x29: ffffcd076afd3c80 x28: 0068000000000f07 x27: ffff800008000000 | x26: fffffbfff0000000 x25: fffffbffff000000 x24: ff00000000000000 | x23: ffffcd076ad3c000 x22: fffffc0000000000 x21: ffff800008000000 | x20: ffff800008004000 x19: ffff800008000000 x18: ffff800008004000 | x17: 666678302820295f x16: ffffffffffffffff x15: 0000000000000004 | x14: ffffcd076b009e88 x13: 0000000000000fff x12: 0000000000000003 | x11: 00000000ffffefff x10: c0000000ffffefff x9 : 0000000000000000 | x8 : 0000000000000000 x7 : 205d303030303030 x6 : 302e30202020205b | x5 : ffffcd076b41d63f x4 : ffffcd076afd3827 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : ffffcd076afd3a30 x0 : 000000000000004f | Call trace: | __virt_to_phys+0x78/0x80 | __kasan_unpoison_vmalloc+0xd4/0x478 | __vmalloc_node_range+0x77c/0x7b8 | __vmalloc_node+0x54/0x64 | init_IRQ+0x94/0xc8 | start_kernel+0x194/0x420 | __primary_switched+0xbc/0xc4 | ---[ end trace 0000000000000000 ]--- | Unable to handle kernel paging request at virtual address 03fffacbe27b8000 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041bc5000 | [03fffacbe27b8000] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: | CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 6.3.0-rc3-00073-g83865133300d-dirty #4 | Hardware name: linux,dummy-virt (DT) | pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __kasan_unpoison_vmalloc+0xe4/0x478 | lr : __kasan_unpoison_vmalloc+0xd4/0x478 | sp : ffffcd076afd3ca0 | x29: ffffcd076afd3ca0 x28: 0068000000000f07 x27: ffff800008000000 | x26: 0000000000000000 x25: 03fffacbe27b8000 x24: ff00000000000000 | x23: ffffcd076ad3c000 x22: fffffc0000000000 x21: ffff800008000000 | x20: ffff800008004000 x19: ffff800008000000 x18: ffff800008004000 | x17: 666678302820295f x16: ffffffffffffffff x15: 0000000000000004 | x14: ffffcd076b009e88 x13: 0000000000000fff x12: 0000000000000001 | x11: 0000800008000000 x10: ffff800008000000 x9 : ffffb2f8dee00000 | x8 : 000ffffb2f8dee00 x7 : 205d303030303030 x6 : 302e30202020205b | x5 : ffffcd076b41d63f x4 : ffffcd076afd3827 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : ffffcd076afd3a30 x0 : ffffb2f8dee00000 | Call trace: | __kasan_unpoison_vmalloc+0xe4/0x478 | __vmalloc_node_range+0x77c/0x7b8 | __vmalloc_node+0x54/0x64 | init_IRQ+0x94/0xc8 | start_kernel+0x194/0x420 | __primary_switched+0xbc/0xc4 | Code: d34cfc08 aa1f03fa 8b081b39 d503201f (f9400328) | ---[ end trace 0000000000000000 ]--- | Kernel panic - not syncing: Attempted to kill the idle task! This is because init_vmalloc_pages() erroneously calls virt_to_page() on a vmalloc address, while virt_to_page() is only valid for addresses in the linear/direct map. Since init_vmalloc_pages() expects virtual addresses in the vmalloc range, it must use vmalloc_to_page() rather than virt_to_page(). We call init_vmalloc_pages() from __kasan_unpoison_vmalloc(), where we check !is_vmalloc_or_module_addr(), suggesting that we might encounter a non-vmalloc address. Luckily, this never happens. By design, we only call __kasan_unpoison_vmalloc() on pointers in the vmalloc area, and I have verified that we don't violate that expectation. Given that, is_vmalloc_or_module_addr() must always be true for any legitimate argument to __kasan_unpoison_vmalloc(). Correct init_vmalloc_pages() to use vmalloc_to_page(), and remove the redundant and misleading use of is_vmalloc_or_module_addr() in __kasan_unpoison_vmalloc(). Link: https://lkml.kernel.org/r/20230418164212.1775741-1-mark.rutland@arm.com Fixes: 6c2f761dad7851d8 ("kasan: fix zeroing vmalloc memory with HW_TAGS") Signed-off-by: Mark Rutland Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit 245f0922689364b21163af4937a05ea0ba576fae Author: Kefeng Wang Date: Mon Apr 17 12:53:23 2023 +0800 mm: hwpoison: coredump: support recovery from dump_user_range() dump_user_range() is used to copy the user page to a coredump file, but if a hardware memory error occurred during copy, which called from __kernel_write_iter() in dump_user_range(), it crashes, CPU: 112 PID: 7014 Comm: mca-recover Not tainted 6.3.0-rc2 #425 pc : __memcpy+0x110/0x260 lr : _copy_from_iter+0x3bc/0x4c8 ... Call trace: __memcpy+0x110/0x260 copy_page_from_iter+0xcc/0x130 pipe_write+0x164/0x6d8 __kernel_write_iter+0x9c/0x210 dump_user_range+0xc8/0x1d8 elf_core_dump+0x308/0x368 do_coredump+0x2e8/0xa40 get_signal+0x59c/0x788 do_signal+0x118/0x1f8 do_notify_resume+0xf0/0x280 el0_da+0x130/0x138 el0t_64_sync_handler+0x68/0xc0 el0t_64_sync+0x188/0x190 Generally, the '->write_iter' of file ops will use copy_page_from_iter() and copy_page_from_iter_atomic(), change memcpy() to copy_mc_to_kernel() in both of them to handle #MC during source read, which stop coredump processing and kill the task instead of kernel panic, but the source address may not always a user address, so introduce a new copy_mc flag in struct iov_iter{} to indicate that the iter could do a safe memory copy, also introduce the helpers to set/cleck the flag, for now, it's only used in coredump's dump_user_range(), but it could expand to any other scenarios to fix the similar issue. Link: https://lkml.kernel.org/r/20230417045323.11054-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: Alexander Viro Cc: Christian Brauner Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Tong Tiangen Cc: Jens Axboe Signed-off-by: Andrew Morton commit 65f67a3e002f0e5ae84a65be915248d57d480060 Author: Baolin Wang Date: Tue Apr 25 20:44:53 2023 +0800 mm/page_alloc: add some comments to explain the possible hole in __pageblock_pfn_to_page() Now the __pageblock_pfn_to_page() is used by set_zone_contiguous(), which checks whether the given zone contains holes, and uses pfn_to_online_page() to validate if the start pfn is online and valid, as well as using pfn_valid() to validate the end pfn. However, the __pageblock_pfn_to_page() function may return non-NULL even if the end pfn of a pageblock is in a memory hole in some situations. For example, if the pageblock order is MAX_ORDER, which will fall into 2 sub-sections, and the end pfn of the pageblock may be hole even though the start pfn is online and valid. See below memory layout as an example and suppose the pageblock order is MAX_ORDER. [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000040000000-0x00000000ffffffff] [ 0.000000] DMA32 empty [ 0.000000] Normal [mem 0x0000000100000000-0x0000001fa7ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000040000000-0x0000001fa3c7ffff] [ 0.000000] node 0: [mem 0x0000001fa3c80000-0x0000001fa3ffffff] [ 0.000000] node 0: [mem 0x0000001fa4000000-0x0000001fa402ffff] [ 0.000000] node 0: [mem 0x0000001fa4030000-0x0000001fa40effff] [ 0.000000] node 0: [mem 0x0000001fa40f0000-0x0000001fa73cffff] [ 0.000000] node 0: [mem 0x0000001fa73d0000-0x0000001fa745ffff] [ 0.000000] node 0: [mem 0x0000001fa7460000-0x0000001fa746ffff] [ 0.000000] node 0: [mem 0x0000001fa7470000-0x0000001fa758ffff] [ 0.000000] node 0: [mem 0x0000001fa7590000-0x0000001fa7dfffff] Focus on the last memory range, and there is a hole for the range [mem 0x0000001fa7590000-0x0000001fa7dfffff]. That means the last pageblock will contain the range from 0x1fa7c00000 to 0x1fa7ffffff, since the pageblock must be 4M aligned. And in this pageblock, these pfns will fall into 2 sub-section (the sub-section size is 2M aligned). So, the 1st sub-section (indicates pfn range: 0x1fa7c00000 - 0x1fa7dfffff ) in this pageblock is valid by calling subsection_map_init() in free_area_init(), but the 2nd sub-section (indicates pfn range: 0x1fa7e00000 - 0x1fa7ffffff ) in this pageblock is not valid. This did not break anything until now, but the zone continuous is fragile in this possible scenario. So as previous discussion[1], it is better to add some comments to explain this possible issue in case there are some future pfn walkers that rely on this. [1] https://lore.kernel.org/all/87r0sdsmr6.fsf@yhuang6-desk2.ccr.corp.intel.com/ Link: https://lkml.kernel.org/r/5c26368865e79c743a453dea48d30670b19d2e4f.1682425534.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/5c26368865e79c743a453dea48d30670b19d2e4f.1682425534.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: Michal Hocko Reviewed-by: "Huang, Ying" Cc: Baolin Wang Cc: David Hildenbrand Cc: Mel Gorman Cc: Mike Rapoport (IBM) Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2c281f54f556e1f3266c8cb104adf9eea7a7b742 Author: David Hildenbrand Date: Sat Apr 22 23:01:56 2023 +0200 mm/ksm: move disabling KSM from s390/gmap code to KSM code Let's factor out actual disabling of KSM. The existing "mm->def_flags &= ~VM_MERGEABLE;" was essentially a NOP and can be dropped, because def_flags should never include VM_MERGEABLE. Note that we don't currently prevent re-enabling KSM. This should now be faster in case KSM was never enabled, because we only conditionally iterate all VMAs. Further, it certainly looks cleaner. Link: https://lkml.kernel.org/r/20230422210156.33630-1-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Janosch Frank Acked-by: Stefan Roesch Cc: Christian Borntraeger Cc: Claudio Imbrenda Cc: Heiko Carstens Cc: Johannes Weiner Cc: Michal Hocko Cc: Rik van Riel Cc: Shuah Khan Cc: Sven Schnelle Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit 1150ea9338554ee6685c9f8939cf7202bf5b27cf Author: David Hildenbrand Date: Sat Apr 22 22:54:19 2023 +0200 selftests/ksm: ksm_functional_tests: add prctl unmerge test Let's test whether setting PR_SET_MEMORY_MERGE to 0 after setting it to 1 will unmerge pages, similar to how setting MADV_UNMERGEABLE after setting MADV_MERGEABLE would. Link: https://lkml.kernel.org/r/20230422205420.30372-3-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Stefan Roesch Cc: Christian Borntraeger Cc: Claudio Imbrenda Cc: Heiko Carstens Cc: Janosch Frank Cc: Johannes Weiner Cc: Michal Hocko Cc: Rik van Riel Cc: Shuah Khan Cc: Sven Schnelle Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit 24139c07f413ef4b555482c758343d71392a19bc Author: David Hildenbrand Date: Sat Apr 22 22:54:18 2023 +0200 mm/ksm: unmerge and clear VM_MERGEABLE when setting PR_SET_MEMORY_MERGE=0 Patch series "mm/ksm: improve PR_SET_MEMORY_MERGE=0 handling and cleanup disabling KSM", v2. (1) Make PR_SET_MEMORY_MERGE=0 unmerge pages like setting MADV_UNMERGEABLE does, (2) add a selftest for it and (3) factor out disabling of KSM from s390/gmap code. This patch (of 3): Let's unmerge any KSM pages when setting PR_SET_MEMORY_MERGE=0, and clear the VM_MERGEABLE flag from all VMAs -- just like KSM would. Of course, only do that if we previously set PR_SET_MEMORY_MERGE=1. Link: https://lkml.kernel.org/r/20230422205420.30372-1-david@redhat.com Link: https://lkml.kernel.org/r/20230422205420.30372-2-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Stefan Roesch Cc: Christian Borntraeger Cc: Claudio Imbrenda Cc: Heiko Carstens Cc: Janosch Frank Cc: Johannes Weiner Cc: Michal Hocko Cc: Rik van Riel Cc: Shuah Khan Cc: Sven Schnelle Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit 70307b0e297a6634be855c49525ccbea50922a90 Author: Kefeng Wang Date: Wed Mar 8 16:33:11 2023 +0800 mm/damon/paddr: fix missing folio_sz update in damon_pa_young() The *folio_sz in damon_pa_young() will be used(as last_folio_sz) by __damon_pa_check_access(), so it's need to be updated, fix missing branch. Link: https://lkml.kernel.org/r/20230308083311.120951-4-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit b6993be23601c8bc992dc9743fbf78c1ff5d6b6a Author: Kefeng Wang Date: Wed Mar 8 16:33:10 2023 +0800 mm/damon/paddr: minor refactor of damon_pa_mark_accessed_or_deactivate() Omit one line by unified folio_put(), and make code more clear. Link: https://lkml.kernel.org/r/20230308083311.120951-3-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit dd411433129c07a3bea43a0cc5ad9587bac1736a Author: Kefeng Wang Date: Wed Mar 8 16:33:09 2023 +0800 mm/damon/paddr: minor refactor of damon_pa_pageout() Patch series "mm/damon/paddr: minor code improvement", v3. Unify folio_put() to make code more clear, and also fix minor issue in damon_pa_young(). This patch (of 3): Omit three lines by unified folio_put(), and make code more clear. Link: https://lkml.kernel.org/r/20230308083311.120951-1-wangkefeng.wang@huawei.com Link: https://lkml.kernel.org/r/20230308083311.120951-2-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 348551ddaf311c76b01cdcbaf61b6fef06a49144 Merge: 7df047b3f0aa0 b7badd752de05 Author: Linus Torvalds Date: Tue May 2 15:40:41 2023 -0700 Merge tag 'pinctrl-v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Mostly drivers! Nothing special: some new Qualcomm chips as usual, and the new NXP S32 and nVidia BlueField-3. Core changes: - Make a lot of pin controllers with GPIO and irqchips immutable, i.e. not living structs, but const structs. This is driving a changed initiated by the irqchip maintainers. New drivers: - New driver for the NXP S32 SoC pin controller - As part of a thorough cleanup and restructuring of the Ralink/Mediatek drivers, the Ralink MIPS pin control drivers were folded into the Mediatek directory and the family is renamed "mtmips". The Ralink chips live on as Mediatek MIPS family where new variants can be added. As part of this work also the device tree bindings were reworked. - New subdriver for the Qualcomm SM7150 SoC. - New subdriver for the Qualcomm IPQ9574 SoC. - New driver for the nVidia BlueField-3 SoC. - Support for the Qualcomm PMM8654AU mixed signal circuit GPIO. - Support for the Qualcomm PMI632 mixed signal circuit GPIO. Improvements: - Add some missing pins and generic cleanups on the Renesas r8a779g0 and r8a779g0 pin controllers. Generic Renesas extension for power source selection on several SoCs. - Misc cleanups for the Atmel AT91 and AT91-PIO4 pin controllers - Make the GPIO mode work on the Qualcomm SM8550-lpass-lpi driver. - Several device tree binding cleanups as the binding YAML syntax is solidifying" * tag 'pinctrl-v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (153 commits) pinctrl-bcm2835.c: fix race condition when setting gpio dir dt-bindings: pinctrl: qcom,sm8150: Drop duplicate function value "atest_usb2" dt-bindings: pinctrl: qcom: Add few missing functions pinctrl: qcom: spmi-gpio: Add PMI632 support dt-bindings: pinctrl: qcom,pmic-gpio: add PMI632 pinctrl: wpcm450: select MFD_SYSCON pinctrl: qcom ssbi-gpio: Convert to immutable irq_chip pinctrl: qcom ssbi-mpp: Convert to immutable irq_chip pinctrl: qcom spmi-mpp: Convert to immutable irq_chip pinctrl: plgpio: Convert to immutable irq_chip pinctrl: pistachio: Convert to immutable irq_chip pinctrl: pic32: Convert to immutable irq_chip pinctrl: sx150x: Convert to immutable irq_chip pinctrl: stmfx: Convert to immutable irq_chip pinctrl: st: Convert to immutable irq_chip pinctrl: mcp23s08: Convert to immutable irq_chip pinctrl: equilibrium: Convert to immutable irq_chip pinctrl: npcm7xx: Convert to immutable irq_chip pinctrl: armada-37xx: Convert to immutable irq_chip pinctrl: nsp: Convert to immutable irq_chip ... commit fc412a6196a6f46ece0e6e6b118556464f165800 Author: Tom Rix Date: Tue May 2 14:07:13 2023 -0400 lockd: define nlm_port_min,max with CONFIG_SYSCTL gcc with W=1 and ! CONFIG_SYSCTL fs/lockd/svc.c:80:51: error: ‘nlm_port_max’ defined but not used [-Werror=unused-const-variable=] 80 | static const int nlm_port_min = 0, nlm_port_max = 65535; | ^~~~~~~~~~~~ fs/lockd/svc.c:80:33: error: ‘nlm_port_min’ defined but not used [-Werror=unused-const-variable=] 80 | static const int nlm_port_min = 0, nlm_port_max = 65535; | ^~~~~~~~~~~~ The only use of these variables is when CONFIG_SYSCTL is defined, so their definition should be likewise conditional. Signed-off-by: Tom Rix Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 340086da9a87820b40601141a0e9e87c954ac006 Author: Tom Rix Date: Tue May 2 13:11:21 2023 -0400 nfsd: define exports_proc_ops with CONFIG_PROC_FS gcc with W=1 and ! CONFIG_PROC_FS fs/nfsd/nfsctl.c:161:30: error: ‘exports_proc_ops’ defined but not used [-Werror=unused-const-variable=] 161 | static const struct proc_ops exports_proc_ops = { | ^~~~~~~~~~~~~~~~ The only use of exports_proc_ops is when CONFIG_PROC_FS is defined, so its definition should be likewise conditional. Signed-off-by: Tom Rix Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7df047b3f0aa0c0ba730b6be9ab35c0053a3d4fd Merge: 21d2be646007a 705b004ee377b Author: Linus Torvalds Date: Tue May 2 11:56:43 2023 -0700 Merge tag 'vfio-v6.4-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Expose and allow R/W access to the PCIe DVSEC capability through vfio-pci, as we already do with the legacy vendor capability (K V P Satyanarayana) - Fix kernel-doc issues with structure definitions (Simon Horman) - Clarify ordering of operations relative to the kvm-vfio device for driver dependencies against the kvm pointer (Yi Liu) * tag 'vfio-v6.4-rc1' of https://github.com/awilliam/linux-vfio: docs: kvm: vfio: Suggest KVM_DEV_VFIO_GROUP_ADD vs VFIO_GROUP_GET_DEVICE_FD ordering vfio: correct kdoc for ops structures vfio/pci: Add DVSEC PCI Extended Config Capability to user visible list. commit 21d2be646007a1c5461f4233749c368693aa6d9f Merge: d7b3ffe2d7e47 9ea4eff4b6f4f Author: Linus Torvalds Date: Tue May 2 11:23:08 2023 -0700 Merge tag 'afs-fixes-20230502' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS updates from David Howells: "Three fixes to AFS directory handling: - Make sure that afs_read_dir() sees any increase in file size if the file unexpectedly changed on the server (e.g. due to another client making a change). - Make afs_getattr() always return the server's dir file size, not the locally edited one, so that pagecache eviction doesn't cause the dir file size to change unexpectedly. - Prevent afs_read_dir() from getting into an endless loop if the server indicates that the directory file size is larger than expected" * tag 'afs-fixes-20230502' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Avoid endless loop if file is larger than expected afs: Fix getattr to report server i_size on dirs, not local size afs: Fix updating of i_size with dv jump from server commit d7b3ffe2d7e476f11d73b74093006aa936f59e8b Merge: 3af49062b0115 fb200218b40b7 Author: Linus Torvalds Date: Tue May 2 10:46:11 2023 -0700 Merge tag 'backlight-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Fix-ups: - Add / improve Device Tree bindings - Convert (int) .remove functions to (void) .remove_new - Rid 'defined but not used' warnings - Remove ineffective casts and pointer stubs - Use specifically crafted API for testing DT property presence" * tag 'backlight-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: as3711: Use of_property_read_bool() for boolean properties backlight: hx8357: Use of_property_present() for testing DT property presence backlight: arcxcnn_bl: Drop of_match_ptr for ID table backlight: lp855x: Mark OF related data as maybe unused backlight: sky81452-backlight: Convert to platform remove callback returning void backlight: rt4831-backlight: Convert to platform remove callback returning void backlight: qcom-wled: Convert to platform remove callback returning void backlight: pwm_bl: Convert to platform remove callback returning void backlight: mt6370-backlight: Convert to platform remove callback returning void backlight: lp8788_bl: Convert to platform remove callback returning void backlight: lm3533_bl: Convert to platform remove callback returning void backlight: led_bl: Convert to platform remove callback returning void backlight: hp680_bl: Convert to platform remove callback returning void backlight: da9052_bl: Convert to platform remove callback returning void backlight: cr_bllcd: Convert to platform remove callback returning void backlight: adp5520_bl: Convert to platform remove callback returning void backlight: aat2870_bl: Convert to platform remove callback returning void backlight: qcom-wled: Add PMI8950 compatible commit 3af49062b0115b55a54615109172b44f618daf97 Merge: c5eb8bf76718c 9e9ff39243ea8 Author: Linus Torvalds Date: Tue May 2 10:41:31 2023 -0700 Merge tag 'mfd-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Drivers: - Add support for Renesas RZ/G2L MTU3 New Device Support: - Add support for Lenovo Yoga Book X90F to Intel CHT WC - Add support for MAX5970 and MAX5978 to Simple MFD (I2C) - Add support for Meteor Lake PCH-S LPSS PCI to Intel LPSS PCI - Add support for AXP15060 PMIC to X-Powers PMIC collection Remove Device Support: - Remove support for Samsung 5M8751 and S5M8763 PMIC devices New Functionality: - Convert deprecated QCOM IRQ Chip to config registers - Add support for 32-bit address spaces to Renesas SMUs Fix-ups: - Make use of APIs / MACROs designed to simplify and demystify - Add / improve Device Tree bindings - Memory saving struct layout optimisations - Remove old / deprecated functionality - Factor out unassigned register addresses from ranges - Trivial: Spelling fixes, renames and coding style fixes - Rid 'defined but not used' warnings - Remove ineffective casts and pointer stubs Bug Fixes: - Fix incorrectly non-inverted mask/unmask IRQs on QCOM platforms - Remove MODULE_*() helpers from non-tristate drivers - Do not attempt to use out-of-range memory addresses associated with io_base - Provide missing export helpers - Fix remap bulk read optimisation fallout - Fix memory leak issues in error paths" * tag 'mfd-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (88 commits) dt-bindings: mfd: ti,j721e-system-controller: Add SoC chip ID leds: bd2606mvv: Driver for the Rohm 6 Channel i2c LED driver dt-bindings: mfd: qcom,spmi-pmic: Document flash LED controller dt-bindings: mfd: x-powers,axp152: Document the AXP15060 variant mfd: axp20x: Add support for AXP15060 PMIC dt-bindings: mfd: x-powers,axp152: Document the AXP313a variant counter: rz-mtu3-cnt: Unlock on error in rz_mtu3_count_ceiling_write() dt-bindings: mfd: dlg,da9063: Document voltage monitoring dt-bindings: mfd: stm32: Remove unnecessary blank lines dt-bindings: mfd: qcom,spmi-pmic: Use generic ADC node name in examples dt-bindings: mfd: syscon: Add nuvoton,ma35d1-sys compatible MAINTAINERS: Add entries for Renesas RZ/G2L MTU3a counter driver counter: Add Renesas RZ/G2L MTU3a counter driver Documentation: ABI: sysfs-bus-counter: add cascade_counts_enable and external_input_phase_clock_select mfd: Add Renesas RZ/G2L MTU3a core driver dt-bindings: timer: Document RZ/G2L MTU3a bindings mfd: rsmu_i2c: Convert to i2c's .probe_new() again mfd: intel-lpss: Add Intel Meteor Lake PCH-S LPSS PCI IDs mfd: dln2: Fix memory leak in dln2_probe() mfd: axp20x: Fix axp288 writable-ranges ... commit c5eb8bf76718cf2e2f36aac216a99014f00927de Merge: 865fdb08197e6 8325642d2757e Author: Linus Torvalds Date: Tue May 2 10:36:02 2023 -0700 Merge tag 'leds-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "New Drivers: - Add support for MediaTek MT6370 LED Indicator - Add support for MediaTek MT6370 Flashlight - Add support for QCOM PMIC Flash - Add support for Rohm BD2606MVV Charge Pump LED New Device Support: - Add support for PMK8550 PWM to QCOM LPG New Functionality: - Add support for high resolution PWM to QCOM LPG Fix-ups: - Kconfig 'depends' and 'select' dependency changes - Remove unused / irrelevant includes - Remove unnecessary checks (already performed further into the call stack) - Trivial: Fix commentary, simplify error messages - Rid 'defined but not used' warnings - Provide documentation - Explicitly provide include files Bug Fixes: - Mark GPIO LED as BROKEN - Fix Kconfig entries - Fix various Smatch staticify reports - Fix error handling (or a lack there of)" * tag 'leds-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (30 commits) leds: bd2606mvv: Driver for the Rohm 6 Channel i2c LED driver dt-bindings: leds: Add ROHM BD2606MVV LED docs: leds: ledtrig-oneshot: Fix spelling mistake leds: pwm-multicolor: Simplify an error message dt-bindings: leds: Convert PCA9532 to dtschema leds: rgb: leds-qcom-lpg: Add support for PMK8550 PWM leds: rgb: leds-qcom-lpg: Add support for high resolution PWM dt-bindings: leds-qcom-lpg: Add qcom,pmk8550-pwm compatible string leds: tca6507: Fix error handling of using fwnode_property_read_string leds: flash: Set variables mvflash_{3,4}ch_regs storage-class-specifier to static leds: rgb: mt6370: Correct config name to select in LEDS_MT6370_RGB MAINTAINERS: Add entry for LED devices documentation Documentation: leds: MT6370: Use bullet lists for timing variables Documentation: leds: mt6370: Properly wrap hw_pattern chart Documentation: leds: Add MT6370 doc to the toctree leds: rgb: mt6370: Fix implicit declaration for FIELD_GET docs: leds: Add MT6370 RGB LED pattern document leds: flash: mt6370: Add MediaTek MT6370 flashlight support leds: rgb: mt6370: Add MediaTek MT6370 current sink type LED Indicator support dt-bindings: leds: spmi-flash-led: Add pm6150l compatible ... commit cdc822dda6f82269b94d5fa60ddc71d98c160fa0 Author: Carlos Bilbao Date: Wed Mar 15 09:35:26 2023 -0500 docs/sp_SP: Add translation of process/adding-syscalls Translate Documentation/process/adding-syscalls.rst into Spanish. Co-developed-by: Mauricio Fuentes Signed-off-by: Mauricio Fuentes Signed-off-by: Carlos Bilbao Link: https://lore.kernel.org/r/20230315143526.1213813-1-carlos.bilbao@amd.com commit 37c95f3a3d251a9319ed137ee0adf5ab9e431ce2 Author: Mat Martineau Date: Mon May 1 17:05:44 2023 -0700 CREDITS: Update email address for Mat Martineau Changing my email address in CREDITS to be consistent with what's in use in MAINTAINERS and mailmap. Also removed extra date information from the CREDITS entry since I'm a maintainer for MPTCP again. Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230502000545.2899055-1-martineau@kernel.org Signed-off-by: Jonathan Corbet commit 530421acaeda1d8c3533f241db944127f69efadc Author: 晏艳(采苓) Date: Tue Mar 28 15:25:37 2023 +0800 Documentation: update kernel stack for x86_64 Commit 6538b8ea886e ("x86_64: expand kernel stack to 16K") expanded kernel stack for x86_64 but left the wrong documentation, update it. Signed-off-by: Yan Yan Reviewed-by: Lai Jiangshan Link: https://lore.kernel.org/r/20230328072537.20188-1-yanyan.yan@antgroup.com Signed-off-by: Jonathan Corbet commit 4a2d80ad062e2f3722227a72ad6050aa3e2c7676 Author: Tao Liu Date: Wed Apr 26 10:14:52 2023 +0800 docs: Remove unnecessary unicode character There is a non-printable unicode char '\u202a' or "0xe2 0x80 0xaa" in hex in the translation doc. It is unnecessary and should be removed for better text formatting when using editors like vi. Signed-off-by: Tao Liu Reviewed-by: Yanteng Si Link: https://lore.kernel.org/r/20230426021452.9745-1-ltao@redhat.com Signed-off-by: Jonathan Corbet commit be8ca5f4bcdb8f12f75e0fc64f37a13657440f22 Author: Deming Wang Date: Mon May 1 21:01:57 2023 -0400 docs: fix "Reviewd" typo Spell "Reviewed" properly in Documentation/Translations/jp/SubmittingPatches Signed-off-by: Deming Wang Reviewed-by: Akira Yokosawa Link: https://lore.kernel.org/r/20230502010157.1655-1-wangdeming@inspur.com Signed-off-by: Jonathan Corbet commit 4c093cbb89f32762555f624882f1d31a79237eaf Author: Geert Uytterhoeven Date: Tue May 2 12:05:10 2023 +0200 Documentation: timers: hrtimers: Make hybrid union historical Non-scalar time was removed from the ktime hybrid union in v3.17, and the union itself followed suit in v4.10. Make it clear that ktime_t is always a 64bit scalar type, to avoid confusing the casual reader. While at it, fix a spelling mistake. Fixes: 24e4a8c3e8868874 ("ktime: Kill non-scalar ktime_t implementation for 2038") Fixes: 2456e855354415bf ("ktime: Get rid of the union") Signed-off-by: Geert Uytterhoeven Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/r/59250a3d1c2c827b5c1833169a6e652ca6a784e6.1683021785.git.geert+renesas@glider.be Signed-off-by: Jonathan Corbet commit 9ea4eff4b6f4f36546d537a74da44fd3f30903ab Author: Marc Dionne Date: Fri Dec 2 10:19:42 2022 -0400 afs: Avoid endless loop if file is larger than expected afs_read_dir fetches an amount of data that's based on what the inode size is thought to be. If the file on the server is larger than what was fetched, the code rechecks i_size and retries. If the local i_size was not properly updated, this can lead to an endless loop of fetching i_size from the server and noticing each time that the size is larger on the server. If it is known that the remote size is larger than i_size, bump up the fetch size to that size. Fixes: f3ddee8dc4e2 ("afs: Fix directory handling") Signed-off-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org commit 45f66fa03ba9943cca5af88d691399332b8bde08 Author: David Howells Date: Tue Dec 6 13:49:42 2022 +0000 afs: Fix getattr to report server i_size on dirs, not local size Fix afs_getattr() to report the server's idea of the file size of a directory rather than the local size. The local size may differ as we edit the local copy to avoid having to redownload it and we may end up with a differently structured blob of a different size. However, if the directory is discarded from the pagecache we then download it again and the user may see the directory file size apparently change. Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org commit d7f74e9a917503ee78f2b603a456d7227cf38919 Author: Marc Dionne Date: Fri Dec 2 10:07:01 2022 -0400 afs: Fix updating of i_size with dv jump from server If the data version returned from the server is larger than expected, the local data is invalidated, but we may still want to note the remote file size. Since we're setting change_size, we have to also set data_changed for the i_size to get updated. Fixes: 3f4aa9818163 ("afs: Fix EOF corruption") Signed-off-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org commit af97b7dfb0d4636d58f2341346fffce30c6c2259 Author: Ard Biesheuvel Date: Mon May 1 16:04:08 2023 +0200 SUNRPC: Avoid relying on crypto API to derive CBC-CTS output IV Scott reports SUNRPC self-test failures regarding the output IV on arm64 when using the SIMD accelerated implementation of AES in CBC mode with ciphertext stealing ("cts(cbc(aes))" in crypto API speak). These failures are the result of the fact that, while RFC 3962 does specify what the output IV should be and includes test vectors for it, the general concept of an output IV is poorly defined, and generally, not specified by the various algorithms implemented by the crypto API. Only algorithms that support transparent chaining (e.g., CBC mode on a block boundary) have requirements on the output IV, but ciphertext stealing (CTS) is fundamentally about how to encapsulate CBC in a way where the length of the entire message may not be an integral multiple of the cipher block size, and the concept of an output IV does not exist here because it has no defined purpose past the end of the message. The generic CTS template takes advantage of this chaining capability of the CBC implementations, and as a result, happens to return an output IV, simply because it passes its IV buffer directly to the encapsulated CBC implementation, which operates on full blocks only, and always returns an IV. This output IV happens to match how RFC 3962 defines it, even though the CTS template itself does not contain any output IV logic whatsoever, and, for this reason, lacks any test vectors that exercise this accidental output IV generation. The arm64 SIMD implementation of cts(cbc(aes)) does not use the generic CTS template at all, but instead, implements the CBC mode and ciphertext stealing directly, and therefore does not encapsule a CBC implementation that returns an output IV in the same way. The arm64 SIMD implementation complies with the specification and passes all internal tests, but when invoked by the SUNRPC code, fails to produce the expected output IV and causes its selftests to fail. Given that the output IV is defined as the penultimate block (where the final block may smaller than the block size), we can quite easily derive it in the caller by copying the appropriate slice of ciphertext after encryption. Cc: Trond Myklebust Cc: Anna Schumaker Cc: Chuck Lever Cc: Jeff Layton Reported-by: Scott Mayhew Tested-by: Scott Mayhew Signed-off-by: Ard Biesheuvel Signed-off-by: Chuck Lever commit 90c49fce1c43e1cc152695e20363ff5087897c09 Author: Paulo Alcantara Date: Fri Apr 21 15:52:32 2023 -0300 cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path as well and then prevent any potential use-after-free bugs. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 1810769e3a51375ca35d7a5e5f79542858ca495a Author: Paulo Alcantara Date: Thu Apr 27 16:20:13 2023 -0300 cifs: print smb3_fs_context::source when mounting Print full device name (UNC + optional prefix) from @old_ctx->source when printing info about mount. Before patch mount.cifs //srv/share/dir /mnt -o ... dmesg ... CIFS: Attempting to mount \\srv\share After patch mount.cifs //srv/share/dir /mnt -o ... dmesg ... CIFS: Attempting to mount //srv/share/dir Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 5bff9f741af60b143a5ae73417a8ec47fd5ff2f4 Author: Paulo Alcantara Date: Thu Apr 27 16:07:38 2023 -0300 cifs: protect session status check in smb2_reconnect() Use @ses->ses_lock to protect access of @ses->ses_status. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 3d6b15a8f3aeb4a6eed69a22822def0d0b039a16 Author: Steve French Date: Sun Apr 30 12:27:49 2023 -0500 SMB3.1.1: correct definition for app_instance_id create contexts The name lengths were incorrect for two create contexts. SMB2_CREATE_APP_INSTANCE_ID SMB2_CREATE_APP_INSTANCE_VERSION Update the definitions for these two to match the protocol specs. Acked-by: Paulo Alcantara (SUSE) Reviewed-by: Namjae Jeon Signed-off-by: Steve French commit 7e2d06628aab6324e1ac885910a52f4c038d4043 Author: Mark Asselstine Date: Mon May 1 19:13:46 2023 -0400 ALSA: hda/realtek: Add quirk for ASUS UM3402YAR using CS35L41 This Asus Zenbook laptop uses Realtek HDA codec combined with 2xCS35L41 Amplifiers using I2C with External Boost. Signed-off-by: Mark Asselstine Cc: Link: https://lore.kernel.org/r/20230501231346.54979-1-asselsm@gmail.com Signed-off-by: Takashi Iwai commit 0cce06ba859a515bd06224085d3addb870608b6d Author: Peter Zijlstra Date: Tue Apr 25 17:03:13 2023 +0200 debugobjects,locking: Annotate debug_object_fill_pool() wait type violation There is an explicit wait-type violation in debug_object_fill_pool() for PREEMPT_RT=n kernels which allows them to more easily fill the object pool and reduce the chance of allocation failures. Lockdep's wait-type checks are designed to check the PREEMPT_RT locking rules even for PREEMPT_RT=n kernels and object to this, so create a lockdep annotation to allow this to stand. Specifically, create a 'lock' type that overrides the inner wait-type while it is held -- allowing one to temporarily raise it, such that the violation is hidden. Reported-by: Vlastimil Babka Reported-by: Qi Zheng Signed-off-by: Peter Zijlstra (Intel) Tested-by: Qi Zheng Link: https://lkml.kernel.org/r/20230429100614.GA1489784@hirez.programming.kicks-ass.net commit e7db9e5c6b9615b287d01f0231904fbc1fbde9c5 Author: Boris Burkov Date: Fri Apr 28 14:02:11 2023 -0700 btrfs: fix encoded write i_size corruption with no-holes We have observed a btrfs filesystem corruption on workloads using no-holes and encoded writes via send stream v2. The symptom is that a file appears to be truncated to the end of its last aligned extent, even though the final unaligned extent and even the file extent and otherwise correctly updated inode item have been written. So if we were writing out a 1MiB+X file via 8 128K extents and one extent of length X, i_size would be set to 1MiB, but the ninth extent, nbyte, etc. would all appear correct otherwise. The source of the race is a narrow (one line of code) window in which a no-holes fs has read in an updated i_size, but has not yet set a shared disk_i_size variable to write. Therefore, if two ordered extents run in parallel (par for the course for receive workloads), the following sequence can play out: (following "threads" a bit loosely, since there are callbacks involved for endio but extra threads aren't needed to cause the issue) ENC-WR1 (second to last) ENC-WR2 (last) ------- ------- btrfs_do_encoded_write set i_size = 1M submit bio B1 ending at 1M endio B1 btrfs_inode_safe_disk_i_size_write local i_size = 1M falls off a cliff for some reason btrfs_do_encoded_write set i_size = 1M+X submit bio B2 ending at 1M+X endio B2 btrfs_inode_safe_disk_i_size_write local i_size = 1M+X disk_i_size = 1M+X disk_i_size = 1M btrfs_delayed_update_inode btrfs_delayed_update_inode And the delayed inode ends up filled with nbytes=1M+X and isize=1M, and writes respect i_size and present a corrupted file missing its last extents. Fix this by holding the inode lock in the no-holes case so that a thread can't sneak in a write to disk_i_size that gets overwritten with an out of date i_size. Fixes: 41a2ee75aab0 ("btrfs: introduce per-inode file extent tree") CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Josef Bacik Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0fddb79bf283a561eb81f09d01f5ac8f61bf8966 Author: Fangrui Song Date: Tue May 2 07:41:05 2023 +0000 arm64: lds: move .got section out of .text Currently, the .got section is placed within the output section .text. However, when .got is non-empty, the SHF_WRITE flag is set for .text when linked by lld. GNU ld recognizes .text as a special section and ignores the SHF_WRITE flag. By renaming .text, we can also get the SHF_WRITE flag. The kernel has performed R_AARCH64_RELATIVE resolving very early, and can then assume that .got is read-only. Let's move .got to the vmlinux_rodata pseudo-segment. As Ard Biesheuvel notes: "This matters to consumers of the vmlinux ELF representation of the kernel image, such as syzkaller, which disregards writable PT_LOAD segments when resolving code symbols. The kernel itself does not care about this distinction, but given that the GOT contains data and not code, it does not require executable permissions, and therefore does not belong in .text to begin with." Reviewed-by: Ard Biesheuvel Signed-off-by: Fangrui Song Link: https://lore.kernel.org/r/20230502074105.1541926-1-maskray@google.com Signed-off-by: Will Deacon commit 4df69e0df295822cdf816442fe4897f214cccb08 Author: ndesaulniers@google.com Date: Fri Apr 28 11:28:17 2023 -0700 arm64: kernel: remove SHF_WRITE|SHF_EXECINSTR from .idmap.text commit d54170812ef1 ("arm64: fix .idmap.text assertion for large kernels") modified some of the section assembler directives that declare .idmap.text to be SHF_ALLOC instead of SHF_ALLOC|SHF_WRITE|SHF_EXECINSTR. This patch fixes up the remaining stragglers that were left behind. Add Fixes tag so that this doesn't precede related change in stable. Fixes: d54170812ef1 ("arm64: fix .idmap.text assertion for large kernels") Reported-by: Greg Thelen Reviewed-by: Ard Biesheuvel Signed-off-by: Nick Desaulniers Link: https://lore.kernel.org/r/20230428-awx-v2-1-b197ffa16edc@google.com Signed-off-by: Will Deacon commit eda081d2efac50c9b314df7fb340a62306a7b07a Author: Kristina Martsenko Date: Fri Apr 28 14:25:46 2023 +0100 arm64: cpufeature: Fix pointer auth hwcaps The pointer auth hwcaps are not getting reported to userspace, as they are missing the .matches field. Add the field back. Fixes: 876e3c8efe79 ("arm64/cpufeature: Pull out helper for CPUID register definitions") Signed-off-by: Kristina Martsenko Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20230428132546.2513834-1-kristina.martsenko@arm.com Signed-off-by: Will Deacon commit 9b86c49710eec7b4fbb78a0232b2dd0972a2b576 Author: Yang Jihong Date: Fri Apr 21 02:59:53 2023 +0000 perf tracepoint: Fix memory leak in is_valid_tracepoint() When is_valid_tracepoint() returns 1, need to call put_events_file() to free `dir_path`. Fixes: 25a7d914274de386 ("perf parse-events: Use get/put_events_file()") Signed-off-by: Yang Jihong Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230421025953.173826-1-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 6bf86cada3eb8ec3eb80cdce5280e7a22dac8b01 Author: Ganapatrao Kulkarni Date: Thu Apr 20 22:52:53 2023 -0700 perf cs-etm: Add fix for coresight trace for any range of CPUs The current implementation supports coresight trace decode for a range of CPUs, if the first CPU is CPU0. Perf report segfaults, if tried for sparse CPUs list and also for any range of CPUs(non zero first CPU). Adding a fix to perf report for any range of CPUs and for sparse list. Signed-off-by: Ganapatrao Kulkarni Link: https://lore.kernel.org/r/20230421055253.83912-1-gankulkarni@os.amperecomputing.com Cc: suzuki.poulose@arm.com Cc: acme@kernel.org Cc: mathieu.poirier@linaro.org Cc: mike.leach@linaro.org Cc: linux-arm-kernel@lists.infradead.org Cc: darren@os.amperecomputing.com Cc: scclevenger@os.amperecomputing.com Cc: scott@os.amperecomputing.com Cc: linux-kernel@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d199226143f0ef6919131120319766ece514314e Author: James Clark Date: Tue Apr 25 11:44:13 2023 +0100 perf build: Fix unescaped # in perf build-test With the following bash and make versions: $ make --version GNU Make 4.2.1 Built for aarch64-unknown-linux-gnu $ bash --version GNU bash, version 5.0.17(1)-release (aarch64-unknown-linux-gnu) This error is encountered when running the build-test target: $ make -C tools/perf build-test tests/make:181: *** unterminated call to function 'shell': missing ')'. Stop. make: *** [Makefile:103: build-test] Error 2 Fix it by escaping the # which was causing make to interpret the rest of the line as a comment leaving the unclosed opening bracket. Fixes: 56d5229471ee1634 ("tools build: Pass libbpf feature only if libbpf 1.0+") Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20230425104414.1723571-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit c31380140f11195abb5b5f576355f886d32afd1c Author: Changbin Du Date: Wed Apr 26 11:22:46 2023 +0800 perf unwind: Suppress massive unsupported target platform errors When cross-analyzing perf data recorded on an another platform, massive unsupported target platform errors are printed. So let's show this message as warning and only once. Signed-off-by: Changbin Du Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Hui Wang Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230426032246.3608596-1-changbin.du@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 69b0e112612be9e325ea682263d895f3c675772f Author: Sriram Yagnaraman Date: Wed Apr 26 12:41:49 2023 +0200 perf script: Add new parameter in kfree_skb tracepoint to the python scripts using it Include reason parameter that was added in commit c504e5c2f9648a1e ("net: skb: introduce kfree_skb_reason()") Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sriram Yagnaraman Link: https://lore.kernel.org/r/20230426104149.14089-1-sriram.yagnaraman@est.tech Signed-off-by: Arnaldo Carvalho de Melo commit 0e20f4311254193fbf9eebafb4dc5c922a885397 Author: Changbin Du Date: Tue Apr 18 11:18:23 2023 +0800 perf script: Print raw ip instead of binary offset for callchain Before this, the raw ip is printed for non-callchain and dso offset for callchain. This inconsistent output for address may confuse people. And mostly what we expect is the raw ip. 'dso offset' is printed in callchain: $ perf script ... ls 1341034 2739463.008343: 2162417 cycles: ffffffff99d657a7 [unknown] ([unknown]) ffffffff99e00b67 [unknown] ([unknown]) 235d3 memset+0x53 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) # dso offset a61b _dl_map_object+0x1bb (/usr/lib/x86_64-linux-gnu/ld-2.31.so) raw ip is printed for non-callchain: $ perf script -G ... ls 1341034 2739463.008876: 2053304 cycles: ffffffffc1596923 [unknown] ([unknown]) ls 1341034 2739463.009381: 1917049 cycles: 14def8e149e6 __strcoll_l+0xd96 (/usr/lib/x86_64-linux-gnu/libc-2.31.so) # raw ip Let's have consistent output for it. Later I'll add a new field 'dsoff' to print dso offset. Signed-off-by: Changbin Du Acked-by: Adrian Hunter Cc: Alexander Shishkin Cc: Hui Wang Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230418031825.1262579-2-changbin.du@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 1511e4696acb715a4fe48be89e1e691daec91c0e Author: Yang Jihong Date: Thu Apr 27 01:28:41 2023 +0000 perf symbols: Fix return incorrect build_id size in elf_read_build_id() In elf_read_build_id(), if gnu build_id is found, should return the size of the actually copied data. If descsz is greater thanBuild_ID_SIZE, write_buildid data access may occur. Fixes: be96ea8ffa788dcc ("perf symbols: Fix issue with binaries using 16-bytes buildids (v2)") Reported-by: Will Ochowicz Signed-off-by: Yang Jihong Tested-by: Will Ochowicz Acked-by: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/lkml/CWLP265MB49702F7BA3D6D8F13E4B1A719C649@CWLP265MB4970.GBRP265.PROD.OUTLOOK.COM/T/ Link: https://lore.kernel.org/r/20230427012841.231729-1-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 6a7b57d85f4a6232d435eac945b325d9048f030c Author: Namhyung Kim Date: Thu Apr 27 16:05:02 2023 -0700 perf list: Modify the warning message about scandirat(3) It should mention scandirat() instead of scandir(). Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230427230502.1526136-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7586d11d36fad5e6a28736be7ac8f9495e28289a Author: Namhyung Kim Date: Thu Apr 27 16:05:01 2023 -0700 perf list: Fix memory leaks in print_tracepoint_events() It should free entries (not only the array) filled by scandirat() after use. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230427230502.1526136-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b9f82b5c63bf5390da19e879275a792a959a8dac Author: Namhyung Kim Date: Thu Apr 27 16:48:33 2023 -0700 perf lock contention: Rework offset calculation with BPF CO-RE It seems BPF CO-RE reloc doesn't work well with the pattern that gets the field-offset only. Use offsetof() to make it explicit so that the compiler would generate the correct code. Fixes: 0c1228486befa3d6 ("perf lock contention: Support pre-5.14 kernels") Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andrii Nakryiko Cc: Hao Luo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Co-developed-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20230427234833.1576130-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e53de7b65a3ca59af268c78df2d773f277f717fd Author: Namhyung Kim Date: Thu Apr 27 16:48:32 2023 -0700 perf lock contention: Fix struct rq lock access The BPF CO-RE's ignore suffix rule requires three underscores. Otherwise it'd fail like below: $ sudo perf lock contention -ab libbpf: prog 'collect_lock_syms': BPF program load failed: Invalid argument libbpf: prog 'collect_lock_syms': -- BEGIN PROG LOAD LOG -- reg type unsupported for arg#0 function collect_lock_syms#380 ; int BPF_PROG(collect_lock_syms) 0: (b7) r6 = 0 ; R6_w=0 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r9 = 1 ; R9_w=1 3: failed to resolve CO-RE relocation [381] struct rq__new.__lock (0:0 @ offset 0) Fixes: 0c1228486befa3d6 ("perf lock contention: Support pre-5.14 kernels") Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andrii Nakryiko Cc: Hao Luo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20230427234833.1576130-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b8969a1b69672b163d057e7745ebc915df689211 Author: Ondrej Mosnacek Date: Tue May 2 10:02:33 2023 +0200 crypto: api - Fix CRYPTO_USER checks for report function Checking the config via ifdef incorrectly compiles out the report functions when CRYPTO_USER is set to =m. Fix it by using IS_ENABLED() instead. Fixes: c0f9e01dd266 ("crypto: api - Check CRYPTO_USER instead of NET for report") Signed-off-by: Ondrej Mosnacek Signed-off-by: Herbert Xu commit 0af462f19e635ad522f28981238334620881badc Author: Thomas Gleixner Date: Mon May 1 17:42:06 2023 +0200 debugobject: Ensure pool refill (again) The recent fix to ensure atomicity of lookup and allocation inadvertently broke the pool refill mechanism. Prior to that change debug_objects_activate() and debug_objecs_assert_init() invoked debug_objecs_init() to set up the tracking object for statically initialized objects. That's not longer the case and debug_objecs_init() is now the only place which does pool refills. Depending on the number of statically initialized objects this can be enough to actually deplete the pool, which was observed by Ido via a debugobjects OOM warning. Restore the old behaviour by adding explicit refill opportunities to debug_objects_activate() and debug_objecs_assert_init(). Fixes: 63a759694eed ("debugobject: Prevent init race with static objects") Reported-by: Ido Schimmel Signed-off-by: Thomas Gleixner Tested-by: Ido Schimmel Link: https://lore.kernel.org/r/871qk05a9d.ffs@tglx commit 529de2f1ca3f0898c0d905b7d355a43dce1de7dc Author: Maximilian Weigand Date: Mon May 1 17:07:49 2023 -0700 Input: cyttsp5 - fix array length The cmd array should be initialized with the proper command size and not with the actual command value that is sent to the touchscreen. Signed-off-by: Maximilian Weigand Reviewed-by: Alistair Francis Link: https://lore.kernel.org/r/20230501113010.891786-2-mweigand@mweigand.net Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5 touchscreen") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit c2d3c8441e3ddbfe41fea9282ddc6ee372e154cd Author: Conor Dooley Date: Thu Apr 20 19:30:16 2023 +0100 RISC-V: include cpufeature.h in cpufeature.c Automation complains: warning: symbol '__pcpu_scope_misaligned_access_speed' was not declared. Should it be static? cpufeature.c doesn't actually include the header of the same name, as it had not previously used anything from it. The per-cpu variable is declared there, so include it to silence the complaints. Fixes: 62a31d6e38bd ("RISC-V: hwprobe: Support probing of misaligned access performance") Signed-off-by: Conor Dooley Reviewed-by: Evan Green Link: https://lore.kernel.org/r/20230420-wound-gizzard-2b2b589d9bea@spud Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 865fdb08197e657c59e74a35fa32362b12397f58 Merge: c8c655c34e335 9a87ffc99ec8e Author: Linus Torvalds Date: Mon May 1 17:18:56 2023 -0700 Merge tag 'input-for-v6.4-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a new driver for Novatek touch controllers - a new driver for power button for NXP BBNSM - a skeleton KUnit tests for the input core - improvements to Xpad game controller driver to support more devices - improvements to edt-ft5x06, hideep and other drivers * tag 'input-for-v6.4-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (42 commits) Revert "Input: xpad - fix support for some third-party controllers" dt-bindings: input: pwm-beeper: convert to dt schema Input: xpad - fix PowerA EnWired Controller guide button Input: xpad - add constants for GIP interface numbers Input: synaptics-rmi4 - fix function name in kerneldoc Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe Input: edt-ft5x06 - select REGMAP_I2C Input: melfas_mip4 - report palm touches Input: cma3000_d0x - remove unneeded code Input: edt-ft5x06 - calculate points data length only once Input: edt-ft5x06 - unify the crc check Input: edt-ft5x06 - convert to use regmap API Input: edt-ft5x06 - don't print error messages with dev_dbg() Input: edt-ft5x06 - remove code duplication Input: edt-ft5x06 - don't recalculate the CRC Input: edt-ft5x06 - add spaces to ensure format specification Input: edt-ft5x06 - remove unnecessary blank lines Input: edt-ft5x06 - fix indentation Input: tsc2007 - enable cansleep pendown GPIO Input: Add KUnit tests for some of the input core helper functions ... commit 4db9e253e7016e6588620ad02d4ed326107506db Author: Alexandre Ghiti Date: Fri Apr 28 14:09:32 2023 +0200 riscv: Move .rela.dyn to the init sections The recent introduction of relocatable kernels prepared the move of .rela.dyn to the init section, but actually forgot to do so, so do it here. Before this patch: "Freeing unused kernel image (initmem) memory: 2592K" After this patch: "Freeing unused kernel image (initmem) memory: 6288K" The difference corresponds to the size of the .rela.dyn section: "[42] .rela.dyn RELA ffffffff8197e798 0127f798 000000000039c660 0000000000000018 A 47 0 8" Fixes: 559d1e45a16d ("riscv: Use --emit-relocs in order to move .rela.dyn in init") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230428120932.22735-1-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 41ebfc91f785c202e8e8f9bd2f67154efad6287e Author: Conor Dooley Date: Thu Apr 27 11:43:42 2023 +0100 dt-bindings: riscv: explicitly mention assumption of Zicsr & Zifencei support The dt-binding was defined before the extraction of csr access and fence.i into their own extensions, and thus the presence of the I base extension implies Zicsr and Zifencei. There's no harm in adding them obviously, but for backwards compatibility with DTs that existed prior to that extraction, software is unable to differentiate between "i" and "i_zicsr_zifencei" without any further information. Signed-off-by: Conor Dooley Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230427-fence-blurred-c92fb69d4137@wendy Signed-off-by: Palmer Dabbelt commit 2254a7396a0ca6309854948ee1c0a33fa4268cec Author: Darrick J. Wong Date: Tue May 2 09:16:14 2023 +1000 xfs: fix xfs_inodegc_stop racing with mod_delayed_work syzbot reported this warning from the faux inodegc shrinker that tries to kick off inodegc work: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 102 at kernel/workqueue.c:1445 __queue_work+0xd44/0x1120 kernel/workqueue.c:1444 RIP: 0010:__queue_work+0xd44/0x1120 kernel/workqueue.c:1444 Call Trace: __queue_delayed_work+0x1c8/0x270 kernel/workqueue.c:1672 mod_delayed_work_on+0xe1/0x220 kernel/workqueue.c:1746 xfs_inodegc_shrinker_scan fs/xfs/xfs_icache.c:2212 [inline] xfs_inodegc_shrinker_scan+0x250/0x4f0 fs/xfs/xfs_icache.c:2191 do_shrink_slab+0x428/0xaa0 mm/vmscan.c:853 shrink_slab+0x175/0x660 mm/vmscan.c:1013 shrink_one+0x502/0x810 mm/vmscan.c:5343 shrink_many mm/vmscan.c:5394 [inline] lru_gen_shrink_node mm/vmscan.c:5511 [inline] shrink_node+0x2064/0x35f0 mm/vmscan.c:6459 kswapd_shrink_node mm/vmscan.c:7262 [inline] balance_pgdat+0xa02/0x1ac0 mm/vmscan.c:7452 kswapd+0x677/0xd60 mm/vmscan.c:7712 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 This warning corresponds to this code in __queue_work: /* * For a draining wq, only works from the same workqueue are * allowed. The __WQ_DESTROYING helps to spot the issue that * queues a new work item to a wq after destroy_workqueue(wq). */ if (unlikely(wq->flags & (__WQ_DESTROYING | __WQ_DRAINING) && WARN_ON_ONCE(!is_chained_work(wq)))) return; For this to trip, we must have a thread draining the inodedgc workqueue and a second thread trying to queue inodegc work to that workqueue. This can happen if freezing or a ro remount race with reclaim poking our faux inodegc shrinker and another thread dropping an unlinked O_RDONLY file: Thread 0 Thread 1 Thread 2 xfs_inodegc_stop xfs_inodegc_shrinker_scan xfs_is_inodegc_enabled xfs_clear_inodegc_enabled xfs_inodegc_queue_all xfs_inodegc_queue xfs_is_inodegc_enabled drain_workqueue llist_empty mod_delayed_work_on(..., 0) __queue_work In other words, everything between the access to inodegc_enabled state and the decision to poke the inodegc workqueue requires some kind of coordination to avoid the WQ_DRAINING state. We could perhaps introduce a lock here, but we could also try to eliminate WQ_DRAINING from the picture. We could replace the drain_workqueue call with a loop that flushes the workqueue and queues workers as long as there is at least one inode present in the per-cpu inodegc llists. We've disabled inodegc at this point, so we know that the number of queued inodes will eventually hit zero as long as xfs_inodegc_start cannot reactivate the workers. There are four callers of xfs_inodegc_start. Three of them come from the VFS with s_umount held: filesystem thawing, failed filesystem freezing, and the rw remount transition. The fourth caller is mounting rw (no remount or freezing possible). There are three callers ofs xfs_inodegc_stop. One is unmounting (no remount or thaw possible). Two of them come from the VFS with s_umount held: fs freezing and ro remount transition. Hence, it is correct to replace the drain_workqueue call with a loop that drains the inodegc llists. Fixes: 6191cf3ad59f ("xfs: flush inodegc workqueue tasks before cancel") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 2d5f38a31980d7090f5bf91021488dc61a0ba8ee Author: Darrick J. Wong Date: Tue May 2 09:16:14 2023 +1000 xfs: disable reaping in fscounters scrub The fscounters scrub code doesn't work properly because it cannot quiesce updates to the percpu counters in the filesystem, hence it returns false corruption reports. This has been fixed properly in one of the online repair patchsets that are under review by replacing the xchk_disable_reaping calls with an exclusive filesystem freeze. Disabling background gc isn't sufficient to fix the problem. In other words, scrub doesn't need to call xfs_inodegc_stop, which is just as well since it wasn't correct to allow scrub to call xfs_inodegc_start when something else could be calling xfs_inodegc_stop (e.g. trying to freeze the filesystem). Neuter the scrubber for now, and remove the xchk_*_reaping functions. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit b37c4c8339cd394ea6b8b415026603320a185651 Author: Darrick J. Wong Date: Tue May 2 09:16:12 2023 +1000 xfs: check that per-cpu inodegc workers actually run on that cpu Now that we've allegedly worked out the problem of the per-cpu inodegc workers being scheduled on the wrong cpu, let's put in a debugging knob to let us know if a worker ever gets mis-scheduled again. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 03e0add80f4cf3f7393edb574eeb3a89a1db7758 Author: Darrick J. Wong Date: Tue May 2 09:16:05 2023 +1000 xfs: explicitly specify cpu when forcing inodegc delayed work to run immediately I've been noticing odd racing behavior in the inodegc code that could only be explained by one cpu adding an inode to its inactivation llist at the same time that another cpu is processing that cpu's llist. Preemption is disabled between get/put_cpu_ptr, so the only explanation is scheduler mayhem. I inserted the following debug code into xfs_inodegc_worker (see the next patch): ASSERT(gc->cpu == smp_processor_id()); This assertion tripped during overnight tests on the arm64 machines, but curiously not on x86_64. I think we haven't observed any resource leaks here because the lockfree list code can handle simultaneous llist_add and llist_del_all functions operating on the same list. However, the whole point of having percpu inodegc lists is to take advantage of warm memory caches by inactivating inodes on the last processor to touch the inode. The incorrect scheduling seems to occur after an inodegc worker is subjected to mod_delayed_work(). This wraps mod_delayed_work_on with WORK_CPU_UNBOUND specified as the cpu number. Unbound allows for scheduling on any cpu, not necessarily the same one that scheduled the work. Because preemption is disabled for as long as we have the gc pointer, I think it's safe to use current_cpu() (aka smp_processor_id) to queue the delayed work item on the correct cpu. Fixes: 7cf2b0f9611b ("xfs: bound maximum wait time for inodegc work") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 1bba82fe1afac69c85c1f5ea137c8e73de3c8032 Author: Darrick J. Wong Date: Tue May 2 09:15:01 2023 +1000 xfs: fix negative array access in xfs_getbmap In commit 8ee81ed581ff, Ye Bin complained about an ASSERT in the bmapx code that trips if we encounter a delalloc extent after flushing the pagecache to disk. The ioctl code does not hold MMAPLOCK so it's entirely possible that a racing write page fault can create a delalloc extent after the file has been flushed. The proposed solution was to replace the assertion with an early return that avoids filling out the bmap recordset with a delalloc entry if the caller didn't ask for it. At the time, I recall thinking that the forward logic sounded ok, but felt hesitant because I suspected that changing this code would cause something /else/ to burst loose due to some other subtlety. syzbot of course found that subtlety. If all the extent mappings found after the flush are delalloc mappings, we'll reach the end of the data fork without ever incrementing bmv->bmv_entries. This is new, since before we'd have emitted the delalloc mappings even though the caller didn't ask for them. Once we reach the end, we'll try to set BMV_OF_LAST on the -1st entry (because bmv_entries is zero) and go corrupt something else in memory. Yay. I really dislike all these stupid patches that fiddle around with debug code and break things that otherwise worked well enough. Nobody was complaining that calling XFS_IOC_BMAPX without BMV_IF_DELALLOC would return BMV_OF_DELALLOC records, and now we've gone from "weird behavior that nobody cared about" to "bad behavior that must be addressed immediately". Maybe I'll just ignore anything from Huawei from now on for my own sake. Reported-by: syzbot+c103d3808a0de5faaf80@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-xfs/20230412024907.GP360889@frogsfrogsfrogs/ Fixes: 8ee81ed581ff ("xfs: fix BUG_ON in xfs_getbmap()") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 1f1397b7218d7f8e53e33c6b58cbf9601cd2d8e6 Author: Darrick J. Wong Date: Tue May 2 09:14:51 2023 +1000 xfs: don't allocate into the data fork for an unshare request For an unshare request, we only have to take action if the data fork has a shared mapping. We don't care if someone else set up a cow operation. If we find nothing in the data fork, return a hole to avoid allocating space. Note that fallocate will replace the delalloc reservation with an unwritten extent anyway, so this has no user-visible effects outside of avoiding unnecessary updates. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 397b2d7e0f3e28bbeaa05cf8e10d0fd601f446f4 Author: Darrick J. Wong Date: Tue May 2 09:14:43 2023 +1000 xfs: flush dirty data and drain directios before scrubbing cow fork When we're scrubbing the COW fork, we need to take MMAPLOCK_EXCL to prevent page_mkwrite from modifying any inode state. The ILOCK should suffice to avoid confusing online fsck, but let's take the same locks that we do everywhere else. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 8e698ee72c4ecbbf18264568eb310875839fd601 Author: Darrick J. Wong Date: Tue May 2 09:14:36 2023 +1000 xfs: set bnobt/cntbt numrecs correctly when formatting new AGs Through generic/300, I discovered that mkfs.xfs creates corrupt filesystems when given these parameters: # mkfs.xfs -d size=512M /dev/sda -f -d su=128k,sw=4 --unsupported Filesystems formatted with --unsupported are not supported!! meta-data=/dev/sda isize=512 agcount=8, agsize=16352 blks = sectsz=512 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=1 = reflink=1 bigtime=1 inobtcount=1 nrext64=1 data = bsize=4096 blocks=130816, imaxpct=25 = sunit=32 swidth=128 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1 log =internal log bsize=4096 blocks=8192, version=2 = sectsz=512 sunit=32 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 = rgcount=0 rgsize=0 blks Discarding blocks...Done. # xfs_repair -n /dev/sda Phase 1 - find and verify superblock... - reporting progress in intervals of 15 minutes Phase 2 - using internal log - zero log... - 16:30:50: zeroing log - 16320 of 16320 blocks done - scan filesystem freespace and inode maps... agf_freeblks 25, counted 0 in ag 4 sb_fdblocks 8823, counted 8798 The root cause of this problem is the numrecs handling in xfs_freesp_init_recs, which is used to initialize a new AG. Prior to calling the function, we set up the new bnobt block with numrecs == 1 and rely on _freesp_init_recs to format that new record. If the last record created has a blockcount of zero, then it sets numrecs = 0. That last bit isn't correct if the AG contains the log, the start of the log is not immediately after the initial blocks due to stripe alignment, and the end of the log is perfectly aligned with the end of the AG. For this case, we actually formatted a single bnobt record to handle the free space before the start of the (stripe aligned) log, and incremented arec to try to format a second record. That second record turned out to be unnecessary, so what we really want is to leave numrecs at 1. The numrecs handling itself is overly complicated because a different function sets numrecs == 1. Change the bnobt creation code to start with numrecs set to zero and only increment it after successfully formatting a free space extent into the btree block. Fixes: f327a00745ff ("xfs: account for log space when formatting new AGs") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit b82a5c42a5fa7e79426ed047ced3f8482bb66fbc Author: Darrick J. Wong Date: Tue May 2 09:14:27 2023 +1000 xfs: don't unconditionally null args->pag in xfs_bmap_btalloc_at_eof xfs/170 on a filesystem with su=128k,sw=4 produces this splat: BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP CPU: 1 PID: 4022907 Comm: dd Tainted: G W 6.3.0-xfsx #2 6ebeeffbe9577d32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20171121_152543-x86-ol7-bu RIP: 0010:xfs_perag_rele+0x10/0x70 [xfs] RSP: 0018:ffffc90001e43858 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000100 RDX: ffffffffa054e717 RSI: 0000000000000005 RDI: 0000000000000000 RBP: ffff888194eea000 R08: 0000000000000000 R09: 0000000000000037 R10: ffff888100ac1cb0 R11: 0000000000000018 R12: 0000000000000000 R13: ffffc90001e43a38 R14: ffff888194eea000 R15: ffff888194eea000 FS: 00007f93d1a0e740(0000) GS:ffff88843fc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000018a34f000 CR4: 00000000003506e0 Call Trace: xfs_bmap_btalloc+0x1a7/0x5d0 [xfs f85291d6841cbb3dc740083f1f331c0327394518] xfs_bmapi_allocate+0xee/0x470 [xfs f85291d6841cbb3dc740083f1f331c0327394518] xfs_bmapi_write+0x539/0x9e0 [xfs f85291d6841cbb3dc740083f1f331c0327394518] xfs_iomap_write_direct+0x1bb/0x2b0 [xfs f85291d6841cbb3dc740083f1f331c0327394518] xfs_direct_write_iomap_begin+0x51c/0x710 [xfs f85291d6841cbb3dc740083f1f331c0327394518] iomap_iter+0x132/0x2f0 __iomap_dio_rw+0x2f8/0x840 iomap_dio_rw+0xe/0x30 xfs_file_dio_write_aligned+0xad/0x180 [xfs f85291d6841cbb3dc740083f1f331c0327394518] xfs_file_write_iter+0xfb/0x190 [xfs f85291d6841cbb3dc740083f1f331c0327394518] vfs_write+0x2eb/0x410 ksys_write+0x65/0xe0 do_syscall_64+0x2b/0x80 This crash occurs under the "out_low_space" label. We grabbed a perag reference, passed it via args->pag into xfs_bmap_btalloc_at_eof, and afterwards args->pag is NULL. Fix the second function not to clobber args->pag if the caller had passed one in. Fixes: 85843327094f ("xfs: factor xfs_bmap_btalloc()") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit f9c4bbddece7eff1155c70d48e3c9c2a01b9d778 Author: Guo Ren Date: Mon May 1 15:33:54 2023 -0700 riscv: compat_syscall_table: Fixup compile warning ../arch/riscv/kernel/compat_syscall_table.c:12:41: warning: initialized field overwritten [-Woverride-init] 12 | #define __SYSCALL(nr, call) [nr] = (call), | ^ ../include/uapi/asm-generic/unistd.h:567:1: note: in expansion of macro '__SYSCALL' 567 | __SYSCALL(__NR_semget, sys_semget) Fixes: 59c10c52f573 ("riscv: compat: syscall: Add compat_sys_call_table implementation") Reviewed-by: Conor Dooley Reported-by: kernel test robot Tested-by: Jisheng Zhang Signed-off-by: Guo Ren Signed-off-by: Guo Ren Signed-off-by: Drew Fustini Link: https://lore.kernel.org/r/20230501223353.2833899-1-dfustini@baylibre.com Signed-off-by: Palmer Dabbelt commit 9a87ffc99ec8eb8d35eed7c4f816d75f5cc9662e Merge: 5dc63e56a9cf8 53bea86b5712c Author: Dmitry Torokhov Date: Mon May 1 15:20:08 2023 -0700 Merge branch 'next' into for-linus Prepare input updates for 6.4 merge window. commit 53bea86b5712c7491bb3dae12e271666df0a308c Author: Dmitry Torokhov Date: Mon May 1 15:11:55 2023 -0700 Revert "Input: xpad - fix support for some third-party controllers" This reverts commit db7220c48d8d71476f881a7ae1285e1df4105409 because it causes crashes when trying to dereference xpad->dev->dev in xpad_probe() which has not been set up yet. Reported-by: syzbot+a3f758b8d8cb7e49afec@syzkaller.appspotmail.com Reported-by: Dongliang Mu Link: https://groups.google.com/g/syzkaller-bugs/c/iMhTgpGuIbM Signed-off-by: Dmitry Torokhov commit c8c655c34e33544aec9d64b660872ab33c29b5f1 Merge: d75439d64a1e2 b3c98052d4694 Author: Linus Torvalds Date: Mon May 1 12:06:20 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "s390: - More phys_to_virt conversions - Improvement of AP management for VSIE (nested virtualization) ARM64: - Numerous fixes for the pathological lock inversion issue that plagued KVM/arm64 since... forever. - New framework allowing SMCCC-compliant hypercalls to be forwarded to userspace, hopefully paving the way for some more features being moved to VMMs rather than be implemented in the kernel. - Large rework of the timer code to allow a VM-wide offset to be applied to both virtual and physical counters as well as a per-timer, per-vcpu offset that complements the global one. This last part allows the NV timer code to be implemented on top. - A small set of fixes to make sure that we don't change anything affecting the EL1&0 translation regime just after having having taken an exception to EL2 until we have executed a DSB. This ensures that speculative walks started in EL1&0 have completed. - The usual selftest fixes and improvements. x86: - Optimize CR0.WP toggling by avoiding an MMU reload when TDP is enabled, and by giving the guest control of CR0.WP when EPT is enabled on VMX (VMX-only because SVM doesn't support per-bit controls) - Add CR0/CR4 helpers to query single bits, and clean up related code where KVM was interpreting kvm_read_cr4_bits()'s "unsigned long" return as a bool - Move AMD_PSFD to cpufeatures.h and purge KVM's definition - Avoid unnecessary writes+flushes when the guest is only adding new PTEs - Overhaul .sync_page() and .invlpg() to utilize .sync_page()'s optimizations when emulating invalidations - Clean up the range-based flushing APIs - Revamp the TDP MMU's reaping of Accessed/Dirty bits to clear a single A/D bit using a LOCK AND instead of XCHG, and skip all of the "handle changed SPTE" overhead associated with writing the entire entry - Track the number of "tail" entries in a pte_list_desc to avoid having to walk (potentially) all descriptors during insertion and deletion, which gets quite expensive if the guest is spamming fork() - Disallow virtualizing legacy LBRs if architectural LBRs are available, the two are mutually exclusive in hardware - Disallow writes to immutable feature MSRs (notably PERF_CAPABILITIES) after KVM_RUN, similar to CPUID features - Overhaul the vmx_pmu_caps selftest to better validate PERF_CAPABILITIES - Apply PMU filters to emulated events and add test coverage to the pmu_event_filter selftest - AMD SVM: - Add support for virtual NMIs - Fixes for edge cases related to virtual interrupts - Intel AMX: - Don't advertise XTILE_CFG in KVM_GET_SUPPORTED_CPUID if XTILE_DATA is not being reported due to userspace not opting in via prctl() - Fix a bug in emulation of ENCLS in compatibility mode - Allow emulation of NOP and PAUSE for L2 - AMX selftests improvements - Misc cleanups MIPS: - Constify MIPS's internal callbacks (a leftover from the hardware enabling rework that landed in 6.3) Generic: - Drop unnecessary casts from "void *" throughout kvm_main.c - Tweak the layout of "struct kvm_mmu_memory_cache" to shrink the struct size by 8 bytes on 64-bit kernels by utilizing a padding hole Documentation: - Fix goof introduced by the conversion to rST" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (211 commits) KVM: s390: pci: fix virtual-physical confusion on module unload/load KVM: s390: vsie: clarifications on setting the APCB KVM: s390: interrupt: fix virtual-physical confusion for next alert GISA KVM: arm64: Have kvm_psci_vcpu_on() use WRITE_ONCE() to update mp_state KVM: arm64: Acquire mp_state_lock in kvm_arch_vcpu_ioctl_vcpu_init() KVM: selftests: Test the PMU event "Instructions retired" KVM: selftests: Copy full counter values from guest in PMU event filter test KVM: selftests: Use error codes to signal errors in PMU event filter test KVM: selftests: Print detailed info in PMU event filter asserts KVM: selftests: Add helpers for PMC asserts in PMU event filter test KVM: selftests: Add a common helper for the PMU event filter guest code KVM: selftests: Fix spelling mistake "perrmited" -> "permitted" KVM: arm64: vhe: Drop extra isb() on guest exit KVM: arm64: vhe: Synchronise with page table walker on MMU update KVM: arm64: pkvm: Document the side effects of kvm_flush_dcache_to_poc() KVM: arm64: nvhe: Synchronise with page table walker on TLBI KVM: arm64: Handle 32bit CNTPCTSS traps KVM: arm64: nvhe: Synchronise with page table walker on vcpu run KVM: arm64: vgic: Don't acquire its_lock before config_lock KVM: selftests: Add test to verify KVM's supported XCR0 ... commit d75439d64a1e2b35e0f08906205b00279753cbed Merge: 3f2a1903af066 c91b4a07655d5 Author: Linus Torvalds Date: Mon May 1 11:52:32 2023 -0700 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC updates from Stafford Horne: "Two things for OpenRISC this cycle: - Small cleanup for device tree cpu iteration from Rob Herring - Add support for storing, restoring and accessing user space FPU state, to allow for libc to support the FPU on OpenRISC" * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: Add floating point regset openrisc: Support floating point user api openrisc: Support storing and restoring fpu state openrisc: Properly store r31 to pt_regs on unhandled exceptions openrisc: Use common of_get_cpu_node() instead of open-coding commit 3f2a1903af06672f416efd506f029066b9243cbd Merge: e0906f1feb7ca e99ab4abebf82 Author: Linus Torvalds Date: Mon May 1 11:14:12 2023 -0700 Merge tag 'rtc-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Not much this cycle, there is the conversion to remove_new and many small fixes in drivers: Subsystem: - Convert to platform remove callback returning void Drivers: - meson-vrtc: fix a firmware display issue" * tag 'rtc-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (53 commits) rtc: armada38x: use devm_platform_ioremap_resource_byname() rtc: sunplus: use devm_platform_ioremap_resource_byname() rtc: jz4740: Make sure clock provider gets removed rtc: k3: handle errors while enabling wake irq rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time dt-bindings: rtc: Drop unneeded quotes rtc: pcf8523: remove unnecessary OR operation rtc: pcf8523: fix coding-style issues rtc: ds1390: mark OF related data as maybe unused rtc: omap: include header for omap_rtc_power_off_program prototype rtc: sun6i: Use of_property_present() for testing DT property presence rtc: mpfs: convert SOC_MICROCHIP_POLARFIRE to ARCH_MICROCHIP_POLARFIRE rtc: zynqmp: Convert to platform remove callback returning void rtc: xgene: Convert to platform remove callback returning void rtc: wm8350: Convert to platform remove callback returning void rtc: vt8500: Convert to platform remove callback returning void rtc: twl: Convert to platform remove callback returning void rtc: tps6586x: Convert to platform remove callback returning void rtc: tegra: Convert to platform remove callback returning void rtc: sunplus: Convert to platform remove callback returning void ... commit e0906f1feb7caf5098e7f831f4889feecfb0c68b Merge: 06936aaf490ff 6b496a94c5905 Author: Linus Torvalds Date: Mon May 1 11:08:01 2023 -0700 Merge tag 'i3c/for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "Subsystem: - OF alias bus numbering - convert to platform remove callback returning void New driver: - AST2600 controller, based on Synopsys DesignWare IP Driver update: - dw: add infrastructure to support different platform integrations" * tag 'i3c/for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: ast2600: set variable ast2600_i3c_ops storage-class-specifier to static i3c: ast2600: fix register setting for 545 ohm pullups i3c: ast2600: enable IBI support i3c: dw: Add a platform facility for IBI PEC workarounds i3c: dw: Add support for in-band interrupts i3c: dw: Turn DAT array entry into a struct i3c: dw: Create a generic fifo read function i3c: Allow OF-alias-based persistent bus numbering i3c: ast2600: Add AST2600 platform-specific driver dt-bindings: i3c: Add AST2600 i3c controller i3c: dw: Add infrastructure for platform-specific implementations i3c: dw: use bus mode rather than device reg for conditional tCAS setting i3c: dw: Return the length from a read priv_xfer i3c: svc: Convert to platform remove callback returning void i3c: mipi-i3c-hci: Convert to platform remove callback returning void i3c: cdns: Convert to platform remove callback returning void i3c: dw: Convert to platform remove callback returning void i3c: Make i3c_master_unregister() return void i3c: dw: drop of_match_ptr for ID table i3c: Correct reference to the I²C device data type commit 06936aaf490ff55dd5787375a83d6e486bccc397 Merge: 26c009dffca89 d4fab7b28e2f5 Author: Linus Torvalds Date: Mon May 1 11:00:04 2023 -0700 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Some ext4 regression and bug fixes" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: clean up error handling in __ext4_fill_super() ext4: reflect error codes from ext4_multi_mount_protect() to its callers ext4: fix lost error code reporting in __ext4_fill_super() ext4: fix unused iterator variable warnings ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline ext4: fix i_disksize exceeding i_size problem in paritally written case commit 26c009dffca89b0f8fe7facc41d1ccf88a66825a Merge: ed9a65e575cc3 9be11a69315e2 Author: Linus Torvalds Date: Mon May 1 10:43:44 2023 -0700 Merge tag '6.4-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: - deferred close fix for an important case when cached file should be closed immediately - two fixes for missing locks - eight minor cleanup * tag '6.4-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module version number for cifs.ko smb3: move some common open context structs to smbfs_common smb3: make query_on_disk_id open context consistent and move to common code SMB3.1.1: add new tree connect ShareFlags cifs: missing lock when updating session status SMB3: Close deferred file handles in case of handle lease break SMB3: Add missing locks to protect deferred close file list cifs: Avoid a cast in add_lease_context() cifs: Simplify SMB2_open_init() cifs: Simplify SMB2_open_init() cifs: Simplify SMB2_open_init() commit ed9a65e575cc3c52a7f130d824671fe48a72da0c Merge: 58390c8ce1bdd 0c8862de05c1a Author: Linus Torvalds Date: Mon May 1 10:37:37 2023 -0700 Merge tag 'tpmdd-v6.4-rc1-fix-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fix from Jarkko Sakkinen: "This fixes a critical bug in my first pull request. I fixed the cherry pick issue and tested with real hardare and libvirt/qemu plus swtpm" * tag 'tpmdd-v6.4-rc1-fix-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Re-enable TPM chip boostrapping non-tpm_tis TPM drivers commit 2fa5ebe3bc4e31e07a99196455498472417842f2 Author: Huacai Chen Date: Mon May 1 17:19:59 2023 +0800 tools/perf: Add basic support for LoongArch Add basic support for LoongArch, which is very similar to the MIPS version. Signed-off-by: Ming Wang Signed-off-by: Huacai Chen commit 22f367a689ceceb08d9ce6a65c43c9640f5cb935 Author: Youling Tang Date: Mon May 1 17:19:53 2023 +0800 LoongArch: ftrace: Add direct call trampoline samples support The ftrace samples need per-architecture trampoline implementations to save and restore argument registers around the calls to my_direct_func* and to restore polluted registers (e.g: ra). Signed-off-by: Qing Zhang Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 9cdc3b6a299c6314485bcfb695546c11d35dac4c Author: Youling Tang Date: Mon May 1 17:19:53 2023 +0800 LoongArch: ftrace: Add direct call support Select the HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS to provide the register_ftrace_direct[_multi] interfaces allowing users to register the customed trampoline (direct_caller) as the mcount for one or more target functions. And modify_ftrace_direct[_multi] are also provided for modifying direct_caller. There are a few cases to distinguish: - If a direct call ops is the only one tracing a function AND the direct called trampoline is within the reach of a 'bl' instruction -> the ftrace patchsite jumps to the trampoline - Else -> the ftrace patchsite jumps to the ftrace_regs_caller trampoline points to ftrace_list_ops so it iterates over all registered ftrace ops, including the direct call ops and calls its call_direct_funcs handler which stores the direct called trampoline's address in the ftrace_regs and the ftrace_regs_caller trampoline will return to that address instead of returning to the traced function Signed-off-by: Qing Zhang Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 24d4f52791dae16e478741cc397ba660a95b9d02 Author: Youling Tang Date: Mon May 1 17:19:53 2023 +0800 LoongArch: ftrace: Implement ftrace_find_callable_addr() to simplify code In the module processing functions, the same logic can be reused by implementing ftrace_find_callable_addr(). Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 819cf65575230bca02ad669daadba2ac04187ae1 Author: Youling Tang Date: Mon May 1 17:19:52 2023 +0800 LoongArch: ftrace: Fix build error if DYNAMIC_FTRACE_WITH_REGS is not set We can see the following build error if CONFIG_DYNAMIC_FTRACE_WITH_REGS is not set on LoongArch: arch/loongarch/kernel/ftrace_dyn.c: In function ‘ftrace_make_call’: arch/loongarch/kernel/ftrace_dyn.c:167:23: error: implicit declaration of function ‘__get_mod’ 167 | ret = __get_mod(&mod, pc); | ^~~~~~~~~ arch/loongarch/kernel/ftrace_dyn.c:171:24: error: implicit declaration of function ‘get_plt_addr’ 171 | addr = get_plt_addr(mod, addr); | ^~~~~~~~~~~~ The reason is that the __get_mod() and get_plt_addr() may be called in ftrace_make_{call,nop}. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 6fbff14a638293dcd0550cac2921f308ef6abe0e Author: Qing Zhang Date: Mon May 1 17:19:52 2023 +0800 LoongArch: ftrace: Abstract DYNAMIC_FTRACE_WITH_ARGS accesses Add new ftrace_regs_{get,set}_*() helpers which can be used to manipulate ftrace_regs. When CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y, these can always be used on any ftrace_regs, and when CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS =n these can be used when regs are available. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 8b5ee2c66d5c4c1312fd193d4138e6963160ba43 Author: Tiezhu Yang Date: Mon May 1 17:19:52 2023 +0800 LoongArch: Add support for function error injection Inspired by the commit 42d038c4fb00f ("arm64: Add support for function error injection") and the commit ee55ff803b383 ("riscv: Add support for function error injection"), this patch supports function error injection for LoongArch. Mainly implement two functions: (1) regs_set_return_value() which is used to overwrite the return value, (2) override_function_with_return() which is used to override the probed function returning and jump to its caller. Here is a simple test under CONFIG_FUNCTION_ERROR_INJECTION and CONFIG_FAIL_FUNCTION: # echo sys_clone > /sys/kernel/debug/fail_function/inject # echo 100 > /sys/kernel/debug/fail_function/probability # dmesg bash: fork: Invalid argument # dmesg ... FAULT_INJECTION: forcing a failure. name fail_function, interval 1, probability 100, space 0, times 1 ... Call Trace: [<90000000002238f4>] show_stack+0x5c/0x180 [<90000000012e384c>] dump_stack_lvl+0x60/0x88 [<9000000000b1879c>] should_fail_ex+0x1b0/0x1f4 [<900000000032ead4>] fei_kprobe_handler+0x28/0x6c [<9000000000230970>] kprobe_breakpoint_handler+0xf0/0x118 [<90000000012e3e60>] do_bp+0x2c4/0x358 [<9000000002241924>] exception_handlers+0x1924/0x10000 [<900000000023b7d0>] sys_clone+0x0/0x4 [<90000000012e4744>] do_syscall+0x7c/0x94 [<9000000000221e44>] handle_syscall+0xc4/0x160 Tested-by: Hengqi Chen Acked-by: Masami Hiramatsu (Google) Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit d4c937c2a57bbba24790be6fe7a791456f5fbb60 Author: Qing Zhang Date: Mon May 1 17:19:52 2023 +0800 LoongArch: Add ARCH_HAS_FORTIFY_SOURCE selection FORTIFY_SOURCE could detect various overflows at compile and run time. ARCH_HAS_FORTIFY_SOURCE means that the architecture can be built and run with CONFIG_FORTIFY_SOURCE. So select it in LoongArch. See more about this feature from commit 6974f0c4555e285 ("include/linux/ string.h: add the option of fortified string.h functions"). Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 2f1648220214d18168e55920c21014e71c2d5bbc Author: Min Zhou Date: Mon May 1 17:19:43 2023 +0800 LoongArch: crypto: Add crc32 and crc32c hw acceleration With a blatant copy of some MIPS bits we introduce the crc32 and crc32c hw accelerated module to LoongArch. LoongArch has provided these instructions to calculate crc32 and crc32c: * crc.w.b.w crcc.w.b.w * crc.w.h.w crcc.w.h.w * crc.w.w.w crcc.w.w.w * crc.w.d.w crcc.w.d.w So we can make use of these instructions to improve the performance of calculation for crc32(c) checksums. As can be seen from the following test results, crc32(c) instructions can improve the performance by 58%. Software implemention Hardware acceleration Buffer size time cost (seconds) time cost (seconds) Accel. 100 KB 0.000845 0.000534 59.1% 1 MB 0.007758 0.004836 59.4% 10 MB 0.076593 0.047682 59.4% 100 MB 0.756734 0.479126 58.5% 1000 MB 7.563841 4.778266 58.5% Signed-off-by: Min Zhou Signed-off-by: Huacai Chen commit 69e3a6aa6be21de6aaf38130fad97ecde34a193c Author: Bibo Mao Date: Mon May 1 17:19:43 2023 +0800 LoongArch: Add checksum optimization for 64-bit system LoongArch platform is 64-bit system, which supports 8-bytes memory accessing, but generic checksum functions use 4-byte memory access. So add 8-bytes memory access optimization for checksum functions on LoongArch. And the code comes from arm64 system. When network hw checksum is disabled, iperf performance improves about 10% with this patch. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 8941e93ca5906fcca87dc74255b58054ec4d7868 Author: WANG Rui Date: Mon May 1 17:19:43 2023 +0800 LoongArch: Optimize memory ops (memset/memcpy/memmove) To optimize memset()/memcpy()/memmove() and so on, we use a jump table to dispatch cases for short data lengths; and for long data lengths, we split the destination into head part (first 8 bytes), tail part (last 8 bytes) and middle part. The head part and tail part may be at unaligned addresses, while the middle part is always aligned (the middle part is allowed to overlap the head/tail part). In this way, the first and last 8 bytes may be unaligned accesses, but we can make sure the data in the middle is processed at an aligned destination address. We have tested micro-bench[1] on a Loongson-3C5000 16-core machine (2.2GHz): 1. memset | length | src offset | dst offset | speed before | speed after | % | |--------|------------|------------|--------------|-------------|---------| | 8 | 0 | 0 | 696.191 | 1518.785 | 118.16% | | 8 | 0 | 1 | 696.325 | 1518.937 | 118.14% | | 50 | 0 | 0 | 969.976 | 8053.902 | 730.32% | | 50 | 0 | 1 | 970.034 | 8058.475 | 730.74% | | 300 | 0 | 0 | 5876.612 | 16544.703 | 181.53% | | 300 | 0 | 1 | 5030.849 | 16549.011 | 228.95% | | 1200 | 0 | 0 | 11797.077 | 16752.137 | 42.00% | | 1200 | 0 | 1 | 5687.141 | 16645.233 | 192.68% | | 4000 | 0 | 0 | 15723.27 | 16761.557 | 6.60% | | 4000 | 0 | 1 | 5906.114 | 16732.316 | 183.30% | | 8000 | 0 | 0 | 16751.403 | 16770.002 | 0.11% | | 8000 | 0 | 1 | 5995.449 | 16754.07 | 179.45% | 2. memcpy | length | src offset | dst offset | speed before | speed after | % | |--------|------------|------------|--------------|-------------|---------| | 8 | 0 | 0 | 696.2 | 1670.605 | 139.96% | | 8 | 0 | 1 | 696.325 | 1671.138 | 139.99% | | 50 | 0 | 0 | 969.974 | 8724.999 | 799.51% | | 50 | 0 | 1 | 970.032 | 8730.138 | 799.98% | | 300 | 0 | 0 | 5564.662 | 16272.652 | 192.43% | | 300 | 0 | 1 | 4670.436 | 14972.842 | 220.59% | | 1200 | 0 | 0 | 10740.23 | 16751.728 | 55.97% | | 1200 | 0 | 1 | 5027.741 | 14874.564 | 195.85% | | 4000 | 0 | 0 | 15122.367 | 16737.642 | 10.68% | | 4000 | 0 | 1 | 5536.918 | 14890.397 | 168.93% | | 8000 | 0 | 0 | 16505.453 | 16553.543 | 0.29% | | 8000 | 0 | 1 | 5821.619 | 14841.804 | 154.94% | 3. memmove | length | src offset | dst offset | speed before | speed after | % | |--------|------------|------------|--------------|-------------|---------| | 8 | 0 | 0 | 982.693 | 1670.568 | 70.00% | | 8 | 0 | 1 | 983.023 | 1671.174 | 70.00% | | 50 | 0 | 0 | 1230.87 | 8727.625 | 609.06% | | 50 | 0 | 1 | 1232.515 | 8730.138 | 608.32% | | 300 | 0 | 0 | 6490.375 | 16296.993 | 151.09% | | 300 | 0 | 1 | 4282.687 | 14972.842 | 249.61% | | 1200 | 0 | 0 | 11742.755 | 16752.546 | 42.66% | | 1200 | 0 | 1 | 5039.338 | 14872.951 | 195.14% | | 4000 | 0 | 0 | 15467.786 | 16737.09 | 8.21% | | 4000 | 0 | 1 | 5009.905 | 14890.542 | 197.22% | | 8000 | 0 | 0 | 16489.664 | 16553.273 | 0.39% | | 8000 | 0 | 1 | 5823.786 | 14858.646 | 155.14% | * speed: MB/s * length: byte [1] https://github.com/heiher/mem-bench Signed-off-by: WANG Rui Signed-off-by: Huacai Chen commit 2b3bd32ea3a22ea2d5e591da4ac2c2b1fb17c0e0 Author: Huacai Chen Date: Mon May 1 17:19:27 2023 +0800 LoongArch: Provide kernel fpu functions Provide kernel_fpu_begin()/kernel_fpu_end() to allow the kernel itself to use fpu. They can be used by some other kernel components, e.g., the AMDGPU graphic driver for DCN. Reported-by: WANG Xuerui Tested-by: WANG Xuerui Signed-off-by: Huacai Chen commit c23e7f01cf621290770069d968ca4c8356a50d00 Author: WANG Xuerui Date: Mon May 1 17:19:27 2023 +0800 LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR SEGV_BNDERR was introduced initially for supporting the Intel MPX, but fell into disuse after the MPX support was removed. The LoongArch bounds-checking instructions behave very differently than MPX, but overall the interface is still kind of suitable for conveying the information to userland when bounds-checking assertions trigger, so we wouldn't have to invent more UAPI. Specifically, when the BCE triggers, a SEGV_BNDERR is sent to userland, with si_addr set to the out-of-bounds address or value (in asrt{gt,le}'s case), and one of si_lower or si_upper set to the configured bound depending on the faulting instruction. The other bound is set to either 0 or ULONG_MAX to resemble a range with both lower and upper bounds. Note that it is possible to have si_addr == si_lower in case of a failing asrtgt or {ld,st}gt, because those instructions test for strict greater-than relationship. This should not pose a problem for userland, though, because the faulting PC is available for the application to associate back to the exact instruction for figuring out the expectation. Example exception context generated by a faulting `asrtgt.d t0, t1` (assert t0 > t1 or BCE) with t0=100 and t1=200: > pc 00005555558206a4 ra 00007ffff2d854fc tp 00007ffff2f2f180 sp 00007ffffbf9fb80 > a0 0000000000000002 a1 00007ffffbf9fce8 a2 00007ffffbf9fd00 a3 00007ffff2ed4558 > a4 0000000000000000 a5 00007ffff2f044c8 a6 00007ffffbf9fce0 a7 fffffffffffff000 > t0 0000000000000064 t1 00000000000000c8 t2 00007ffffbfa2d5e t3 00007ffff2f12aa0 > t4 00007ffff2ed6158 t5 00007ffff2ed6158 t6 000000000000002e t7 0000000003d8f538 > t8 0000000000000005 u0 0000000000000000 s9 0000000000000000 s0 00007ffffbf9fce8 > s1 0000000000000002 s2 0000000000000000 s3 00007ffff2f2c038 s4 0000555555820610 > s5 00007ffff2ed5000 s6 0000555555827e38 s7 00007ffffbf9fd00 s8 0000555555827e38 > ra: 00007ffff2d854fc > ERA: 00005555558206a4 > CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) > PRMD: 00000007 (PPLV3 +PIE -PWE) > EUEN: 00000000 (-FPE -SXE -ASXE -BTE) > ECFG: 0007181c (LIE=2-4,11-12 VS=7) > ESTAT: 000a0000 [BCE] (IS= ECode=10 EsubCode=0) > PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 325a38b511caff53c10393bab1e59cbd37f15ec2 Author: WANG Xuerui Date: Mon May 1 17:19:27 2023 +0800 LoongArch: Tweak the BADV and CPUCFG.PRID lines in show_regs() Use ISA manual names for BADV and CPUCFG.PRID lines in show_regs(), for stylistic consistency with the other lines already touched. While at it, also include current CPU's full name in show_regs() output. It may be more helpful for developers looking at the resulting dumps, because multiple distinct CPU models may share the same PRID. Not having this info available may hide problems only found on some but not all of the models sharing one specific PRID. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 98b90ede59472de5931b7e4d72c3ff948eaa19a4 Author: WANG Xuerui Date: Mon May 1 17:19:27 2023 +0800 LoongArch: Humanize the ESTAT line when showing registers Example output looks like: [ xx.xxxxxx] ESTAT: 00001000 [INT] (IS=12 ECode=0 EsubCode=0) Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 5e3e784d35c41ca21251f92c243780c791100b02 Author: WANG Xuerui Date: Mon May 1 17:19:27 2023 +0800 LoongArch: Humanize the ECFG line when showing registers Example output looks like: [ xx.xxxxxx] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 9718d96c035c594390600168cbca0ae4e0d867f5 Author: WANG Xuerui Date: Mon May 1 17:19:27 2023 +0800 LoongArch: Humanize the EUEN line when showing registers Example output looks like: [ xx.xxxxxx] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit ce7f0b18b030e17fb3d8327f1b6f1719165ca51d Author: WANG Xuerui Date: Mon May 1 17:19:10 2023 +0800 LoongArch: Humanize the PRMD line when showing registers Example output looks like: [ xx.xxxxxx] PRMD: 00000004 (PPLV0 +PIE -PWE) Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit efada2afacee7b5e59b3182bc36ddfb0fad2b0e2 Author: WANG Xuerui Date: Mon May 1 17:19:10 2023 +0800 LoongArch: Humanize the CRMD line when showing registers Example output looks like: [ xx.xxxxxx] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) Some initial machinery for this pretty-printing format has been included in this patch as well. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 05fa8d4977d727cf41294ea09b4a5085cba4ad54 Author: WANG Xuerui Date: Mon May 1 17:19:10 2023 +0800 LoongArch: Fix format of CSR lines during show_regs() Use uppercase CSR names throughout for consistency with the manual wording, and right-align the keys. The "CSR" part is inferrable from context, hence dropped for more horizontal space. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 863b3795efae6458dbc24f03add50c575cf4fbd2 Author: WANG Xuerui Date: Mon May 1 17:19:10 2023 +0800 LoongArch: Print symbol info for $ra and CSR.ERA only for kernel-mode contexts Otherwise the addresses wouldn't make sense at all. While at it, align the "map keys" to maintain right-alignment with the "estat:" line too; also swap the ERA and ra lines so all CSRs are shown together. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit f6a79b6036ef220028db190c7424ce8099c98090 Author: WANG Xuerui Date: Mon May 1 17:19:10 2023 +0800 LoongArch: Print GPRs with ABI names when showing registers Show PC (CSR.ERA) in place of $zero, and also show the syscall restart flag (conveniently stuffed in regs[0]) if non-zero. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit aa552254cf0039d83908105a07007f9ea616c119 Author: WANG Xuerui Date: Mon May 1 17:19:10 2023 +0800 LoongArch: Define regular names for BCE/WATCH/HVC/GSPR exceptions Define them according to the ISA manual, in order to enable matching the sub-exceptions for humanization purposes later. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 9e36fa42995a7c7fa8d84a429ca647736c4f1c66 Author: WANG Xuerui Date: Mon May 1 17:19:10 2023 +0800 LoongArch: Clean up the architectural interrupt definitions While interrupts are assigned ECodes `64 + interrupt number`, all existing use sites of interrupt numbers want the 64 subtracted. Re-arrange the definitions so that the actual interrupt number is used everywhere, and make EXCCODE_INT_END inclusive as it is more intuitive that way. While at it, according to the asm/loongarch.h definitions, the total number of architectural interrupts should be 14, but various other places indicate otherwise (13 or 15). Those places have been adjusted to 14 as well for consistency. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit fb7cba61919ada54d088870dd173c61b6b372873 Merge: 4f163bf82b024 db099c625b13a Author: David S. Miller Date: Mon May 1 07:43:19 2023 +0100 Merge branch 'rxrpc-timeout-fixes' David Howells says: ==================== rxrpc: Timeout handling fixes Here are three patches to fix timeouts handling in AF_RXRPC: (1) The hard call timeout should be interpreted in seconds, not milliseconds. (2) Allow a waiting call to be aborted (thereby cancelling the call) in the case a signal interrupts sendmsg() and leaves it hanging until it is granted a channel on a connection. (3) Kernel-generated calls get the timer started on them even if they're still waiting to be attached to a connection. If the timer expires before the wait is complete and a conn is attached, an oops will occur. ==================== Signed-off-by: David S. Miller commit db099c625b13a74d462521a46d98a8ce5b53af5d Author: David Howells Date: Fri Apr 28 21:27:56 2023 +0100 rxrpc: Fix timeout of a call that hasn't yet been granted a channel afs_make_call() calls rxrpc_kernel_begin_call() to begin a call (which may get stalled in the background waiting for a connection to become available); it then calls rxrpc_kernel_set_max_life() to set the timeouts - but that starts the call timer so the call timer might then expire before we get a connection assigned - leading to the following oops if the call stalled: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CPU: 1 PID: 5111 Comm: krxrpcio/0 Not tainted 6.3.0-rc7-build3+ #701 RIP: 0010:rxrpc_alloc_txbuf+0xc0/0x157 ... Call Trace: rxrpc_send_ACK+0x50/0x13b rxrpc_input_call_event+0x16a/0x67d rxrpc_io_thread+0x1b6/0x45f ? _raw_spin_unlock_irqrestore+0x1f/0x35 ? rxrpc_input_packet+0x519/0x519 kthread+0xe7/0xef ? kthread_complete_and_exit+0x1b/0x1b ret_from_fork+0x22/0x30 Fix this by noting the timeouts in struct rxrpc_call when the call is created. The timer will be started when the first packet is transmitted. It shouldn't be possible to trigger this directly from userspace through AF_RXRPC as sendmsg() will return EBUSY if the call is in the waiting-for-conn state if it dropped out of the wait due to a signal. Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread") Reported-by: Marc Dionne Signed-off-by: David Howells cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller commit 0eb362d254814ce04848730bf32e75b8ee1a4d6c Author: David Howells Date: Fri Apr 28 21:27:55 2023 +0100 rxrpc: Make it so that a waiting process can be aborted When sendmsg() creates an rxrpc call, it queues it to wait for a connection and channel to be assigned and then waits before it can start shovelling data as the encrypted DATA packet content includes a summary of the connection parameters. However, sendmsg() may get interrupted before a connection gets assigned and further sendmsg() calls will fail with EBUSY until an assignment is made. Fix this so that the call can at least be aborted without failing on EBUSY. We have to be careful here as sendmsg() mustn't be allowed to start the call timer if the call doesn't yet have a connection assigned as an oops may follow shortly thereafter. Fixes: 540b1c48c37a ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg") Reported-by: Marc Dionne Signed-off-by: David Howells cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller commit 0d098d83c5d9e107b2df7f5e11f81492f56d2fe7 Author: David Howells Date: Fri Apr 28 21:27:54 2023 +0100 rxrpc: Fix hard call timeout units The hard call timeout is specified in the RXRPC_SET_CALL_TIMEOUT cmsg in seconds, so fix the point at which sendmsg() applies it to the call to convert to jiffies from seconds, not milliseconds. Fixes: a158bdd3247b ("rxrpc: Fix timeout of a call that hasn't yet been granted a channel") Signed-off-by: David Howells cc: Marc Dionne cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller commit 4f163bf82b0244bf4d1e9a6b0f4cf4e90b42496e Author: Tom Rix Date: Fri Apr 28 17:43:21 2023 -0400 net: atlantic: Define aq_pm_ops conditionally on CONFIG_PM For s390, gcc with W=1 reports drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c:458:32: error: 'aq_pm_ops' defined but not used [-Werror=unused-const-variable=] 458 | static const struct dev_pm_ops aq_pm_ops = { | ^~~~~~~~~ The only use of aq_pm_ops is conditional on CONFIG_PM. The definition of aq_pm_ops and its functions should also be conditional on CONFIG_PM. Signed-off-by: Tom Rix Signed-off-by: David S. Miller commit 281900a923d4c50df109b52a22ae3cdac150159b Author: Andy Moreton Date: Fri Apr 28 12:33:33 2023 +0100 sfc: Fix module EEPROM reporting for QSFP modules The sfc driver does not report QSFP module EEPROM contents correctly as only the first page is fetched from hardware. Commit 0e1a2a3e6e7d ("ethtool: Add SFF-8436 and SFF-8636 max EEPROM length definitions") added ETH_MODULE_SFF_8436_MAX_LEN for the overall size of the EEPROM info, so use that to report the full EEPROM contents. Fixes: 9b17010da57a ("sfc: Add ethtool -m support for QSFP modules") Signed-off-by: Andy Moreton Signed-off-by: David S. Miller commit f858e2fd23ac40286f921cd461e3400e17a7fcf3 Merge: 526f28bd0fbdc cce8334f4aacd Author: David S. Miller Date: Mon May 1 07:32:04 2023 +0100 Merge branch 'r8152-fixes' Hayes Wang says: ==================== r8152: fix 2.5G devices v3: For patch #2, modify the comment. v2: For patch #1, Remove inline for fc_pause_on_auto() and fc_pause_off_auto(), and update the commit message. For patch #2, define the magic value for OCP register 0xa424. v1: These patches are used to fix some issues of RTL8156. ==================== Signed-off-by: David S. Miller commit cce8334f4aacd9936309a002d4a4de92a07cd2c2 Author: Hayes Wang Date: Fri Apr 28 16:53:31 2023 +0800 r8152: move setting r8153b_rx_agg_chg_indicate() Move setting r8153b_rx_agg_chg_indicate() for 2.5G devices. The r8153b_rx_agg_chg_indicate() has to be called after enabling tx/rx. Otherwise, the coalescing settings are useless. Fixes: 195aae321c82 ("r8152: support new chips") Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 61b0ad6f58e2066e054c6d4839d67974d2861a7d Author: Hayes Wang Date: Fri Apr 28 16:53:30 2023 +0800 r8152: fix the poor throughput for 2.5G devices Fix the poor throughput for 2.5G devices, when changing the speed from auto mode to force mode. This patch is used to notify the MAC when the mode is changed. Fixes: 195aae321c82 ("r8152: support new chips") Signed-off-by: Hayes Wang Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 8ceda6d5a1e5402fd852e6cc59a286ce3dc545ee Author: Hayes Wang Date: Fri Apr 28 16:53:29 2023 +0800 r8152: fix flow control issue of RTL8156A The feature of flow control becomes abnormal, if the device sends a pause frame and the tx/rx is disabled before sending a release frame. It causes the lost of packets. Set PLA_RX_FIFO_FULL and PLA_RX_FIFO_EMPTY to zeros before disabling the tx/rx. And, toggle FC_PATCH_TASK before enabling tx/rx to reset the flow control patch and timer. Then, the hardware could clear the state and the flow control becomes normal after enabling tx/rx. Besides, remove inline for fc_pause_on_auto() and fc_pause_off_auto(). Fixes: 195aae321c82 ("r8152: support new chips") Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 526f28bd0fbdc699cda31426928802650c1528e5 Author: Victor Nogueira Date: Wed Apr 26 15:19:40 2023 +0000 net/sched: act_mirred: Add carrier check There are cases where the device is adminstratively UP, but operationally down. For example, we have a physical device (Nvidia ConnectX-6 Dx, 25Gbps) who's cable was pulled out, here is its ip link output: 5: ens2f1: mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000 link/ether b8:ce:f6:4b:68:35 brd ff:ff:ff:ff:ff:ff altname enp179s0f1np1 As you can see, it's administratively UP but operationally down. In this case, sending a packet to this port caused a nasty kernel hang (so nasty that we were unable to capture it). Aborting a transmit based on operational status (in addition to administrative status) fixes the issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira v1->v2: Add fixes tag v2->v3: Remove blank line between tags + add change log, suggested by Leon Signed-off-by: David S. Miller commit 7949aa46bb4b5c5e43ba3ba8298ffcb48bebf0ff Author: Jens Axboe Date: Sun Apr 30 16:15:08 2023 -0600 mailmap: add mailmap entries for Jens Axboe There's an old entry in there already, but update it and add fb/meta and oracle entries as well. Signed-off-by: Jens Axboe commit 6b496a94c5905fca7879bc0dc438a47de40b7d4f Author: Tom Rix Date: Sat Apr 29 09:46:01 2023 -0400 i3c: ast2600: set variable ast2600_i3c_ops storage-class-specifier to static smatch reports drivers/i3c/master/ast2600-i3c-master.c:121:34: warning: symbol 'ast2600_i3c_ops' was not declared. Should it be static? This variable is only used in its defining file, so it should be static. Signed-off-by: Tom Rix Reviewed-by: Jeremy Kerr Link: https://lore.kernel.org/r/20230429134601.2688558-1-trix@redhat.com Signed-off-by: Alexandre Belloni commit 58390c8ce1bddb6c623f62e7ed36383e7fa5c02f Merge: 7acc137211308 e51b4198396cd Author: Linus Torvalds Date: Sun Apr 30 13:00:38 2023 -0700 Merge tag 'iommu-updates-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: - Convert to platform remove callback returning void - Extend changing default domain to normal group - Intel VT-d updates: - Remove VT-d virtual command interface and IOASID - Allow the VT-d driver to support non-PRI IOPF - Remove PASID supervisor request support - Various small and misc cleanups - ARM SMMU updates: - Device-tree binding updates: * Allow Qualcomm GPU SMMUs to accept relevant clock properties * Document Qualcomm 8550 SoC as implementing an MMU-500 * Favour new "qcom,smmu-500" binding for Adreno SMMUs - Fix S2CR quirk detection on non-architectural Qualcomm SMMU implementations - Acknowledge SMMUv3 PRI queue overflow when consuming events - Document (in a comment) why ATS is disabled for bypass streams - AMD IOMMU updates: - 5-level page-table support - NUMA awareness for memory allocations - Unisoc driver: Support for reattaching an existing domain - Rockchip driver: Add missing set_platform_dma_ops callback - Mediatek driver: Adjust the dma-ranges - Various other small fixes and cleanups * tag 'iommu-updates-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (82 commits) iommu: Remove iommu_group_get_by_id() iommu: Make iommu_release_device() static iommu/vt-d: Remove BUG_ON in dmar_insert_dev_scope() iommu/vt-d: Remove a useless BUG_ON(dev->is_virtfn) iommu/vt-d: Remove BUG_ON in map/unmap() iommu/vt-d: Remove BUG_ON when domain->pgd is NULL iommu/vt-d: Remove BUG_ON in handling iotlb cache invalidation iommu/vt-d: Remove BUG_ON on checking valid pfn range iommu/vt-d: Make size of operands same in bitwise operations iommu/vt-d: Remove PASID supervisor request support iommu/vt-d: Use non-privileged mode for all PASIDs iommu/vt-d: Remove extern from function prototypes iommu/vt-d: Do not use GFP_ATOMIC when not needed iommu/vt-d: Remove unnecessary checks in iopf disabling path iommu/vt-d: Move PRI handling to IOPF feature path iommu/vt-d: Move pfsid and ats_qdep calculation to device probe path iommu/vt-d: Move iopf code from SVA to IOPF enabling path iommu/vt-d: Allow SVA with device-specific IOPF dmaengine: idxd: Add enable/disable device IOPF feature arm64: dts: mt8186: Add dma-ranges for the parent "soc" node ... commit 7acc1372113083fa281ba426021801e2402caca1 Merge: 10de638d8ea57 fd35fdcbf75b5 Author: Linus Torvalds Date: Sun Apr 30 11:51:51 2023 -0700 Merge tag 'cxl-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull compute express link updates from Dan Williams: "DOE support is promoted from drivers/cxl/ to drivers/pci/ with Bjorn's blessing, and the CXL core continues to mature its media management capabilities with support for listing and injecting media errors. Some late fixes that missed v6.3-final are also included: - Refactor the DOE infrastructure (Data Object Exchange PCI-config-cycle mailbox) to be a facility of the PCI core rather than the CXL core. This is foundational for upcoming support for PCI device-attestation and PCIe / CXL link encryption. - Add support for retrieving and injecting poison for CXL memory expanders. This enabling uses trace-events to convey CXL media error records to user tooling. It includes translation of device-local addresses (DPA) to system physical addresses (SPA) and their corresponding CXL region. - Fixes for decoder enumeration that missed v6.3-final - Miscellaneous fixups" * tag 'cxl-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (38 commits) cxl/test: Add mock test for set_timestamp cxl/mbox: Update CMD_RC_TABLE tools/testing/cxl: Require CONFIG_DEBUG_FS tools/testing/cxl: Add a sysfs attr to test poison inject limits tools/testing/cxl: Use injected poison for get poison list tools/testing/cxl: Mock the Clear Poison mailbox command tools/testing/cxl: Mock the Inject Poison mailbox command cxl/mem: Add debugfs attributes for poison inject and clear cxl/memdev: Trace inject and clear poison as cxl_poison events cxl/memdev: Warn of poison inject or clear to a mapped region cxl/memdev: Add support for the Clear Poison mailbox command cxl/memdev: Add support for the Inject Poison mailbox command tools/testing/cxl: Mock support for Get Poison List cxl/trace: Add an HPA to cxl_poison trace events cxl/region: Provide region info to the cxl_poison trace event cxl/memdev: Add trigger_poison_list sysfs attribute cxl/trace: Add TRACE support for CXL media-error records cxl/mbox: Add GET_POISON_LIST mailbox command cxl/mbox: Initialize the poison state cxl/mbox: Restrict poison cmds to debugfs cxl_raw_allow_all ... commit 10de638d8ea57ebab4231ea077bed01d9bade775 Merge: d55571c008446 2a405f6bb3a5b Author: Linus Torvalds Date: Sun Apr 30 11:43:31 2023 -0700 Merge tag 's390-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Add support for stackleak feature. Also allow specifying architecture-specific stackleak poison function to enable faster implementation. On s390, the mvc-based implementation helps decrease typical overhead from a factor of 3 to just 25% - Convert all assembler files to use SYM* style macros, deprecating the ENTRY() macro and other annotations. Select ARCH_USE_SYM_ANNOTATIONS - Improve KASLR to also randomize module and special amode31 code base load addresses - Rework decompressor memory tracking to support memory holes and improve error handling - Add support for protected virtualization AP binding - Add support for set_direct_map() calls - Implement set_memory_rox() and noexec module_alloc() - Remove obsolete overriding of mem*() functions for KASAN - Rework kexec/kdump to avoid using nodat_stack to call purgatory - Convert the rest of the s390 code to use flexible-array member instead of a zero-length array - Clean up uaccess inline asm - Enable ARCH_HAS_MEMBARRIER_SYNC_CORE - Convert to using CONFIG_FUNCTION_ALIGNMENT and enable DEBUG_FORCE_FUNCTION_ALIGN_64B - Resolve last_break in userspace fault reports - Simplify one-level sysctl registration - Clean up branch prediction handling - Rework CPU counter facility to retrieve available counter sets just once - Other various small fixes and improvements all over the code * tag 's390-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (118 commits) s390/stackleak: provide fast __stackleak_poison() implementation stackleak: allow to specify arch specific stackleak poison function s390: select ARCH_USE_SYM_ANNOTATIONS s390/mm: use VM_FLUSH_RESET_PERMS in module_alloc() s390: wire up memfd_secret system call s390/mm: enable ARCH_HAS_SET_DIRECT_MAP s390/mm: use BIT macro to generate SET_MEMORY bit masks s390/relocate_kernel: adjust indentation s390/relocate_kernel: use SYM* macros instead of ENTRY(), etc. s390/entry: use SYM* macros instead of ENTRY(), etc. s390/purgatory: use SYM* macros instead of ENTRY(), etc. s390/kprobes: use SYM* macros instead of ENTRY(), etc. s390/reipl: use SYM* macros instead of ENTRY(), etc. s390/head64: use SYM* macros instead of ENTRY(), etc. s390/earlypgm: use SYM* macros instead of ENTRY(), etc. s390/mcount: use SYM* macros instead of ENTRY(), etc. s390/crc32le: use SYM* macros instead of ENTRY(), etc. s390/crc32be: use SYM* macros instead of ENTRY(), etc. s390/crypto,chacha: use SYM* macros instead of ENTRY(), etc. s390/amode31: use SYM* macros instead of ENTRY(), etc. ... commit d55571c0084465f1f7e1e29f22bd910d366a6e1d Merge: 310897659cf05 9892bd72efdc9 Author: Linus Torvalds Date: Sun Apr 30 11:32:53 2023 -0700 Merge tag 'kbuild-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Refactor scripts/kallsyms to make it faster and easier to maintain - Clean up menuconfig - Provide Clang with hard-coded target triple instead of CROSS_COMPILE - Use -z pack-relative-relocs flags instead of --use-android-relr-tags for arm64 CONFIG_RELR - Add srcdeb-pkg target to build only a Debian source package - Add KDEB_SOURCE_COMPRESS option to specify the compression for a Debian source package - Misc cleanups and fixes * tag 'kbuild-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: deb-pkg: specify targets in debian/rules as .PHONY sparc: unify sparc32/sparc64 archhelp kbuild: rpm-pkg: remove kernel-drm PROVIDES kbuild: deb-pkg: add KDEB_SOURCE_COMPRESS to specify source compression kbuild: add srcdeb-pkg target Makefile: use -z pack-relative-relocs kbuild: clang: do not use CROSS_COMPILE for target triple kconfig: menuconfig: reorder functions to remove forward declarations kconfig: menuconfig: remove unused M_EVENT macro kconfig: menuconfig: remove OLD_NCURSES macro kbuild: builddeb: Eliminate debian/arch use scripts/kallsyms: update the usage in the comment block scripts/kallsyms: decrease expand_symbol() / cleanup_symbol_name() calls scripts/kallsyms: change the output order scripts/kallsyms: move compiler-generated symbol patterns to mksysmap scripts/kallsyms: exclude symbols generated by itself dynamically scripts/mksysmap: use sed with in-line comments scripts/mksysmap: remove comments described in nm(1) scripts/kallsyms: remove redundant code for omitting U and N kallsyms: expand symbol name into comment for debugging commit 310897659cf056016e2c772a028f9b8abc934928 Merge: 825a0714d2b38 ea76e08f4d901 Author: Linus Torvalds Date: Sun Apr 30 11:20:22 2023 -0700 Merge tag 'rust-6.4' of https://github.com/Rust-for-Linux/linux Pull rust updates from Miguel Ojeda "More additions to the Rust core. Importantly, this adds the pin-init API, which will be used by other abstractions, such as the synchronization ones added here too: - pin-init API: a solution for the safe pinned initialization problem. This allows to reduce the need for 'unsafe' code in the kernel when dealing with data structures that require a stable address. Commit 90e53c5e70a6 ("rust: add pin-init API core") contains a nice introduction -- here is an example of how it looks like: #[pin_data] struct Example { #[pin] value: Mutex, #[pin] value_changed: CondVar, } impl Example { fn new() -> impl PinInit { pin_init!(Self { value <- new_mutex!(0), value_changed <- new_condvar!(), }) } } // In a `Box`. let b = Box::pin_init(Example::new())?; // In the stack. stack_pin_init!(let s = Example::new()); - 'sync' module: New types 'LockClassKey' ('struct lock_class_key'), 'Lock', 'Guard', 'Mutex' ('struct mutex'), 'SpinLock' ('spinlock_t'), 'LockedBy' and 'CondVar' (uses 'wait_queue_head_t'), plus macros such as 'static_lock_class!' and 'new_spinlock!'. In particular, 'Lock' and 'Guard' are generic implementations that contain code that is common to all locks. Then, different backends (the new 'Backend' trait) are implemented and used to define types like 'Mutex': type Mutex = Lock; In addition, new methods 'assume_init()', 'init_with()' and 'pin_init_with()' for 'UniqueArc>' and 'downcast()' for 'Arc'; as well as 'Debug' and 'Display' implementations for 'Arc' and 'UniqueArc'. Reduced stack usage of 'UniqueArc::try_new_uninit()', too. - 'types' module: New trait 'AlwaysRefCounted' and new type 'ARef' (an owned reference to an always-reference-counted object, meant to be used in wrappers for C types that have their own ref counting functions). Moreover, new associated functions 'raw_get()' and 'ffi_init()' for 'Opaque'. - New 'task' module with a new type 'Task' ('struct task_struct'), and a new macro 'current!' to safely get a reference to the current one. - New 'ioctl' module with new '_IOC*' const functions (equivalent to the C macros). - New 'uapi' crate, intended to be accessible by drivers directly. - 'macros' crate: new 'quote!' macro (similar to the one provided in userspace by the 'quote' crate); and the 'module!' macro now allows specifying multiple module aliases. - 'error' module: New associated functions for the 'Error' type, such as 'from_errno()' and new functions such as 'to_result()'. - 'alloc' crate: More fallible 'Vec' methods: 'try_resize` and 'try_extend_from_slice' and the infrastructure (imported from the Rust standard library) they need" * tag 'rust-6.4' of https://github.com/Rust-for-Linux/linux: (44 commits) rust: ioctl: Add ioctl number manipulation functions rust: uapi: Add UAPI crate rust: sync: introduce `CondVar` rust: lock: add `Guard::do_unlocked` rust: sync: introduce `LockedBy` rust: introduce `current` rust: add basic `Task` rust: introduce `ARef` rust: lock: introduce `SpinLock` rust: lock: introduce `Mutex` rust: sync: introduce `Lock` and `Guard` rust: sync: introduce `LockClassKey` MAINTAINERS: add Benno Lossin as Rust reviewer rust: init: broaden the blanket impl of `Init` rust: sync: add functions for initializing `UniqueArc>` rust: sync: reduce stack usage of `UniqueArc::try_new_uninit` rust: types: add `Opaque::ffi_init` rust: prelude: add `pin-init` API items to prelude rust: init: add `Zeroable` trait and `init::zeroed` function rust: init: add `stack_pin_init!` macro ... commit db2993a423e3fd0e4878f4d3ac66fe717f5f072e Author: Christophe JAILLET Date: Thu Apr 27 20:05:42 2023 +0200 ceph: reorder fields in 'struct ceph_snapid_map' Group some variables based on their sizes to reduce holes. On x86_64, this shrinks the size of 'struct ceph_snapid_map' from 72 to 64 bytes. When such a structure is allocated, because of the way memory allocation works, when 72 bytes were requested, 96 bytes were allocated. So, on x86_64, this change saves 32 bytes per allocation and has the structure fit in a single cacheline. Signed-off-by: Christophe JAILLET Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit a5ffd7b6e91a12975ae30de863437cc04387576a Author: Xiubo Li Date: Wed Apr 26 10:38:57 2023 +0800 ceph: pass ino# instead of old_dentry if it's disconnected When exporting the kceph to NFS it may pass a DCACHE_DISCONNECTED dentry for the link operation. Then it will parse this dentry as a snapdir, and the mds will fail the link request as -EROFS. MDS allow clients to pass a ino# instead of a path. Link: https://tracker.ceph.com/issues/59515 Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit aaf67de78807c59c35bafb5003d4fb457c764800 Author: Xiubo Li Date: Wed Apr 19 10:39:14 2023 +0800 ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash. We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/43272 Signed-off-by: Xiubo Li Reviewed-by: Luís Henriques Signed-off-by: Ilya Dryomov commit 7d41870d65db028234333c68e60a034ac335557a Author: Xiubo Li Date: Wed Mar 8 10:21:44 2023 +0800 ceph: implement writeback livelock avoidance using page tagging While the mapped IOs continue if we try to flush a file's buffer we can see that the fsync() won't complete until the IOs finish. This is analogous to Jan Kara's commit (f446daaea9d4 mm: implement writeback livelock avoidance using page tagging), we will try to avoid livelocks of writeback when some steadily creates dirty pages in a mapping we are writing out. Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 7a6c3a035a2e133b41d01c1a479b50aac4aeecad Author: Xiubo Li Date: Tue Feb 28 20:40:51 2023 +0800 ceph: do not print the whole xattr value if it's too long If the xattr's value size is long enough the kernel will warn and then will fail the xfstests test case. Just print part of the value string if it's too long. At the same time fix the function name issue in the debug logs. Link: https://tracker.ceph.com/issues/58404 Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 9f855779a3874eee70e9f6be57b5f7774f14e510 Author: Akhil R Date: Thu Apr 27 18:09:14 2023 +0530 i2c: tegra: Fix PEC support for SMBUS block read Update the msg->len value correctly for SMBUS block read. The discrepancy went unnoticed as msg->len is used in SMBUS transfers only when a PEC byte is added. Fixes: d7583c8a5748 ("i2c: tegra: Add SMBus block read function") Signed-off-by: Akhil R Acked-by: Thierry Reding Signed-off-by: Wolfram Sang commit 825a0714d2b3883d4f8ff64f6933fb73ee3f1834 Merge: 17d4ded2fc9d4 026b85796ab4d Author: Linus Torvalds Date: Sat Apr 29 17:42:33 2023 -0700 Merge tag 'efi-next-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - relocate the LoongArch kernel if the preferred address is already occupied - implement BTI annotations for arm64 EFI stub and zboot images - clean up arm64 zboot Kbuild rules for injecting the kernel code size * tag 'efi-next-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/zboot: arm64: Grab code size from ELF symbol in payload efi/zboot: arm64: Inject kernel code size symbol into the zboot payload efi/zboot: Set forward edge CFI compat header flag if supported efi/zboot: Add BSS padding before compression arm64: efi: Enable BTI codegen and add PE/COFF annotation efi/pe: Import new BTI/IBT header flags from the spec efi/loongarch: Reintroduce efi_relocate_kernel() to relocate kernel commit 17d4ded2fc9d4f0b7c3c74ed9f80420c59d36e0b Merge: e81507acdc19d baba1315a74d1 Author: Linus Torvalds Date: Sat Apr 29 17:37:02 2023 -0700 Merge tag 'for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: - power-supply core support for automatic handling of constant battery data supplied by firmware - generic-adc-battery: major cleanup - axp288_charger: fix ACPI issues on x86 Android tablets - rk817: cleanup and fix handling for low state of charge * tag 'for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (26 commits) power: supply: rk817: Fix low SOC bugs power: supply: rk817: Drop unneeded debugging code power: supply: axp288_charger: Use alt usb-id extcon on some x86 android tablets power: supply: generic-adc-battery: style fixes power: supply: generic-adc-battery: improve error message power: supply: generic-adc-battery: update copyright info power: supply: generic-adc-battery: add DT support power: supply: generic-adc-battery: add temperature support power: supply: generic-adc-battery: simplify read_channel logic power: supply: generic-adc-battery: use simple-battery API power: supply: generic-adc-battery: drop memory alloc error message power: supply: generic-adc-battery: drop charge now support power: supply: generic-adc-battery: drop jitter delay support power: supply: generic-adc-battery: fix unit scaling power: supply: generic-adc-battery: convert to managed resources power: supply: core: auto-exposure of simple-battery data dt-bindings: power: supply: adc-battery: add binding power: supply: bq256xx: Support to disable charger power: supply: charger-manager: Use of_property_read_bool() for boolean properties power: reset: qcom-pon: drop of_match_ptr for ID table ... commit e81507acdc19d91df4121f409871f3e4e055f6c2 Merge: af3877265dd88 a9863979fbc25 Author: Linus Torvalds Date: Sat Apr 29 17:29:39 2023 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "Nothing looks out of the ordinary in this batch of clk driver updates. There are a couple patches to the core clk framework, but they're all basically cleanups or debugging aids. The driver updates and new additions are dominated in the diffstat by Qualcomm and MediaTek drivers. Qualcomm gained a handful of new drivers for various SoCs, and MediaTek gained a bunch of drivers for MT8188. The MediaTek drivers are being modernized as well, so there are updates all over that vendor's clk drivers. There's also a couple other new clk drivers in here, for example the Starfive JH7110 SoC support is added. Outside of the two major SoC vendors though, we have the usual collection of non-critical fixes and cleanups to various clk drivers. It's good to see that we're getting more cleanups and modernization patches. Maybe one day we'll be able to properly split clk providers from clk consumers. Core: - Print an informational message before disabling unused clks New Drivers: - BCM63268 timer clock and reset controller - Frequency Hopping (FHCTL) on MediaTek MT6795, MT8173, MT8192 and MT8195 SoCs - Mediatek MT8188 SoC clk drivers - Clock driver for Sunplus SP7021 SoC - Clk driver support for Loongson-2 SoCs - Clock driver for Skyworks Si521xx I2C PCIe clock generators - Initial Starfive JH7110 clk/reset support - Global clock controller drivers for Qualcomm SM7150, IPQ9574, MSM8917 and IPQ5332 SoCs - GPU clock controller drivers for SM6115, SM6125, SM6375 and SA8775P SoCs Updates: - Shrink size of clk_fractional_divider a little - Convert various clk drivers to devm_of_clk_add_hw_provider() - Convert platform clk drivers to remove_new() - Converted most Mediatek clock drivers to struct platform_driver - MediaTek clock drivers can be built as modules - Reimplement Loongson-1 clk driver with DT support - Migrate socfpga clk driver to of_clk_add_hw_provider() - Support for i3c clks on Aspeed ast2600 SoCs - Add clock generic devm_clk_hw_register_gate_parent_data - Add audiomix block control for i.MX8MP - Add support for determine_rate to i.MX composite-8m - Let the LCDIF Pixel clock of i.MX8MM and i.MX8MN set parent rate - Provide clock name in error message for clk-gpr-mux on get parent failure - Drop duplicate imx_clk_mux_flags macro - Register the i.MX8MP Media Disp2 Pix clock as bus clock - Add Media LDB root clock to i.MX8MP - Make i.MX8MP nand_usdhc_bus clock as non-critical - Fix the rate table for i.MX fracn-gppll - Disable HW control for the fracn-gppll in order to be controlled by register write - Add support for interger PLL in fracn-gppll - Add mcore_booted module parameter to i.MX93 provider - Add NIC, A55 and ARM PLL clocks to i.MX93 - Fix i.MX8ULP XBAR_DIVBUS and AD_SLOW clock parents - Use "divider closest" clock type for PLL4_PFD dividers on i.MX8ULP to get more accurate clock rates - Mark the MU0_Bi and TPM5 clocks on i.MX8ULP as critical - Update some of the i.MX critical clocks flags to allow glitchless on-the-fly rate change. - Add I2C5 clock on Renesas R-Car V3H - Exynos850: Add CMU_G3D clock controller for the Mali GPU - Extract Exynos5433 (ARM64) clock controller power management code to common driver parts - Exynos850: make PMU_ALIVE_PCLK clock critical - Add Audio, thermal, camera (CSI-2), Image Signal Processor/Channel Selector (ISPCS), and video capture (VIN) clocks on Renesas R-Car V4H - Add video capture (VIN) clocks on Renesas R-Car V3H - Add Cortex-A53 System CPU (Z2) clocks on Renesas R-Car V3M and V3H - Support for Stromer Plus PLL on Qualcomm IPQ5332 - Add a missing reset to Qualcomm QCM2290 - Migrate Qualcomm IPQ4019 to clk_parent_data - Make USB GDSCs enter retention state when disabled on Qualcomm SM6375, MSM8996 and MSM8998 SoCs - Set floor rounding clk_ops for Qualcomm QCM2290 SDCC2 clk - Add two EMAC GDSCs on Qualcomm SC8280XP - Use shared rcg clk ops in Qualcomm SM6115 GCC - Park Qualcomm SM8350 PCIe PIPE clks when disabled - Add GDSCs to Qualcomm SC7280 LPASS audio clock controller - Add missing XO clocks to Qualcomm MSM8226 and MSM8974 - Convert some Qualcomm clk DT bindings to YAML - Reparenting fix for the clock supplying camera modules on Rockchip rk3399 - Mark more critical (bus-)clocks on Rockchip rk3588" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (290 commits) clk: qcom: gcc-sc8280xp: Add EMAC GDSCs clk: starfive: Delete the redundant dev_set_drvdata() in JH7110 clock drivers clk: rockchip: rk3588: make gate linked clocks critical clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk clk: qcom: add the GPUCC driver for sa8775p dt-bindings: clock: qcom: describe the GPUCC clock for SA8775P clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks in lpass_cc_sc7280_desc clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration dt-bindings: clock: qcom,sc7280-lpasscc: Add qcom,adsp-pil-mode property clk: starfive: Avoid casting iomem pointers clk: microchip: fix potential UAF in auxdev release callback clk: qcom: rpm: Use managed `of_clk_add_hw_provider()` clk: mediatek: fhctl: Mark local variables static clk: sifive: make SiFive clk drivers depend on ARCH_ symbols clk: uniphier: Use managed `of_clk_add_hw_provider()` clk: si5351: Use managed `of_clk_add_hw_provider()` clk: si570: Use managed `of_clk_add_hw_provider()` clk: si514: Use managed `of_clk_add_hw_provider()` clk: lmk04832: Use managed `of_clk_add_hw_provider()` ... commit af3877265dd88d7e333f94fb37bc09554544adca Merge: 1ae78a14516b9 531094dc71647 Author: Linus Torvalds Date: Sat Apr 29 17:21:24 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Usual wide collection of unrelated items in drivers: - Driver bug fixes and treewide cleanups in hfi1, siw, qib, mlx5, rxe, usnic, usnic, bnxt_re, ocrdma, iser: - remove unnecessary NULL checks - kmap obsolescence - pci_enable_pcie_error_reporting() obsolescence - unused variables and macros - trace event related warnings - casting warnings - Code cleanups for irdm and erdma - EFA reporting of 128 byte PCIe TLP support - mlx5 more agressively uses the out of order HW feature - Big rework of how state machines and tasks work in rxe - Fix a syzkaller found crash netdev refcount leak in siw - bnxt_re revises their HW description header - Congestion control for bnxt_re - Use mmu_notifiers more safely in hfi1 - mlx5 gets better support for PCIe relaxed ordering inside VMs" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (81 commits) RDMA/efa: Add rdma write capability to device caps RDMA/mlx5: Use correct device num_ports when modify DC RDMA/irdma: Drop spurious WQ_UNBOUND from alloc_ordered_workqueue() call RDMA/rxe: Fix spinlock recursion deadlock on requester RDMA/mlx5: Fix flow counter query via DEVX RDMA/rxe: Protect QP state with qp->state_lock RDMA/rxe: Move code to check if drained to subroutine RDMA/rxe: Remove qp->req.state RDMA/rxe: Remove qp->comp.state RDMA/rxe: Remove qp->resp.state RDMA/mlx5: Allow relaxed ordering read in VFs and VMs net/mlx5: Update relaxed ordering read HCA capabilities RDMA/mlx5: Check pcie_relaxed_ordering_enabled() in UMR RDMA/mlx5: Remove pcie_relaxed_ordering_enabled() check for RO write RDMA: Add ib_virt_dma_to_page() RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task" RDMA/irdma: Slightly optimize irdma_form_ah_cm_frame() RDMA/rxe: Fix incorrect TASKLET_STATE_SCHED check in rxe_task.c IB/hfi1: Place struct mmu_rb_handler on cache line start IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests ... commit 26b0812f4cf824a02eec9a425c09e34a25420166 Author: Conor Dooley Date: Sat Apr 29 10:27:33 2023 +0100 RISC-V: fixup in-flight collision with ARCH_WANT_OPTIMIZE_VMEMMAP rename Lukas warned that ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP had been renamed in the mm tree & that RISC-V would need a fixup as part of the merge. The warning was missed however, and RISC-V is selecting the orphaned Kconfig option. Fixes: 89d77f71f493 ("Merge tag 'riscv-for-linus-6.4-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux") Reported-by: Lukas Bulwahn . Link: https://lore.kernel.org/linux-riscv/CAKXUXMyVeg2kQK_edKHtMD3eADrDK_PKhCSVkMrLDdYgTQQ5rg@mail.gmail.com/ Signed-off-by: Conor Dooley Reviewed-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230429-trilogy-jolly-12bf5c53d62d@spud Signed-off-by: Palmer Dabbelt commit a2a58b5ca124f4a0178d0ada801f1ed2c84c393d Author: Randy Dunlap Date: Sat Apr 29 08:52:47 2023 -0700 RISC-V: fix sifive and thead section mismatches in errata When CONFIG_MODULES is set, __init_or_module becomes , but when CONFIG_MODULES is not set, __init_or_module becomes __init. In the latter case, it causes section mismatch warnings: WARNING: modpost: vmlinux.o: section mismatch in reference: riscv_fill_cpu_mfr_info (section: .text) -> sifive_errata_patch_func (section: .init.text) WARNING: modpost: vmlinux.o: section mismatch in reference: riscv_fill_cpu_mfr_info (section: .text) -> thead_errata_patch_func (section: .init.text) Fixes: bb3f89487fd9 ("RISC-V: hwprobe: Remove __init on probe_vendor_features()") Signed-off-by: Randy Dunlap Reviewed-by: Evan Green Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230429155247.12131-1-rdunlap@infradead.org Signed-off-by: Palmer Dabbelt commit 41cad8284d5e6bf1d49d3c10a6b52ee1ae866a20 Author: Andrew Jones Date: Thu Apr 27 18:36:26 2023 +0200 RISC-V: Align SBI probe implementation with spec sbi_probe_extension() is specified with "Returns 0 if the given SBI extension ID (EID) is not available, or 1 if it is available unless defined as any other non-zero value by the implementation." Additionally, sbiret.value is a long. Fix the implementation to ensure any nonzero long value is considered a success, rather than only positive int values. Fixes: b9dcd9e41587 ("RISC-V: Add basic support for SBI v0.2") Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230427163626.101042-1-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit e4ef93edd4e0b022529303db1915766ff9de450e Author: Song Shuai Date: Wed Apr 26 18:00:09 2023 +0800 riscv: mm: remove redundant parameter of create_fdt_early_page_table create_fdt_early_page_table() explicitly uses early_pg_dir for 32-bit fdt mapping and the pgdir parameter is redundant here. So remove it and its caller. Reviewed-by: Alexandre Ghiti Signed-off-by: Song Shuai Reviewed-by: Conor Dooley Fixes: ef69d2559fe9 ("riscv: Move early dtb mapping into the fixmap region") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230426100009.685435-1-suagrfillet@gmail.com Signed-off-by: Palmer Dabbelt commit 38dab744f77f6d61f6d08334f83948ce9faadd3a Merge: b3d6bdfea21ce c0317210012e3 Author: Palmer Dabbelt Date: Sat Apr 29 11:25:15 2023 -0700 Merge patch series "RISC-V Hibernation Support" Sia Jee Heng says: This series adds RISC-V Hibernation/suspend to disk support. Low level Arch functions were created to support hibernation. swsusp_arch_suspend() relies code from __cpu_suspend_enter() to write cpu state onto the stack, then calling swsusp_save() to save the memory image. Arch specific hibernation header is implemented and is utilized by the arch_hibernation_header_restore() and arch_hibernation_header_save() functions. The arch specific hibernation header consists of satp, hartid, and the cpu_resume address. The kernel built version is also need to be saved into the hibernation image header to making sure only the same kernel is restore when resume. swsusp_arch_resume() creates a temporary page table that covering only the linear map. It copies the restore code to a 'safe' page, then start to restore the memory image. Once completed, it restores the original kernel's page table. It then calls into __hibernate_cpu_resume() to restore the CPU context. Finally, it follows the normal hibernation path back to the hibernation core. To enable hibernation/suspend to disk into RISCV, the below config need to be enabled: - CONFIG_HIBERNATION - CONFIG_ARCH_HIBERNATION_HEADER - CONFIG_ARCH_HIBERNATION_POSSIBLE At high-level, this series includes the following changes: 1) Change suspend_save_csrs() and suspend_restore_csrs() to public function as these functions are common to suspend/hibernation. (patch 1) 2) Refactor the common code in the __cpu_resume_enter() function and __hibernate_cpu_resume() function. The common code are used by hibernation and suspend. (patch 2) 3) Enhance kernel_page_present() function to support huge page. (patch 3) 4) Add arch/riscv low level functions to support hibernation/suspend to disk. (patch 4) * b4-shazam-merge: RISC-V: Add arch functions to support hibernation/suspend-to-disk RISC-V: mm: Enable huge page support to kernel_page_present() function RISC-V: Factor out common code of __cpu_resume_enter() RISC-V: Change suspend_save_csrs and suspend_restore_csrs to public function Link: https://lore.kernel.org/r/20230330064321.1008373-1-jeeheng.sia@starfivetech.com Signed-off-by: Palmer Dabbelt commit b3d6bdfea21ce1bbb45c3e6f297dfaf570d36300 Author: Nathan Chancellor Date: Tue Apr 4 13:34:21 2023 -0700 riscv: Adjust dependencies of HAVE_DYNAMIC_FTRACE selection When building allmodconfig with clang and its integrated assembler and linking with a version of GNU ld prior to 2.36, the following link error occurs: riscv64-linux-gnu-ld: .init.data has both ordered [`__patchable_function_entries' in init/main.o] and unordered [`.init_array.0' in kernel/trace/trace_benchmark.o] sections riscv64-linux-gnu-ld: final link failed: bad value This is the same error addressed by commit 45bd8951806e ("arm64: Improve HAVE_DYNAMIC_FTRACE_WITH_REGS selection for clang") for arm64. See that changelog for a full description of why this error occurs with this combination of tools. In a similar manner as that change, restrict the CONFIG_HAVE_DYNAMIC_FTRACE selection to combinations of tools known to work so that there are no errors. Link: https://github.com/ClangBuiltLinux/linux/issues/1817 Signed-off-by: Nathan Chancellor Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230404-riscv-dynamic-ftrace-checks-clang-v1-1-0ce296b7d423@kernel.org Signed-off-by: Palmer Dabbelt commit c0317210012e3b985779ddd92a7c5db8424e1e97 Author: Sia Jee Heng Date: Thu Mar 30 14:43:21 2023 +0800 RISC-V: Add arch functions to support hibernation/suspend-to-disk Low level Arch functions were created to support hibernation. swsusp_arch_suspend() relies code from __cpu_suspend_enter() to write cpu state onto the stack, then calling swsusp_save() to save the memory image. Arch specific hibernation header is implemented and is utilized by the arch_hibernation_header_restore() and arch_hibernation_header_save() functions. The arch specific hibernation header consists of satp, hartid, and the cpu_resume address. The kernel built version is also need to be saved into the hibernation image header to making sure only the same kernel is restore when resume. swsusp_arch_resume() creates a temporary page table that covering only the linear map. It copies the restore code to a 'safe' page, then start to restore the memory image. Once completed, it restores the original kernel's page table. It then calls into __hibernate_cpu_resume() to restore the CPU context. Finally, it follows the normal hibernation path back to the hibernation core. To enable hibernation/suspend to disk into RISCV, the below config need to be enabled: - CONFIG_HIBERNATION - CONFIG_ARCH_HIBERNATION_HEADER - CONFIG_ARCH_HIBERNATION_POSSIBLE Signed-off-by: Sia Jee Heng Reviewed-by: Ley Foon Tan Reviewed-by: Mason Huo Reviewed-by: Conor Dooley Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230330064321.1008373-5-jeeheng.sia@starfivetech.com Signed-off-by: Palmer Dabbelt commit a15c90b67a662c75f469822a7f95c7aaa049e28f Author: Sia Jee Heng Date: Thu Mar 30 14:43:20 2023 +0800 RISC-V: mm: Enable huge page support to kernel_page_present() function Currently kernel_page_present() function doesn't support huge page detection causes the function to mistakenly return false to the hibernation core. Add huge page detection to the function to solve the problem. Fixes: 9e953cda5cdf ("riscv: Introduce huge page support for 32/64bit kernel") Signed-off-by: Sia Jee Heng Reviewed-by: Ley Foon Tan Reviewed-by: Mason Huo Reviewed-by: Andrew Jones Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230330064321.1008373-4-jeeheng.sia@starfivetech.com Signed-off-by: Palmer Dabbelt commit fcb89863d1b798565db6bdaf8f97f65823c2fd1b Author: Sia Jee Heng Date: Thu Mar 30 14:43:19 2023 +0800 RISC-V: Factor out common code of __cpu_resume_enter() The cpu_resume() function is very similar for the suspend to disk and suspend to ram cases. Factor out the common code into suspend_restore_csrs macro and suspend_restore_regs macro. Signed-off-by: Sia Jee Heng Reviewed-by: Andrew Jones Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230330064321.1008373-3-jeeheng.sia@starfivetech.com Signed-off-by: Palmer Dabbelt commit 0def12f32129c774f2cd598e326cc4b473da927b Author: Sia Jee Heng Date: Thu Mar 30 14:43:18 2023 +0800 RISC-V: Change suspend_save_csrs and suspend_restore_csrs to public function Currently suspend_save_csrs() and suspend_restore_csrs() functions are statically defined in the suspend.c. Change the function's attribute to public so that the functions can be used by hibernation as well. Signed-off-by: Sia Jee Heng Reviewed-by: Ley Foon Tan Reviewed-by: Mason Huo Reviewed-by: Conor Dooley Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230330064321.1008373-2-jeeheng.sia@starfivetech.com Signed-off-by: Palmer Dabbelt commit 1ae78a14516b9372e4c90a89ac21b259339a3a3a Merge: 4e1c80ae5cf45 74d7970febf7e Author: Linus Torvalds Date: Sat Apr 29 11:10:39 2023 -0700 Merge tag '6.4-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server updates from Steve French: - SMB3.1.1 negotiate context fixes and cleanup - new lock_rename_child VFS helper - ksmbd fix to avoid unlink race and to use the new VFS helper to avoid rename race * tag '6.4-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix racy issue from using ->d_parent and ->d_name ksmbd: remove unused compression negotiate ctx packing ksmbd: avoid duplicate negotiate ctx offset increments ksmbd: set NegotiateContextCount once instead of every inc fs: introduce lock_rename_child() helper ksmbd: remove internal.h include commit 4e1c80ae5cf458792bec9815ee77bc3851046fb8 Merge: 0127f25b5dfcc 9280c57743140 Author: Linus Torvalds Date: Sat Apr 29 11:04:14 2023 -0700 Merge tag 'nfsd-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "The big ticket item for this release is that support for RPC-with-TLS [RFC 9289] has been added to the Linux NFS server. The goal is to provide a simple-to-deploy, low-overhead in-transit confidentiality and peer authentication mechanism. It can supplement NFS Kerberos and it can protect the use of legacy non-cryptographic user authentication flavors such as AUTH_SYS. The TLS Record protocol is handled entirely by kTLS, meaning it can use either software encryption or offload encryption to smart NICs. Aside from that, work continues on improving NFSD's open file cache. Among the many clean-ups in that area is a patch to convert the rhashtable to use the list-hashing version of that data structure" * tag 'nfsd-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (31 commits) NFSD: Handle new xprtsec= export option SUNRPC: Support TLS handshake in the server-side TCP socket code NFSD: Clean up xattr memory allocation flags NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop SUNRPC: Clear rq_xid when receiving a new RPC Call SUNRPC: Recognize control messages in server-side TCP socket code SUNRPC: Be even lazier about releasing pages SUNRPC: Convert svc_xprt_release() to the release_pages() API SUNRPC: Relocate svc_free_res_pages() nfsd: simplify the delayed disposal list code SUNRPC: Ignore return value of ->xpo_sendto SUNRPC: Ensure server-side sockets have a sock->file NFSD: Watch for rq_pages bounds checking errors in nfsd_splice_actor() sunrpc: simplify two-level sysctl registration for svcrdma_parm_table SUNRPC: return proper error from get_expiry() lockd: add some client-side tracepoints nfs: move nfs_fhandle_hash to common include file lockd: server should unlock lock if client rejects the grant lockd: fix races in client GRANTED_MSG wait logic lockd: move struct nlm_wait to lockd.h ... commit 0127f25b5dfcc3d0349eb29d692178183e101652 Merge: 1e098dec61ba3 fbd2a05f29a95 Author: Linus Torvalds Date: Sat Apr 29 10:58:44 2023 -0700 Merge tag 'nfs-for-6.4-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "New Features: - Convert the readdir path to use folios - Convert the NFS fscache code to use netfs Bugfixes and Cleanups: - Always send a RECLAIM_COMPLETE after establishing a lease - Simplify sysctl registrations and other cleanups - Handle out-of-order write replies on NFS v3 - Have sunrpc call_bind_status use standard hard/soft task semantics - Other minor cleanups" * tag 'nfs-for-6.4-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4.2: Rework scratch handling for READ_PLUS NFS: Cleanup unused rpc_clnt variable NFS: set varaiable nfs_netfs_debug_id storage-class-specifier to static SUNRPC: remove the maximum number of retries in call_bind_status NFS: Convert readdir page array functions to use a folio NFS: Convert the readdir array-of-pages into an array-of-folios NFSv3: handle out-of-order write replies. NFS: Remove fscache specific trace points and NFS_INO_FSCACHE bit NFS: Remove all NFSIOS_FSCACHE counters due to conversion to netfs API NFS: Convert buffered read paths to use netfs when fscache is enabled NFS: Configure support for netfs when NFS fscache is configured NFS: Rename readpage_async_filler to nfs_read_add_folio sunrpc: simplify one-level sysctl registration for debug_table sunrpc: move sunrpc_table and proc routines above sunrpc: simplify one-level sysctl registration for xs_tunables_table sunrpc: simplify one-level sysctl registration for xr_tunables_table nfs: simplify two-level sysctl registration for nfs_cb_sysctls nfs: simplify two-level sysctl registration for nfs4_cb_sysctls lockd: simplify two-level sysctl registration for nlm_sysctls NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease commit 1e098dec61ba342c8cebbfdf0fcdcd9ce54f7fa1 Merge: 56c455b38dba4 788ee1605c2e9 Author: Linus Torvalds Date: Sat Apr 29 10:52:37 2023 -0700 Merge tag 'ntfs3_for_6.4' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "New code: - add missed "nocase" in ntfs_show_options - extend information on failures/errors - small optimizations Fixes: - some logic errors - some dead code was removed - code is refactored and reformatted according to the new version of clang-format Code removal: - 'noacsrules' option. Currently, this option does not work properly, and its use leads to unstable results. If we figure out how to implement it without errors, we will add it later - writepage" * tag 'ntfs3_for_6.4' of https://github.com/Paragon-Software-Group/linux-ntfs3: (30 commits) fs/ntfs3: Fix root inode checking fs/ntfs3: Print details about mount fails fs/ntfs3: Add missed "nocase" in ntfs_show_options fs/ntfs3: Code formatting and refactoring fs/ntfs3: Changed ntfs_get_acl() to use dentry fs/ntfs3: Remove field sbi->used.bitmap.set_tail fs/ntfs3: Undo critial modificatins to keep directory consistency fs/ntfs3: Undo endian changes fs/ntfs3: Optimization in ntfs_set_state() fs/ntfs3: Fix ntfs_create_inode() fs/ntfs3: Remove noacsrules fs/ntfs3: Use bh_read to simplify code fs/ntfs3: Fix a possible null-pointer dereference in ni_clear() fs/ntfs3: Refactoring of various minor issues fs/ntfs3: Restore overflow checking for attr size in mi_enum_attr fs/ntfs3: Check for extremely large size of $AttrDef fs/ntfs3: Improved checking of attribute's name length fs/ntfs3: Add null pointer checks fs/ntfs3: fix spelling mistake "attibute" -> "attribute" fs/ntfs3: Add length check in indx_get_root ... commit 56c455b38dba47ae9cb48d71b2a106d769d1a694 Merge: bedf1495271bc 9419092fb2630 Author: Linus Torvalds Date: Sat Apr 29 10:44:27 2023 -0700 Merge tag 'xfs-6.4-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Dave Chinner: "This consists mainly of online scrub functionality and the design documentation for the upcoming online repair functionality built on top of the scrub code: - Added detailed design documentation for the upcoming online repair feature - major update to online scrub to complete the reverse mapping cross-referencing infrastructure enabling us to fully validate allocated metadata against owner records. This is the last piece of scrub infrastructure needed before we can start merging online repair functionality. - Fixes for the ascii-ci hashing issues - deprecation of the ascii-ci functionality - on-disk format verification bug fixes - various random bug fixes for syzbot and other bug reports" * tag 'xfs-6.4-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (107 commits) xfs: fix livelock in delayed allocation at ENOSPC xfs: Extend table marker on deprecated mount options table xfs: fix duplicate includes xfs: fix BUG_ON in xfs_getbmap() xfs: verify buffer contents when we skip log replay xfs: _{attr,data}_map_shared should take ILOCK_EXCL until iread_extents is completely done xfs: remove WARN when dquot cache insertion fails xfs: don't consider future format versions valid xfs: deprecate the ascii-ci feature xfs: test the ascii case-insensitive hash xfs: stabilize the dirent name transformation function used for ascii-ci dir hash computation xfs: cross-reference rmap records with refcount btrees xfs: cross-reference rmap records with inode btrees xfs: cross-reference rmap records with free space btrees xfs: cross-reference rmap records with ag btrees xfs: introduce bitmap type for AG blocks xfs: convert xbitmap to interval tree xfs: drop the _safe behavior from the xbitmap foreach macro xfs: don't load local xattr values during scrub xfs: remove the for_each_xbitmap_ helpers ... commit bedf1495271bc2ea57903762b722f339ea680d0d Merge: b28e6315a0b42 3fd41721cd5c3 Author: Linus Torvalds Date: Sat Apr 29 10:35:48 2023 -0700 Merge tag 'iomap-6.4-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap updates from Darrick Wong: "The only changes for this cycle are the addition of tracepoints to the iomap directio code so that Ritesh (who is working on porting ext2 to iomap) can observe the io flows more easily. Summary: - Remove an unused symbol - Add tracepoints for the directio code" * tag 'iomap-6.4-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: Add DIO tracepoints iomap: Remove IOMAP_DIO_NOSYNC unused dio flag fs.h: Add TRACE_IOCB_STRINGS for use in trace points commit b28e6315a0b42b39351d1953c1c4b54f80855857 Merge: 7d8d20191c855 ec274aff21b6a Author: Linus Torvalds Date: Sat Apr 29 10:29:57 2023 -0700 Merge tag 'dma-mapping-6.4-2023-04-28' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - fix a PageHighMem check in dma-coherent initialization (Doug Berger) - clean up the coherency defaul initialiation (Jiaxun Yang) - add cacheline to user/kernel dma-debug space dump messages (Desnes Nunes, Geert Uytterhoeve) - swiotlb statistics improvements (Michael Kelley) - misc cleanups (Petr Tesarik) * tag 'dma-mapping-6.4-2023-04-28' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: Omit total_used and used_hiwater if !CONFIG_DEBUG_FS swiotlb: track and report io_tlb_used high water marks in debugfs swiotlb: fix debugfs reporting of reserved memory pools swiotlb: relocate PageHighMem test away from rmem_swiotlb_setup of: address: always use dma_default_coherent for default coherency dma-mapping: provide CONFIG_ARCH_DMA_DEFAULT_COHERENT dma-mapping: provide a fallback dma_default_coherent dma-debug: Use %pa to format phys_addr_t dma-debug: add cacheline to user/kernel space dump messages dma-debug: small dma_debug_entry's comment and variable name updates dma-direct: cleanup parameters to dma_direct_optimal_gfp_mask commit 7d8d20191c8557584269b6ba8eae5409564dc84b Merge: 8c1318e4383e4 158009f1b4a33 Author: Linus Torvalds Date: Sat Apr 29 10:24:30 2023 -0700 Merge tag 'timers-core-2023-04-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull more timer updates from Thomas Gleixner: "Timekeeping and clocksource/event driver updates the second batch: - A trivial documentation fix in the timekeeping core - A really boring set of small fixes, enhancements and cleanups in the drivers code. No new clocksource/clockevent drivers for a change" * tag 'timers-core-2023-04-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Fix references to nonexistent ktime_get_fast_ns() dt-bindings: timer: rockchip: Add rk3588 compatible dt-bindings: timer: rockchip: Drop superfluous rk3288 compatible clocksource/drivers/ti: Use of_property_read_bool() for boolean properties clocksource/drivers/timer-ti-dm: Fix finding alwon timer clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails clocksource/drivers/stm32-lp: Drop of_match_ptr for ID table clocksource/drivers/timer-ti-dm: Convert to platform remove callback returning void clocksource/drivers/timer-tegra186: Convert to platform remove callback returning void clocksource/drivers/timer-ti-dm: Improve error message in .remove clocksource/drivers/timer-stm32-lp: Mark driver as non-removable clocksource/drivers/sh_mtu2: Mark driver as non-removable clocksource/drivers/timer-ti-dm: Use of_address_to_resource() clocksource/drivers/timer-imx-gpt: Remove non-DT function clocksource/drivers/timer-mediatek: Split out CPUXGPT timers clocksource/drivers/exynos_mct: Explicitly return 0 for shared timer commit 8c1318e4383e400727c700b9db5044162f5bac57 Merge: febf9ee3d2f37 6d2ed653185ba Author: Linus Torvalds Date: Sat Apr 29 10:17:05 2023 -0700 Merge tag 'lsm-pr-20230428' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm fix from Paul Moore: "A single Documentation/LSM fix to update the LSM hook documentation references from lsm_hooks.h to security.c" * tag 'lsm-pr-20230428' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: move hook comments docs to security/security.c commit febf9ee3d2f37a772802fffb6e17c0e35a52e1f1 Merge: 86e98ed15b3e3 644f17412f5ac Author: Linus Torvalds Date: Sat Apr 29 10:11:32 2023 -0700 Merge tag 'integrity-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity update from Mimi Zohar: "Just one one bug fix. Other integrity changes are being upstreamed via the tpm and lsm trees" * tag 'integrity-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: IMA: allow/fix UML builds commit 86e98ed15b3e34460d1b3095bd119b6fac11841c Merge: cd546fa325161 9403d9cb564b6 Author: Linus Torvalds Date: Sat Apr 29 10:05:22 2023 -0700 Merge tag 'cgroup-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - cpuset changes including the fix for an incorrect interaction with CPU hotplug and an optimization - Other doc and cosmetic changes * tag 'cgroup-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: docs: cgroup-v1/cpusets: update libcgroup project link cgroup/cpuset: Minor updates to test_cpuset_prs.sh cgroup/cpuset: Include offline CPUs when tasks' cpumasks in top_cpuset are updated cgroup/cpuset: Skip task update if hotplug doesn't affect current cpuset cpuset: Clean up cpuset_node_allowed cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers commit cd546fa325161fbe374480a5081b6ebb7d1bec95 Merge: 89d77f71f493a 704bc669e1dda Author: Linus Torvalds Date: Sat Apr 29 09:48:52 2023 -0700 Merge tag 'wq-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: "Mostly changes from Petr to improve warning and error reporting. Workqueue now reports more of the relevant failures with better context which should help debugging" * tag 'wq-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Introduce show_freezable_workqueues workqueue: Print backtraces from CPUs with hung CPU bound workqueues workqueue: Warn when a rescuer could not be created workqueue: Interrupted create_worker() is not a repeated event workqueue: Warn when a new worker could not be created workqueue: Fix hung time report of worker pools workqueue: Simplify a pr_warn() call in wq_select_unbound_cpu() MAINTAINERS: Add workqueue_internal.h to the WORKQUEUE entry commit ec570320b09f76d52819e60abdccf372658216b6 Author: Mark Rutland Date: Thu Apr 13 17:06:44 2023 +0100 locking/atomic: Correct (cmp)xchg() instrumentation All xchg() and cmpxchg() ops are atomic RMWs, but currently we instrument these with instrument_atomic_write() rather than instrument_atomic_read_write(), missing the read aspect. Similarly, all try_cmpxchg() ops are non-atomic RMWs on *oldp, but we instrument these accesses with instrument_atomic_write() rather than instrument_read_write(), missing the read aspect and erroneously marking these as atomic. Fix the instrumentation for both points. Signed-off-by: Mark Rutland Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20230413160644.490976-1-mark.rutland@arm.com Cc: Linus Torvalds commit 5cd4c268412f802e71b7722c3ec4638b0fe04acd Author: Uros Bizjak Date: Wed Apr 5 16:17:09 2023 +0200 locking/x86: Define arch_try_cmpxchg_local() Define target specific arch_try_cmpxchg_local(). This definition overrides the generic arch_try_cmpxchg_local() fallback definition and enables target-specific implementation of try_cmpxchg_local(). Signed-off-by: Uros Bizjak Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230405141710.3551-5-ubizjak@gmail.com Cc: Linus Torvalds commit d994f2c8e2410ebcb928df67baa6f04e29bc9d3e Author: Uros Bizjak Date: Wed Apr 5 16:17:08 2023 +0200 locking/arch: Wire up local_try_cmpxchg() Implement target specific support for local_try_cmpxchg() and local_cmpxchg() using typed C wrappers that call their _local counterpart and provide additional checking of their input arguments. Signed-off-by: Uros Bizjak Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230405141710.3551-4-ubizjak@gmail.com Cc: Linus Torvalds commit 8fc4fddaf9a184eea7da21290236a1764e608a01 Author: Uros Bizjak Date: Wed Apr 5 16:17:07 2023 +0200 locking/generic: Wire up local{,64}_try_cmpxchg() Implement generic support for local{,64}_try_cmpxchg(). Redirect to the atomic_ family of functions when the target does not provide its own local.h definitions. For 64-bit targets, implement local64_try_cmpxchg and local64_cmpxchg using typed C wrappers that call local_ family of functions and provide additional checking of their input arguments. Signed-off-by: Uros Bizjak Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20230405141710.3551-3-ubizjak@gmail.com Cc: Linus Torvalds commit e6ce9d741163af0b846637ce6550ae8a671b1588 Author: Uros Bizjak Date: Wed Apr 5 16:17:06 2023 +0200 locking/atomic: Add generic try_cmpxchg{,64}_local() support Add generic support for try_cmpxchg{,64}_local() and their falbacks. These provides the generic try_cmpxchg_local family of functions from the arch_ prefixed version, also adding explicit instrumentation. Signed-off-by: Uros Bizjak Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20230405141710.3551-2-ubizjak@gmail.com Cc: Linus Torvalds commit 286deb7ec03d941664ac3ffaff58814b454adf65 Author: Sebastian Andrzej Siewior Date: Tue Mar 21 17:11:40 2023 +0100 locking/rwbase: Mitigate indefinite writer starvation On PREEMPT_RT, rw_semaphore and rwlock_t locks are unfair to writers. Readers can indefinitely acquire the lock unless the writer fully acquired the lock, which might never happen if there is always a reader in the critical section owning the lock. Mel Gorman reported that since LTP-20220121 the dio_truncate test case went from having 1 reader to having 16 readers and that number of readers is sufficient to prevent the down_write ever succeeding while readers exist. Eventually the test is killed after 30 minutes as a failure. Mel proposed a timeout to limit how long a writer can be blocked until the reader is forced into the slowpath. Thomas argued that there is no added value by providing this timeout. From a PREEMPT_RT point of view, there are no critical rw_semaphore or rwlock_t locks left where the reader must be preferred. Mitigate indefinite writer starvation by forcing the READER into the slowpath once the WRITER attempts to acquire the lock. Reported-by: Mel Gorman Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Acked-by: Mel Gorman Link: https://lore.kernel.org/877cwbq4cq.ffs@tglx Link: https://lore.kernel.org/r/20230321161140.HMcQEhHb@linutronix.de Cc: Linus Torvalds commit 068550631fbe0b7fb41625cea6fb204fdc8cb224 Author: Andrzej Hajda Date: Wed Jan 18 16:44:44 2023 +0100 locking/arch: Rename all internal __xchg() names to __arch_xchg() Decrease the probability of this internal facility to be used by driver code. Signed-off-by: Andrzej Hajda Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Arnd Bergmann Reviewed-by: Andi Shyti Acked-by: Geert Uytterhoeven [m68k] Acked-by: Palmer Dabbelt [riscv] Link: https://lore.kernel.org/r/20230118154450.73842-1-andrzej.hajda@intel.com Cc: Linus Torvalds commit 10f67d1fd275528e62109de2ece26371833638e5 Author: Christophe JAILLET Date: Wed Apr 26 08:52:49 2023 +0200 watchdog: dw_wdt: Simplify clk management Use devm_clk_get_enabled() instead of hand-writing it. This saves some LoC. Signed-off-by: Christophe JAILLET Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/f6094c55cacf9637d835cd49290d9e888faeb0f7.1682491863.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7f5390750645756bd5da2b24fac285f2654dd922 Author: Christophe JAILLET Date: Wed Apr 26 08:52:48 2023 +0200 watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe() The commit in Fixes has only updated the remove function and missed the error handling path of the probe. Add the missing reset_control_assert() call. Fixes: 65a3b6935d92 ("watchdog: dw_wdt: get reset lines from dt") Signed-off-by: Christophe JAILLET Reviewed-by: Philipp Zabel Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/fbb650650bbb33a8fa2fd028c23157bedeed50e1.1682491863.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b23c1f807cb20a9a4c42b63c3d80f63b045a43ef Author: Xingyu Wu Date: Thu Apr 27 15:44:00 2023 +0800 watchdog: starfive: Fix the warning of starfive_wdt_match Drop the function of of_match_ptr() to fix the warning of unused variable 'starfive_wdt_match'. Fixes: db728ea9c7be ("drivers: watchdog: Add StarFive Watchdog driver") Signed-off-by: Xingyu Wu Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230427074400.55380-1-xingyu.wu@starfivetech.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 90211b58828924577b589e59814f53aec4557fb9 Author: Xingyu Wu Date: Wed Apr 26 11:12:16 2023 +0800 watchdog: starfive: Fix the probe return error if PM and early_enable are both disabled When the starfive watchdog driver uses 'pm_runtime_put_sync()' as probe return value at last and 'early_enable' is disabled, it could return the error '-ENOSYS' if the CONFIG_PM is disabled, but the driver should works normally. Drop the 'return' and keep the 'pm_runtime_put_sync()', but do not use it as the return value. Fixes: db728ea9c7be ("drivers: watchdog: Add StarFive Watchdog driver") Signed-off-by: Xingyu Wu Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230426031216.37981-1-xingyu.wu@starfivetech.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9be11a69315e26363a4de8930bc50d0901a96775 Author: Steve French Date: Sun Apr 23 01:19:28 2023 -0500 cifs: update internal module version number for cifs.ko From 2.42 to 2.43 Signed-off-by: Steve French commit 2fe187dca6030dd5dbecfe38e9610544d46e8c02 Author: Steve French Date: Fri Apr 28 00:41:58 2023 -0500 smb3: move some common open context structs to smbfs_common create durable and create durable reconnect context and the maximal access create context struct definitions can be put in common code in smbfs_common Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 1149c8467ddebfb6bb9aab37830f70a49cab7085 Author: Steve French Date: Fri Apr 28 00:21:10 2023 -0500 smb3: make query_on_disk_id open context consistent and move to common code cifs and ksmbd were using a slightly different version of the query_on_disk_id struct which could be confusing. Use the ksmbd version of this struct, and move it to common code. Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit c09ba02cfaf35732f7e36f291dd9679a6f109a12 Author: Steve French Date: Thu Apr 27 12:45:54 2023 -0500 SMB3.1.1: add new tree connect ShareFlags Also update these flag names in a few places to match the simpler easier to understand names now used in the protocol documentation (see MS-SMB2 section 2.2.10) Acked-by: Bharath SM Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 943fb67b090212f1d3789eb7796b1c9045c62fd6 Author: Steve French Date: Wed Apr 26 22:01:31 2023 -0500 cifs: missing lock when updating session status Coverity noted a place where we were not grabbing the ses_lock when setting (and checking) ses_status. Addresses-Coverity: 1536833 ("Data race condition (MISSING_LOCK)") Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Bharath SM Signed-off-by: Steve French commit 06bff3d98cf2cfef225f8190bb679f3f8cb89912 Author: Ian Rogers Date: Fri Apr 28 00:37:27 2023 -0700 perf stat: Disable TopdownL1 on hybrid Bugs with event parsing, event grouping and metrics causes the TopdownL1 metricgroup to crash the perf command. Temporarily disable the group if no events/metrics are spcecified. Reviewed-by: Kan Liang Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Ahmad Yasin Cc: Alexander Shishkin Cc: Andi Kleen Cc: Athira Rajeev Cc: Caleb Biggers Cc: Edward Baker Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Kang Minchul Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Cc: Samantha Alt Cc: Stephane Eranian Cc: Sumanth Korikkar Cc: Suzuki Poulouse Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xing Zhengjun Cc: Yang Jihong Link: https://lore.kernel.org/r/20230428073809.1803624-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 0463ca3d7159bb86efa6f36ca70a41bb711bc6f8 Author: Ian Rogers Date: Wed Apr 26 00:00:17 2023 -0700 perf stat: Avoid SEGV on counter->name Switch to use evsel__name() that doesn't return NULL for hardware and similar events. Reviewed-by: Kan Liang Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Ahmad Yasin Cc: Alexander Shishkin Cc: Andi Kleen Cc: Athira Rajeev Cc: Caleb Biggers Cc: Edward Baker Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Kang Minchul Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Cc: Samantha Alt Cc: Stephane Eranian Cc: Sumanth Korikkar Cc: Suzuki Poulouse Cc: Thomas Richter Cc: Tiezhu Yang Cc: Weilin Wang Cc: Xing Zhengjun Cc: Yang Jihong Link: https://lore.kernel.org/r/20230426070050.1315519-8-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 89d77f71f493a3663b10fa812d17f472935d24be Merge: b23c1376db2db b09313dd2e726 Author: Linus Torvalds Date: Fri Apr 28 16:55:39 2023 -0700 Merge tag 'riscv-for-linus-6.4-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - Support for runtime detection of the Svnapot extension - Support for Zicboz when clearing pages - We've moved to GENERIC_ENTRY - Support for !MMU on rv32 systems - The linear region is now mapped via huge pages - Support for building relocatable kernels - Support for the hwprobe interface - Various fixes and cleanups throughout the tree * tag 'riscv-for-linus-6.4-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (57 commits) RISC-V: hwprobe: Explicity check for -1 in vdso init RISC-V: hwprobe: There can only be one first riscv: Allow to downgrade paging mode from the command line dt-bindings: riscv: add sv57 mmu-type RISC-V: hwprobe: Remove __init on probe_vendor_features() riscv: Use --emit-relocs in order to move .rela.dyn in init riscv: Check relocations at compile time powerpc: Move script to check relocations at compile time in scripts/ riscv: Introduce CONFIG_RELOCATABLE riscv: Move .rela.dyn outside of init to avoid empty relocations riscv: Prepare EFI header for relocatable kernels riscv: Unconditionnally select KASAN_VMALLOC if KASAN riscv: Fix ptdump when KASAN is enabled riscv: Fix EFI stub usage of KASAN instrumented strcmp function riscv: Move DTB_EARLY_BASE_VA to the kernel address space riscv: Rework kasan population functions riscv: Split early and final KASAN population functions riscv: Use PUD/P4D/PGD pages for the linear mapping riscv: Move the linear mapping creation in its own function riscv: Get rid of riscv_pfn_base variable ... commit b23c1376db2dbbf784906bbcc8db81c304fa76a7 Merge: 70cc1b5307e8e 8ab89e9563161 Author: Linus Torvalds Date: Fri Apr 28 16:37:54 2023 -0700 Merge tag 'm68knommu-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: "A couple of minor changes. One to remove the long dead uclinux.org web address and email list from the MAINTAINERS entry for UCLINUX. The other to remove dead config options in the m68knommu Kconfig" * tag 'm68knommu-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: Kconfig.machine: remove obsolete configs ROMBASE and ROMSIZE MAINTAINERS: drop uclinux.org commit 70cc1b5307e8ee3076fdf2ecbeb89eb973aa0ff7 Merge: 5ea8abf589f29 169f8997968ab Author: Linus Torvalds Date: Fri Apr 28 16:24:32 2023 -0700 Merge tag 'powerpc-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Add support for building the kernel using PC-relative addressing on Power10. - Allow HV KVM guests on Power10 to use prefixed instructions. - Unify support for the P2020 CPU (85xx) into a single machine description. - Always build the 64-bit kernel with 128-bit long double. - Drop support for several obsolete 2000's era development boards as identified by Paul Gortmaker. - A series fixing VFIO on Power since some generic changes. - Various other small features and fixes. Thanks to Alexey Kardashevskiy, Andrew Donnellan, Benjamin Gray, Bo Liu, Christophe Leroy, Dan Carpenter, David Binderman, Ira Weiny, Joel Stanley, Kajol Jain, Kautuk Consul, Liang He, Luis Chamberlain, Masahiro Yamada, Michael Neuling, Nathan Chancellor, Nathan Lynch, Nicholas Miehlbradt, Nicholas Piggin, Nick Desaulniers, Nysal Jan K.A, Pali Rohár, Paul Gortmaker, Paul Mackerras, Petr Vaněk, Randy Dunlap, Rob Herring, Sachin Sant, Sean Christopherson, Segher Boessenkool, and Timothy Pearson. * tag 'powerpc-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (156 commits) powerpc/64s: Disable pcrel code model on Clang powerpc: Fix merge conflict between pcrel and copy_thread changes powerpc/configs/powernv: Add IGB=y powerpc/configs/64s: Drop JFS Filesystem powerpc/configs/64s: Use EXT4 to mount EXT2 filesystems powerpc/configs: Make pseries_defconfig an alias for ppc64le_guest powerpc/configs: Make pseries_le an alias for ppc64le_guest powerpc/configs: Incorporate generic kvm_guest.config into guest configs powerpc/configs: Add IBMVETH=y and IBMVNIC=y to guest configs powerpc/configs/64s: Enable Device Mapper options powerpc/configs/64s: Enable PSTORE powerpc/configs/64s: Enable VLAN support powerpc/configs/64s: Enable BLK_DEV_NVME powerpc/configs/64s: Drop REISERFS powerpc/configs/64s: Use SHA512 for module signatures powerpc/configs/64s: Enable IO_STRICT_DEVMEM powerpc/configs/64s: Enable SCHEDSTATS powerpc/configs/64s: Enable DEBUG_VM & other options powerpc/configs/64s: Enable EMULATED_STATS powerpc/configs/64s: Enable KUNIT and most tests ... commit 5ea8abf589f2974d65460a1ffa0c303763e958da Merge: d579c468d7ad6 82253a271aae9 Author: Linus Torvalds Date: Fri Apr 28 16:11:26 2023 -0700 Merge tag 'trace-tools-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt: - Add auto-analysis only option to rtla/timerlat Add an --aa-only option to the tooling to perform only the auto analysis and not to parse and format the data. - Other minor fixes and clean ups * tag 'trace-tools-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla/timerlat: Fix "Previous IRQ" auto analysis' line rtla/timerlat: Add auto-analysis only option rv: Remove redundant assignment to variable retval rv: Fix addition on an uninitialized variable 'run' rtla: Add .gitignore file commit d579c468d7ad6e37f5b4290b0244a9a5a7d3c4bf Merge: f20730efbd305 675751bb20634 Author: Linus Torvalds Date: Fri Apr 28 15:57:53 2023 -0700 Merge tag 'trace-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - User events are finally ready! After lots of collaboration between various parties, we finally locked down on a stable interface for user events that can also work with user space only tracing. This is implemented by telling the kernel (or user space library, but that part is user space only and not part of this patch set), where the variable is that the application uses to know if something is listening to the trace. There's also an interface to tell the kernel about these events, which will show up in the /sys/kernel/tracing/events/user_events/ directory, where it can be enabled. When it's enabled, the kernel will update the variable, to tell the application to start writing to the kernel. See https://lwn.net/Articles/927595/ - Cleaned up the direct trampolines code to simplify arm64 addition of direct trampolines. Direct trampolines use the ftrace interface but instead of jumping to the ftrace trampoline, applications (mostly BPF) can register their own trampoline for performance reasons. - Some updates to the fprobe infrastructure. fprobes are more efficient than kprobes, as it does not need to save all the registers that kprobes on ftrace do. More work needs to be done before the fprobes will be exposed as dynamic events. - More updates to references to the obsolete path of /sys/kernel/debug/tracing for the new /sys/kernel/tracing path. - Add a seq_buf_do_printk() helper to seq_bufs, to print a large buffer line by line instead of all at once. There are users in production kernels that have a large data dump that originally used printk() directly, but the data dump was larger than what printk() allowed as a single print. Using seq_buf() to do the printing fixes that. - Add /sys/kernel/tracing/touched_functions that shows all functions that was every traced by ftrace or a direct trampoline. This is used for debugging issues where a traced function could have caused a crash by a bpf program or live patching. - Add a "fields" option that is similar to "raw" but outputs the fields of the events. It's easier to read by humans. - Some minor fixes and clean ups. * tag 'trace-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (41 commits) ring-buffer: Sync IRQ works before buffer destruction tracing: Add missing spaces in trace_print_hex_seq() ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus recordmcount: Fix memory leaks in the uwrite function tracing/user_events: Limit max fault-in attempts tracing/user_events: Prevent same address and bit per process tracing/user_events: Ensure bit is cleared on unregister tracing/user_events: Ensure write index cannot be negative seq_buf: Add seq_buf_do_printk() helper tracing: Fix print_fields() for __dyn_loc/__rel_loc tracing/user_events: Set event filter_type from type ring-buffer: Clearly check null ptr returned by rb_set_head_page() tracing: Unbreak user events tracing/user_events: Use print_format_fields() for trace output tracing/user_events: Align structs with tabs for readability tracing/user_events: Limit global user_event count tracing/user_events: Charge event allocs to cgroups tracing/user_events: Update documentation for ABI tracing/user_events: Use write ABI in example tracing/user_events: Add ABI self-test ... commit f20730efbd305d42eded761f6fbd9a59d6125228 Merge: 586b222d748e9 5c3124975e15c Author: Linus Torvalds Date: Fri Apr 28 15:03:43 2023 -0700 Merge tag 'smp-core-2023-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP cross-CPU function-call updates from Ingo Molnar: - Remove diagnostics and adjust config for CSD lock diagnostics - Add a generic IPI-sending tracepoint, as currently there's no easy way to instrument IPI origins: it's arch dependent and for some major architectures it's not even consistently available. * tag 'smp-core-2023-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: trace,smp: Trace all smp_function_call*() invocations trace: Add trace_ipi_send_cpu() sched, smp: Trace smp callback causing an IPI smp: reword smp call IPI comment treewide: Trace IPIs sent via smp_send_reschedule() irq_work: Trace self-IPIs sent via arch_irq_work_raise() smp: Trace IPIs sent via arch_send_call_function_ipi_mask() sched, smp: Trace IPIs sent via send_call_function_single_ipi() trace: Add trace_ipi_send_cpumask() kernel/smp: Make csdlock_debug= resettable locking/csd_lock: Remove per-CPU data indirection from CSD lock debugging locking/csd_lock: Remove added data from CSD lock debugging locking/csd_lock: Add Kconfig option for csd_debug default commit 586b222d748e91c619d68e9239654ebc7fed9b0c Merge: 7c339778f9088 f31dcb152a3d0 Author: Linus Torvalds Date: Fri Apr 28 14:53:30 2023 -0700 Merge tag 'sched-core-2023-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: - Allow unprivileged PSI poll()ing - Fix performance regression introduced by mm_cid - Improve livepatch stalls by adding livepatch task switching to cond_resched(). This resolves livepatching busy-loop stalls with certain CPU-bound kthreads - Improve sched_move_task() performance on autogroup configs - On core-scheduling CPUs, avoid selecting throttled tasks to run - Misc cleanups, fixes and improvements * tag 'sched-core-2023-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/clock: Fix local_clock() before sched_clock_init() sched/rt: Fix bad task migration for rt tasks sched: Fix performance regression introduced by mm_cid sched/core: Make sched_dynamic_mutex static sched/psi: Allow unprivileged polling of N*2s period sched/psi: Extract update_triggers side effect sched/psi: Rename existing poll members in preparation sched/psi: Rearrange polling code in preparation sched/fair: Fix inaccurate tally of ttwu_move_affine vhost: Fix livepatch timeouts in vhost_worker() livepatch,sched: Add livepatch task switching to cond_resched() livepatch: Skip task_call_func() for current task livepatch: Convert stack entries array to percpu sched: Interleave cfs bandwidth timers for improved single thread performance at low utilization sched/core: Reduce cost of sched_move_task when config autogroup sched/core: Avoid selecting the task that is throttled to run when core-sched enable sched/topology: Make sched_energy_mutex,update static commit 7c339778f908875772c17f2e04ed731aac772881 Merge: 2aff7c706c748 743767d6f6b8f Author: Linus Torvalds Date: Fri Apr 28 14:41:53 2023 -0700 Merge tag 'perf-core-2023-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Ingo Molnar: - Add Intel Granite Rapids support - Add uncore events for Intel SPR IMC PMU - Fix perf IRQ throttling bug * tag 'perf-core-2023-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Add events for Intel SPR IMC PMU perf/core: Fix hardlockup failure caused by perf throttle perf/x86/cstate: Add Granite Rapids support perf/x86/msr: Add Granite Rapids perf/x86/intel: Add Granite Rapids commit 2aff7c706c7483f4895ca250c92c1d71e45b6e82 Merge: 22b8cc3e78f54 611d4c716db01 Author: Linus Torvalds Date: Fri Apr 28 14:02:54 2023 -0700 Merge tag 'objtool-core-2023-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: - Mark arch_cpu_idle_dead() __noreturn, make all architectures & drivers that did this inconsistently follow this new, common convention, and fix all the fallout that objtool can now detect statically - Fix/improve the ORC unwinder becoming unreliable due to UNWIND_HINT_EMPTY ambiguity, split it into UNWIND_HINT_END_OF_STACK and UNWIND_HINT_UNDEFINED to resolve it - Fix noinstr violations in the KCSAN code and the lkdtm/stackleak code - Generate ORC data for __pfx code - Add more __noreturn annotations to various kernel startup/shutdown and panic functions - Misc improvements & fixes * tag 'objtool-core-2023-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (52 commits) x86/hyperv: Mark hv_ghcb_terminate() as noreturn scsi: message: fusion: Mark mpt_halt_firmware() __noreturn x86/cpu: Mark {hlt,resume}_play_dead() __noreturn btrfs: Mark btrfs_assertfail() __noreturn objtool: Include weak functions in global_noreturns check cpu: Mark nmi_panic_self_stop() __noreturn cpu: Mark panic_smp_self_stop() __noreturn arm64/cpu: Mark cpu_park_loop() and friends __noreturn x86/head: Mark *_start_kernel() __noreturn init: Mark start_kernel() __noreturn init: Mark [arch_call_]rest_init() __noreturn objtool: Generate ORC data for __pfx code x86/linkage: Fix padding for typed functions objtool: Separate prefix code from stack validation code objtool: Remove superfluous dead_end_function() check objtool: Add symbol iteration helpers objtool: Add WARN_INSN() scripts/objdump-func: Support multiple functions context_tracking: Fix KCSAN noinstr violation objtool: Add stackleak instrumentation to uaccess safe list ... commit fbd2a05f29a95d5b42b294bf47e55a711424965b Author: Anna Schumaker Date: Thu Apr 6 15:16:52 2023 -0400 NFSv4.2: Rework scratch handling for READ_PLUS Instead of using a tiny, static scratch buffer, we should use a kmalloc()-ed buffer that is allocated when checking for read plus usage. This lets us use the buffer before decoding any part of the READ_PLUS operation instead of setting it right before segment decoding, meaning it should be a little more robust. Signed-off-by: Anna Schumaker commit ca29699a57ecee6084a4056f5bfd6f11dd359a71 Author: Jianhua Lu Date: Thu Apr 27 20:21:32 2023 +0800 dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi This fixes warning: sm8250-xiaomi-elish-csot.dtb: dsi@ae94000: Unevaluated properties are not allowed ('qcom,master-dsi', 'qcom,sync-dual-dsi' were unexpected) Reviewed-by: Dmitry Baryshkov Acked-by: Rob Herring Signed-off-by: Jianhua Lu Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/534306/ Link: https://lore.kernel.org/r/20230427122132.24840-1-lujianhua000@gmail.com Signed-off-by: Abhinav Kumar commit 25feda6fbd0cfefcb69308fb20d4d4815a107c5e Author: Kees Cook Date: Sat Feb 4 10:43:10 2023 -0800 drm/nouveau/disp: More DP_RECEIVER_CAP_SIZE array fixes More arrays (and arguments) for dcpd were set to 16, when it looks like DP_RECEIVER_CAP_SIZE (15) should be used. Fix the remaining cases, seen with GCC 13: ../drivers/gpu/drm/nouveau/nvif/outp.c: In function 'nvif_outp_acquire_dp': ../include/linux/fortify-string.h:57:33: warning: array subscript 'unsigned char[16][0]' is partly outside array bounds of 'u8[15]' {aka 'unsigned char[15]'} [-Warray-bounds=] 57 | #define __underlying_memcpy __builtin_memcpy | ^ ... ../drivers/gpu/drm/nouveau/nvif/outp.c:140:9: note: in expansion of macro 'memcpy' 140 | memcpy(args.dp.dpcd, dpcd, sizeof(args.dp.dpcd)); | ^~~~~~ ../drivers/gpu/drm/nouveau/nvif/outp.c:130:49: note: object 'dpcd' of size [0, 15] 130 | nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE], | ~~~^~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 813443721331 ("drm/nouveau/disp: move DP link config into acquire") Cc: Ben Skeggs Cc: Lyude Paul Cc: Karol Herbst Cc: David Airlie Cc: Daniel Vetter Cc: Dave Airlie Cc: "Gustavo A. R. Silva" Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20230204184307.never.825-kees@kernel.org commit 8176080d59e6d4ff9fc97ae534063073b4f7a715 Author: Tao Su Date: Fri Apr 28 12:51:49 2023 +0800 block: Skip destroyed blkg when restart in blkg_destroy_all() Kernel hang in blkg_destroy_all() when total blkg greater than BLKG_DESTROY_BATCH_SIZE, because of not removing destroyed blkg in blkg_list. So the size of blkg_list is same after destroying a batch of blkg, and the infinite 'restart' occurs. Since blkg should stay on the queue list until blkg_free_workfn(), skip destroyed blkg when restart a new round, which will solve this kernel hang issue and satisfy the previous will to restart. Reported-by: Xiangfei Ma Tested-by: Xiangfei Ma Tested-by: Farrah Chen Signed-off-by: Tao Su Fixes: f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") Suggested-and-reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20230428045149.1310073-1-tao1.su@linux.intel.com Signed-off-by: Jens Axboe commit 21e26d5e54ab7cfe6b488fd27d4d70956d07e03b Author: Eric Van Hensbergen Date: Wed Apr 26 16:18:49 2023 +0000 fs/9p: Fix bit operation logic error This re-introduces a fix that somehow got dropped during rebase of the current series in for-next. When writeback is enabled, opens are forced to support both read and write operations but with the logic error other flags may be dropped unintentionaly. Reported-by: Christophe Jaillet Signed-off-by: Eric Van Hensbergen commit d4fab7b28e2f5d74790d47a8d298da0abfb5132f Author: Theodore Ts'o Date: Thu Apr 27 23:01:41 2023 -0400 ext4: clean up error handling in __ext4_fill_super() There were two ways to return an error code; one was via setting the 'err' variable, and the second, if err was zero, was via the 'ret' variable. This was both confusing and fragile, and when code was factored out of __ext4_fill_super(), some of the error codes returned by the original code was replaced by -EINVAL, and in one case, the error code was placed by 0, triggering a kernel null pointer dereference. Clean this up by removing the 'ret' variable, leaving only one way to set the error code to be returned, and restore the errno codes that were returned via the the mount system call as they were before we started refactoring __ext4_fill_super(). Signed-off-by: Theodore Ts'o Reviewed-by: Jason Yan commit 3b50d5018ed06a647bb26c44bb5ae74e59c903c7 Author: Theodore Ts'o Date: Thu Apr 27 22:49:34 2023 -0400 ext4: reflect error codes from ext4_multi_mount_protect() to its callers This will allow more fine-grained errno codes to be returned by the mount system call. Cc: Andreas Dilger Signed-off-by: Theodore Ts'o commit d5e72c4e3256335d6fb75c2e321144f93141f4f5 Author: Theodore Ts'o Date: Thu Apr 27 19:18:01 2023 -0400 ext4: fix lost error code reporting in __ext4_fill_super() When code was factored out of __ext4_fill_super() into ext4_percpu_param_init() the error return was discarded. This meant that it was possible for __ext4_fill_super() to return zero, indicating success, without the struct super getting completely filled in, leading to a potential NULL pointer dereference. Reported-by: syzbot+bbf0f9a213c94f283a5c@syzkaller.appspotmail.com Fixes: 1f79467c8a6b ("ext4: factor out ext4_percpu_param_init() ...") Link: https://syzkaller.appspot.com/bug?id=6dac47d5e58af770c0055f680369586ec32e144c Signed-off-by: Theodore Ts'o Reviewed-by: Jason Yan commit 856dd6c5981260b4d1aa84b78373ad54a203db48 Author: Nathan Chancellor Date: Thu Apr 20 09:51:24 2023 -0700 ext4: fix unused iterator variable warnings When CONFIG_QUOTA is disabled, there are warnings around unused iterator variables: fs/ext4/super.c: In function 'ext4_put_super': fs/ext4/super.c:1262:13: error: unused variable 'i' [-Werror=unused-variable] 1262 | int i, err; | ^ fs/ext4/super.c: In function '__ext4_fill_super': fs/ext4/super.c:5200:22: error: unused variable 'i' [-Werror=unused-variable] 5200 | unsigned int i; | ^ cc1: all warnings being treated as errors The kernel has updated to GNU11, allowing the variables to be declared within the for loop. Do so to clear up the warnings. Fixes: dcbf87589d90 ("ext4: factor out ext4_flex_groups_free()") Signed-off-by: Nathan Chancellor Reviewed-by: Geert Uytterhoeven Reviewed-by: Jan Kara Reviewed-by: Jason Yan Link: https://lore.kernel.org/r/20230420-ext4-unused-variables-super-c-v1-1-138b6db6c21c@kernel.org Signed-off-by: Theodore Ts'o commit 835659598c67907b98cd2aa57bb951dfaf675c69 Author: Ye Bin Date: Thu Apr 6 11:16:27 2023 +0000 ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline Syzbot found the following issue: loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] BUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 Read of size 4 at addr ffff888073644750 by task syz-executor420/5067 CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809 ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline] ext4_da_map_blocks fs/ext4/inode.c:1806 [inline] ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870 ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098 ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082 generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285 ext4_file_write_iter+0x1d0/0x18f0 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f4b7a9737b9 RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9 RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004 RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Above issue is happens when enable bigalloc and inline data feature. As commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for bigalloc + inline. But it only resolved issue when has inline data, if inline data has been converted to extent(ext4_da_convert_inline_data_to_extent) before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However i_data is still store inline data in this scene. Then will trigger UAF when find extent. To resolve above issue, there is need to add judge "ext4_has_inline_data(inode)" in ext4_clu_mapped(). Fixes: 131294c35ed6 ("ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline") Reported-by: syzbot+bf4bb7731ef73b83a3b4@syzkaller.appspotmail.com Reviewed-by: Jan Kara Reviewed-by: Ye Bin Reviewed-by: Tudor Ambarus Tested-by: Tudor Ambarus Link: https://lore.kernel.org/r/20230406111627.1916759-1-tudor.ambarus@linaro.org Signed-off-by: Theodore Ts'o commit 22b8cc3e78f5448b4c5df00303817a9137cd663f Merge: 7b664cc38ea7b 97740266de26e Author: Linus Torvalds Date: Fri Apr 28 09:43:49 2023 -0700 Merge tag 'x86_mm_for_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 LAM (Linear Address Masking) support from Dave Hansen: "Add support for the new Linear Address Masking CPU feature. This is similar to ARM's Top Byte Ignore and allows userspace to store metadata in some bits of pointers without masking it out before use" * tag 'x86_mm_for_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm/iommu/sva: Do not allow to set FORCE_TAGGED_SVA bit from outside x86/mm/iommu/sva: Fix error code for LAM enabling failure due to SVA selftests/x86/lam: Add test cases for LAM vs thread creation selftests/x86/lam: Add ARCH_FORCE_TAGGED_SVA test cases for linear-address masking selftests/x86/lam: Add inherit test cases for linear-address masking selftests/x86/lam: Add io_uring test cases for linear-address masking selftests/x86/lam: Add mmap and SYSCALL test cases for linear-address masking selftests/x86/lam: Add malloc and tag-bits test cases for linear-address masking x86/mm/iommu/sva: Make LAM and SVA mutually exclusive iommu/sva: Replace pasid_valid() helper with mm_valid_pasid() mm: Expose untagging mask in /proc/$PID/status x86/mm: Provide arch_prctl() interface for LAM x86/mm: Reduce untagged_addr() overhead for systems without LAM x86/uaccess: Provide untagged_addr() and remove tags before address check mm: Introduce untagged_addr_remote() x86/mm: Handle LAM on context switch x86: CPUID and CR3/CR4 flags for Linear Address Masking x86: Allow atomic MM_CONTEXT flags setting x86/mm: Rework address range check in get_user() and put_user() commit 3e46c89c74f2c38e5337d2cf44b0b551adff1cb4 Author: Maxim Korotkov Date: Thu Jan 19 13:44:43 2023 +0300 writeback: fix call of incorrect macro the variable 'history' is of type u16, it may be an error that the hweight32 macro was used for it I guess macro hweight16 should be used Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 2a81490811d0 ("writeback: implement foreign cgroup inode detection") Signed-off-by: Maxim Korotkov Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230119104443.3002-1-korotkov.maxim.s@gmail.com Signed-off-by: Jens Axboe commit f40c153afee1e50ed46c2dc22e09940e21699acf Merge: 952aa344bf430 b1211978ecf19 Author: Jens Axboe Date: Fri Apr 28 10:36:27 2023 -0600 Merge tag 'md-next-2023-04-28' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into for-6.4/block Pull MD fixes from Song: "1. Improve raid5 sequential IO performance on spinning disks, which fixes a regression since v6.0, by Jan Kara. 2. Fix bitmap offset types, which fixes an issue introduced in this merge window, by Jonathan Derrick." * tag 'md-next-2023-04-28' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: Fix bitmap offset type in sb writer md/raid5: Improve performance for sequential IO commit 7b664cc38ea7bdd5e3ce018bba98583741921bd4 Merge: e54debe657109 7a3a401874bea Author: Linus Torvalds Date: Fri Apr 28 09:36:09 2023 -0700 Merge tag 'x86_tdx_for_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 tdx update from Dave Hansen: "The original tdx hypercall assembly code took two flags in %RSI to tweak its behavior at runtime. PeterZ recently axed one flag in commit e80a48bade61 ("x86/tdx: Remove TDX_HCALL_ISSUE_STI"). Kill the other flag too and tweak the 'output' mode with an assembly macro instead. This results in elimination of one push/pop pair and overall easier to read assembly. - Do conditional __tdx_hypercall() 'output' processing via an assembly macro argument rather than a runtime register" * tag 'x86_tdx_for_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tdx: Drop flags from __tdx_hypercall() commit e54debe657109f1728312f9cb5ccae6f737b7dd1 Merge: 4980c176a7170 5fbff26075575 Author: Linus Torvalds Date: Fri Apr 28 09:32:34 2023 -0700 Merge tag 'x86_fpu_for_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fpu updates from Dave Hansen: "There's no _actual_ kernel functionality here. This expands the documentation around AMX support including some code examples. The example code also exposed the fact that hardware architecture constants as part of the ABI, but there's no easy place that they get defined for apps. Adding them to a uabi header will eventually make life easier for consumers of the ABI. Summary: - Improve AMX documentation along with example code - Explicitly make some hardware constants part of the uabi" * tag 'x86_fpu_for_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation/x86: Explain the state component permission for guests Documentation/x86: Add the AMX enabling example x86/arch_prctl: Add AMX feature numbers as ABI constants Documentation/x86: Explain the purpose for dynamic features commit 4980c176a71706f3621d5c1674266de54a689cb1 Merge: 682f7bbad29c0 322b72e0fd101 Author: Linus Torvalds Date: Fri Apr 28 09:30:51 2023 -0700 Merge tag 'x86_cache_for_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resctrl update from Dave Hansen: "Reduce redundant counter reads with resctrl refactoring" * tag 'x86_cache_for_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Avoid redundant counter read in __mon_event_count() commit 682f7bbad29c0e5f59929ad69e1ed8525feb96d3 Merge: 33afd4b763936 5462ade6871e9 Author: Linus Torvalds Date: Fri Apr 28 09:22:30 2023 -0700 Merge tag 'x86_cleanups_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: - Unify duplicated __pa() and __va() definitions - Simplify sysctl tables registration - Remove unused symbols - Correct function name in comment * tag 'x86_cleanups_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Centralize __pa()/__va() definitions x86: Simplify one-level sysctl registration for itmt_kern_table x86: Simplify one-level sysctl registration for abi_table2 x86/platform/intel-mid: Remove unused definitions from intel-mid.h x86/uaccess: Remove memcpy_page_flushcache() x86/entry: Change stale function name in comment to error_return() commit b1211978ecf19bceb63a04f53fea4b5d73832a4a Author: Jonathan Derrick Date: Mon Apr 24 19:14:38 2023 -0600 md: Fix bitmap offset type in sb writer Bitmap offset is allowed to be negative, indicating that bitmap precedes metadata. Change the type back from sector_t to loff_t to satisfy conditionals and calculations. Reported-by: Dan Carpenter Link: https://lore.kernel.org/linux-raid/CAPhsuW6HuaUJ5WcyPajVgUfkQFYp2D_cy1g6qxN4CU_gP2=z7g@mail.gmail.com/ Fixes: 10172f200b67 ("md: Fix types in sb writer") Signed-off-by: Jonathan Derrick Suggested-by: Yu Kuai Reviewed-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230425011438.71046-1-jonathan.derrick@linux.dev commit fc05e06e6098ca2c28f7a10da0e00aeea20fa59e Author: Jan Kara Date: Mon Apr 17 19:15:37 2023 +0200 md/raid5: Improve performance for sequential IO Commit 7e55c60acfbb ("md/raid5: Pivot raid5_make_request()") changed the order in which requests for underlying disks are created. Since for large sequential IO adding of requests frequently races with md_raid5 thread submitting bios to underlying disks, this results in a change in IO pattern because intermediate states of new order of request creation result in more smaller discontiguous requests. For RAID5 on top of three rotational disks our performance testing revealed this results in regression in write throughput: iozone -a -s 131072000 -y 4 -q 8 -i 0 -i 1 -R before 7e55c60acfbb: KB reclen write rewrite read reread 131072000 4 493670 525964 524575 513384 131072000 8 540467 532880 512028 513703 after 7e55c60acfbb: KB reclen write rewrite read reread 131072000 4 421785 456184 531278 509248 131072000 8 459283 456354 528449 543834 To reduce the amount of discontiguous requests we can start generating requests with the stripe with the lowest chunk offset as that has the best chance of being adjacent to IO queued previously. This improves the performance to: KB reclen write rewrite read reread 131072000 4 497682 506317 518043 514559 131072000 8 514048 501886 506453 504319 restoring big part of the regression. Fixes: 7e55c60acfbb ("md/raid5: Pivot raid5_make_request()") Cc: stable@vger.kernel.org # v6.0+ Signed-off-by: Jan Kara Reviewed-by: Logan Gunthorpe Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230417171537.17899-1-jack@suse.cz commit 6d2ed653185baa5ba601306cbd6cd7192642045d Author: Randy Dunlap Date: Thu Apr 27 20:09:16 2023 -0700 lsm: move hook comments docs to security/security.c Fix one kernel-doc warning, but invesigating that led to other kernel-doc movement (lsm_hooks.h to security.c) that needs to be fixed also. include/linux/lsm_hooks.h:1: warning: no structured comments found Fixes: e261301c851a ("lsm: move the remaining LSM hook comments to security/security.c") Fixes: 1cd2aca64a5d ("lsm: move the io_uring hook comments to security/security.c") Fixes: 452b670c7222 ("lsm: move the perf hook comments to security/security.c") Fixes: 55e853201a9e ("lsm: move the bpf hook comments to security/security.c") Fixes: b14faf9c94a6 ("lsm: move the audit hook comments to security/security.c") Fixes: 1427ddbe5cc1 ("lsm: move the binder hook comments to security/security.c") Fixes: 43fad2821876 ("lsm: move the sysv hook comments to security/security.c") Fixes: ecc419a44535 ("lsm: move the key hook comments to security/security.c") Fixes: 742b99456e86 ("lsm: move the xfrm hook comments to security/security.c") Fixes: ac318aed5498 ("lsm: move the Infiniband hook comments to security/security.c") Fixes: 4a49f592e931 ("lsm: move the SCTP hook comments to security/security.c") Fixes: 6b6bbe8c02a1 ("lsm: move the socket hook comments to security/security.c") Fixes: 2c2442fd46cd ("lsm: move the AF_UNIX hook comments to security/security.c") Fixes: 2bcf51bf2f03 ("lsm: move the netlink hook comments to security/security.c") Fixes: 130c53bfee4b ("lsm: move the task hook comments to security/security.c") Fixes: a0fd6480de48 ("lsm: move the file hook comments to security/security.c") Fixes: 9348944b775d ("lsm: move the kernfs hook comments to security/security.c") Fixes: 916e32584dfa ("lsm: move the inode hook comments to security/security.c") Fixes: 08526a902cc4 ("lsm: move the filesystem hook comments to security/security.c") Fixes: 36819f185590 ("lsm: move the fs_context hook comments to security/security.c") Fixes: 1661372c912d ("lsm: move the program execution hook comments to security/security.c") Signed-off-by: Randy Dunlap Cc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.org Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Cc: KP Singh Cc: bpf@vger.kernel.org Signed-off-by: Paul Moore commit 631003e2333c12cc1b52df06a707365b7363a159 Author: Naohiro Aota Date: Tue Apr 18 17:45:24 2023 +0900 btrfs: zoned: fix wrong use of bitops API in btrfs_ensure_empty_zones find_next_bit and find_next_zero_bit take @size as the second parameter and @offset as the third parameter. They are specified opposite in btrfs_ensure_empty_zones(). Thanks to the later loop, it never failed to detect the empty zones. Fix them and (maybe) return the result a bit faster. Note: the naming is a bit confusing, size has two meanings here, bitmap and our range size. Fixes: 1cd6121f2a38 ("btrfs: zoned: implement zoned chunk allocator") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 1dedde690303c05ef732b7c5c8356fdf60a4ade3 Author: Zhihao Cheng Date: Tue Mar 21 09:37:21 2023 +0800 ext4: fix i_disksize exceeding i_size problem in paritally written case It is possible for i_disksize can exceed i_size, triggering a warning. generic_perform_write copied = iov_iter_copy_from_user_atomic(len) // copied < len ext4_da_write_end | ext4_update_i_disksize | new_i_size = pos + copied; | WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize | generic_write_end | copied = block_write_end(copied, len) // copied = 0 | if (unlikely(copied < len)) | if (!PageUptodate(page)) | copied = 0; | if (pos + copied > inode->i_size) // return false if (unlikely(copied == 0)) goto again; if (unlikely(iov_iter_fault_in_readable(i, bytes))) { status = -EFAULT; break; } We get i_disksize greater than i_size here, which could trigger WARNING check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio: ext4_dio_write_iter iomap_dio_rw __iomap_dio_rw // return err, length is not aligned to 512 ext4_handle_inode_extension WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2 RIP: 0010:ext4_file_write_iter+0xbc7 Call Trace: vfs_write+0x3b1 ksys_write+0x77 do_syscall_64+0x39 Fix it by updating 'copied' value before updating i_disksize just like ext4_write_inline_data_end() does. A reproducer can be found in the buganizer link below. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217209 Fixes: 64769240bd07 ("ext4: Add delayed allocation support in data=writeback mode") Signed-off-by: Zhihao Cheng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230321013721.89818-1-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 64b5d5b2852661284ccbb038c697562cc56231bf Author: Qu Wenruo Date: Thu Apr 27 09:45:32 2023 +0800 btrfs: properly reject clear_cache and v1 cache for block-group-tree [BUG] With block-group-tree feature enabled, mounting it with clear_cache would cause the following transaction abort at mount or remount: BTRFS info (device dm-4): force clearing of disk cache BTRFS info (device dm-4): using free space tree BTRFS info (device dm-4): auto enabling async discard BTRFS info (device dm-4): clearing free space tree BTRFS info (device dm-4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) BTRFS info (device dm-4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) BTRFS error (device dm-4): block-group-tree feature requires fres-space-tree and no-holes BTRFS error (device dm-4): super block corruption detected before writing it to disk BTRFS: error (device dm-4) in write_all_supers:4288: errno=-117 Filesystem corrupted (unexpected superblock corruption detected) BTRFS warning (device dm-4: state E): Skipping commit of aborted transaction. [CAUSE] For block-group-tree feature, we have an artificial dependency on free-space-tree. This means if we detect block-group-tree without v2 cache, we consider it a corruption and cause the problem. For clear_cache mount option, it would temporary disable v2 cache, then re-enable it. But unfortunately for that temporary v2 cache disabled status, we refuse to write a superblock with bg tree only flag, thus leads to the above transaction abortion. [FIX] For now, just reject clear_cache and v1 cache mount option for block group tree. So now we got a graceful rejection other than a transaction abort: BTRFS info (device dm-4): force clearing of disk cache BTRFS error (device dm-4): cannot disable free space tree with block-group-tree feature BTRFS error (device dm-4): open_ctree failed CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit a2cea677db6099d71c9f70de7f907d3d7e6bec3b Author: Filipe Manana Date: Wed Apr 26 11:51:36 2023 +0100 btrfs: print extent buffers when sibling keys check fails When trying to move keys from one node/leaf to another sibling node/leaf, if the sibling keys check fails we just print an error message with the last key of the left sibling and the first key of the right sibling. However it's also useful to print all the keys of each sibling, as it may provide some clues to what went wrong, which code path may be inserting keys in an incorrect order. So just do that, print the siblings with btrfs_print_tree(), as it works for both leaves and nodes. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9ae5afd02a03d4e22a17a9609b19400b77c36273 Author: Filipe Manana Date: Wed Apr 26 11:51:35 2023 +0100 btrfs: abort transaction when sibling keys check fails for leaves If the sibling keys check fails before we move keys from one sibling leaf to another, we are not aborting the transaction - we leave that to some higher level caller of btrfs_search_slot() (or anything else that uses it to insert items into a b+tree). This means that the transaction abort will provide a stack trace that omits the b+tree modification call chain. So change this to immediately abort the transaction and therefore get a more useful stack trace that shows us the call chain in the bt+tree modification code. It's also important to immediately abort the transaction just in case some higher level caller is not doing it, as this indicates a very serious corruption and we should stop the possibility of doing further damage. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 611ccc58e1f2ccd4a85258a646d5f9b4d5b1b4f6 Author: Filipe Manana Date: Wed Apr 26 18:13:00 2023 +0100 btrfs: fix leak of source device allocation state after device replace When a device replace finishes, the source device is freed by calling btrfs_free_device() at btrfs_rm_dev_replace_free_srcdev(), but the allocation state, tracked in the device's alloc_state io tree, is never freed. This is a regression recently introduced by commit f0bb5474cff0 ("btrfs: remove redundant release of btrfs_device::alloc_state"), which removed a call to extent_io_tree_release() from btrfs_free_device(), with the rationale that btrfs_close_one_device() already releases the allocation state from a device and btrfs_close_one_device() is always called before a device is freed with btrfs_free_device(). However that is not true for the device replace case, as btrfs_free_device() is called without any previous call to btrfs_close_one_device(). The issue is trivial to reproduce, for example, by running test btrfs/027 from fstests: $ ./check btrfs/027 $ rmmod btrfs $ dmesg (...) [84519.395485] BTRFS info (device sdc): dev_replace from (devid 2) to /dev/sdg started [84519.466224] BTRFS info (device sdc): dev_replace from (devid 2) to /dev/sdg finished [84519.552251] BTRFS info (device sdc): scrub: started on devid 1 [84519.552277] BTRFS info (device sdc): scrub: started on devid 2 [84519.552332] BTRFS info (device sdc): scrub: started on devid 3 [84519.552705] BTRFS info (device sdc): scrub: started on devid 4 [84519.604261] BTRFS info (device sdc): scrub: finished on devid 4 with status: 0 [84519.609374] BTRFS info (device sdc): scrub: finished on devid 3 with status: 0 [84519.610818] BTRFS info (device sdc): scrub: finished on devid 1 with status: 0 [84519.610927] BTRFS info (device sdc): scrub: finished on devid 2 with status: 0 [84559.503795] BTRFS: state leak: start 1048576 end 1351614463 state 1 in tree 1 refs 1 [84559.506764] BTRFS: state leak: start 1048576 end 1347420159 state 1 in tree 1 refs 1 [84559.510294] BTRFS: state leak: start 1048576 end 1351614463 state 1 in tree 1 refs 1 So fix this by adding back the call to extent_io_tree_release() at btrfs_free_device(). Fixes: f0bb5474cff0 ("btrfs: remove redundant release of btrfs_device::alloc_state") Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit ac868bc9d136cde6e3eb5de77019a63d57a540ff Author: xiaoshoukui Date: Thu Apr 13 05:55:07 2023 -0400 btrfs: fix assertion of exclop condition when starting balance Balance as exclusive state is compatible with paused balance and device add, which makes some things more complicated. The assertion of valid states when starting from paused balance needs to take into account two more states, the combinations can be hit when there are several threads racing to start balance and device add. This won't typically happen when the commands are started from command line. Scenario 1: With exclusive_operation state == BTRFS_EXCLOP_NONE. Concurrently adding multiple devices to the same mount point and btrfs_exclop_finish executed finishes before assertion in btrfs_exclop_balance, exclusive_operation will changed to BTRFS_EXCLOP_NONE state which lead to assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE || fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD, in fs/btrfs/ioctl.c:456 Call Trace: btrfs_exclop_balance+0x13c/0x310 ? memdup_user+0xab/0xc0 ? PTR_ERR+0x17/0x20 btrfs_ioctl_add_dev+0x2ee/0x320 btrfs_ioctl+0x9d5/0x10d0 ? btrfs_ioctl_encoded_write+0xb80/0xb80 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x3c/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Scenario 2: With exclusive_operation state == BTRFS_EXCLOP_BALANCE_PAUSED. Concurrently adding multiple devices to the same mount point and btrfs_exclop_balance executed finish before the latter thread execute assertion in btrfs_exclop_balance, exclusive_operation will changed to BTRFS_EXCLOP_BALANCE_PAUSED state which lead to assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE || fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD || fs_info->exclusive_operation == BTRFS_EXCLOP_NONE, fs/btrfs/ioctl.c:458 Call Trace: btrfs_exclop_balance+0x240/0x410 ? memdup_user+0xab/0xc0 ? PTR_ERR+0x17/0x20 btrfs_ioctl_add_dev+0x2ee/0x320 btrfs_ioctl+0x9d5/0x10d0 ? btrfs_ioctl_encoded_write+0xb80/0xb80 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x3c/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd An example of the failed assertion is below, which shows that the paused balance is also needed to be checked. root@syzkaller:/home/xsk# ./repro Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 [ 416.611428][ T7970] BTRFS info (device loop0): fs_info exclusive_operation: 0 Failed to add device /dev/vda, errno 14 [ 416.613973][ T7971] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.615456][ T7972] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.617528][ T7973] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.618359][ T7974] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.622589][ T7975] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.624034][ T7976] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.626420][ T7977] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.627643][ T7978] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.629006][ T7979] BTRFS info (device loop0): fs_info exclusive_operation: 3 [ 416.630298][ T7980] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 Failed to add device /dev/vda, errno 14 [ 416.632787][ T7981] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.634282][ T7982] BTRFS info (device loop0): fs_info exclusive_operation: 3 Failed to add device /dev/vda, errno 14 [ 416.636202][ T7983] BTRFS info (device loop0): fs_info exclusive_operation: 3 [ 416.637012][ T7984] BTRFS info (device loop0): fs_info exclusive_operation: 1 Failed to add device /dev/vda, errno 14 [ 416.637759][ T7984] assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE || fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD || fs_info->exclusive_operation == BTRFS_EXCLOP_NONE, in fs/btrfs/ioctl.c:458 [ 416.639845][ T7984] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 416.640485][ T7984] CPU: 0 PID: 7984 Comm: repro Not tainted 6.2.0 #7 [ 416.641172][ T7984] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 416.642090][ T7984] RIP: 0010:btrfs_assertfail+0x2c/0x2e [ 416.644423][ T7984] RSP: 0018:ffffc90003ea7e28 EFLAGS: 00010282 [ 416.645018][ T7984] RAX: 00000000000000cc RBX: 0000000000000000 RCX: 0000000000000000 [ 416.645763][ T7984] RDX: ffff88801d030000 RSI: ffffffff81637e7c RDI: fffff520007d4fb7 [ 416.646554][ T7984] RBP: ffffffff8a533de0 R08: 00000000000000cc R09: 0000000000000000 [ 416.647299][ T7984] R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8a533da0 [ 416.648041][ T7984] R13: 00000000000001ca R14: 000000005000940a R15: 0000000000000000 [ 416.648785][ T7984] FS: 00007fa2985d4640(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000 [ 416.649616][ T7984] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 416.650238][ T7984] CR2: 0000000000000000 CR3: 0000000018e5e000 CR4: 0000000000750ef0 [ 416.650980][ T7984] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 416.651725][ T7984] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 416.652502][ T7984] PKRU: 55555554 [ 416.652888][ T7984] Call Trace: [ 416.653241][ T7984] [ 416.653527][ T7984] btrfs_exclop_balance+0x240/0x410 [ 416.654036][ T7984] ? memdup_user+0xab/0xc0 [ 416.654465][ T7984] ? PTR_ERR+0x17/0x20 [ 416.654874][ T7984] btrfs_ioctl_add_dev+0x2ee/0x320 [ 416.655380][ T7984] btrfs_ioctl+0x9d5/0x10d0 [ 416.655822][ T7984] ? btrfs_ioctl_encoded_write+0xb80/0xb80 [ 416.656400][ T7984] __x64_sys_ioctl+0x197/0x210 [ 416.656874][ T7984] do_syscall_64+0x3c/0xb0 [ 416.657346][ T7984] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 416.657922][ T7984] RIP: 0033:0x4546af [ 416.660170][ T7984] RSP: 002b:00007fa2985d4150 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 416.660972][ T7984] RAX: ffffffffffffffda RBX: 00007fa2985d4640 RCX: 00000000004546af [ 416.661714][ T7984] RDX: 0000000000000000 RSI: 000000005000940a RDI: 0000000000000003 [ 416.662449][ T7984] RBP: 00007fa2985d41d0 R08: 0000000000000000 R09: 00007ffee37a4c4f [ 416.663195][ T7984] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa2985d4640 [ 416.663951][ T7984] R13: 0000000000000009 R14: 000000000041b320 R15: 00007fa297dd4000 [ 416.664703][ T7984] [ 416.665040][ T7984] Modules linked in: [ 416.665590][ T7984] ---[ end trace 0000000000000000 ]--- [ 416.666176][ T7984] RIP: 0010:btrfs_assertfail+0x2c/0x2e [ 416.668775][ T7984] RSP: 0018:ffffc90003ea7e28 EFLAGS: 00010282 [ 416.669425][ T7984] RAX: 00000000000000cc RBX: 0000000000000000 RCX: 0000000000000000 [ 416.670235][ T7984] RDX: ffff88801d030000 RSI: ffffffff81637e7c RDI: fffff520007d4fb7 [ 416.671050][ T7984] RBP: ffffffff8a533de0 R08: 00000000000000cc R09: 0000000000000000 [ 416.671867][ T7984] R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8a533da0 [ 416.672685][ T7984] R13: 00000000000001ca R14: 000000005000940a R15: 0000000000000000 [ 416.673501][ T7984] FS: 00007fa2985d4640(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000 [ 416.674425][ T7984] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 416.675114][ T7984] CR2: 0000000000000000 CR3: 0000000018e5e000 CR4: 0000000000750ef0 [ 416.675933][ T7984] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 416.676760][ T7984] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Link: https://lore.kernel.org/linux-btrfs/20230324031611.98986-1-xiaoshoukui@gmail.com/ CC: stable@vger.kernel.org # 6.1+ Signed-off-by: xiaoshoukui Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f932d4ef007d6a4ae03badcb749fbb8f49196f6 Author: Filipe Manana Date: Wed Apr 12 11:33:09 2023 +0100 btrfs: fix btrfs_prev_leaf() to not return the same key twice A call to btrfs_prev_leaf() may end up returning a path that points to the same item (key) again. This happens if while btrfs_prev_leaf(), after we release the path, a concurrent insertion happens, which moves items off from a sibling into the front of the previous leaf, and an item with the computed previous key does not exists. For example, suppose we have the two following leaves: Leaf A ------------------------------------------------------------- | ... key (300 96 10) key (300 96 15) key (300 96 16) | ------------------------------------------------------------- slot 20 slot 21 slot 22 Leaf B ------------------------------------------------------------- | key (300 96 20) key (300 96 21) key (300 96 22) ... | ------------------------------------------------------------- slot 0 slot 1 slot 2 If we call btrfs_prev_leaf(), from btrfs_previous_item() for example, with a path pointing to leaf B and slot 0 and the following happens: 1) At btrfs_prev_leaf() we compute the previous key to search as: (300 96 19), which is a key that does not exists in the tree; 2) Then we call btrfs_release_path() at btrfs_prev_leaf(); 3) Some other task inserts a key at leaf A, that sorts before the key at slot 20, for example it has an objectid of 299. In order to make room for the new key, the key at slot 22 is moved to the front of leaf B. This happens at push_leaf_right(), called from split_leaf(). After this leaf B now looks like: -------------------------------------------------------------------------------- | key (300 96 16) key (300 96 20) key (300 96 21) key (300 96 22) ... | -------------------------------------------------------------------------------- slot 0 slot 1 slot 2 slot 3 4) At btrfs_prev_leaf() we call btrfs_search_slot() for the computed previous key: (300 96 19). Since the key does not exists, btrfs_search_slot() returns 1 and with a path pointing to leaf B and slot 1, the item with key (300 96 20); 5) This makes btrfs_prev_leaf() return a path that points to slot 1 of leaf B, the same key as before it was called, since the key at slot 0 of leaf B (300 96 16) is less than the computed previous key, which is (300 96 19); 6) As a consequence btrfs_previous_item() returns a path that points again to the item with key (300 96 20). For some users of btrfs_prev_leaf() or btrfs_previous_item() this may not be functional a problem, despite not making sense to return a new path pointing again to the same item/key. However for a caller such as tree-log.c:log_dir_items(), this has a bad consequence, as it can result in not logging some dir index deletions in case the directory is being logged without holding the inode's VFS lock (logging triggered while logging a child inode for example) - for the example scenario above, in case the dir index keys 17, 18 and 19 were deleted in the current transaction. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 0c8862de05c1a087795ee0a87bf61a6394306cc0 Author: Jarkko Sakkinen Date: Wed Apr 26 21:49:37 2023 +0300 tpm: Re-enable TPM chip boostrapping non-tpm_tis TPM drivers TPM chip bootstrapping was removed from tpm_chip_register(), and it was relocated to tpm_tis_core. This breaks all drivers which are not based on tpm_tis because the chip will not get properly initialized. Take the corrective steps: 1. Rename tpm_chip_startup() as tpm_chip_bootstrap() and make it one-shot. 2. Call tpm_chip_bootstrap() in tpm_chip_register(), which reverts the things as tehy used to be. Cc: Lino Sanfilippo Fixes: 548eb516ec0f ("tpm, tpm_tis: startup chip before testing for interrupts") Reported-by: Pengfei Xu Link: https://lore.kernel.org/all/ZEjqhwHWBnxcaRV5@xpf.sh.intel.com/ Tested-by: Pengfei Xu Signed-off-by: Jarkko Sakkinen commit 4140aafcff167b5b9e8dae6a1709a6de7cac6f74 Author: Olivier Bacon Date: Thu Apr 20 11:00:35 2023 -0400 crypto: engine - fix crypto_queue backlog handling CRYPTO_TFM_REQ_MAY_BACKLOG tells the crypto driver that it should internally backlog requests until the crypto hw's queue becomes full. At that point, crypto_engine backlogs the request and returns -EBUSY. Calling driver such as dm-crypt then waits until the complete() function is called with a status of -EINPROGRESS before sending a new request. The problem lies in the call to complete() with a value of -EINPROGRESS that is made when a backlog item is present on the queue. The call is done before the successful execution of the crypto request. In the case that do_one_request() returns < 0 and the retry support is available, the request is put back in the queue. This leads upper drivers to send a new request even if the queue is still full. The problem can be reproduced by doing a large dd into a crypto dm-crypt device. This is pretty easy to see when using Freescale CAAM crypto driver and SWIOTLB dma. Since the actual amount of requests that can be hold in the queue is unlimited we get IOs error and dma allocation. The fix is to call complete with a value of -EINPROGRESS only if the request is not enqueued back in crypto_queue. This is done by calling complete() later in the code. In order to delay the decision, crypto_queue is modified to correctly set the backlog pointer when a request is enqueued back. Fixes: 6a89f492f8e5 ("crypto: engine - support for parallel requests based on retry mechanism") Co-developed-by: Sylvain Ouellet Signed-off-by: Sylvain Ouellet Signed-off-by: Olivier Bacon Signed-off-by: Herbert Xu commit 8fd91151ebcb21b3f2f2bf158ac6092192550b2b Author: Christophe JAILLET Date: Mon Apr 17 22:25:09 2023 +0200 crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs() SS_ENCRYPTION is (0 << 7 = 0), so the test can never be true. Use a direct comparison to SS_ENCRYPTION instead. The same king of test is already done the same way in sun8i_ss_run_task(). Fixes: 359e893e8af4 ("crypto: sun8i-ss - rework handling of IV") Signed-off-by: Christophe JAILLET Signed-off-by: Herbert Xu commit 9d2f38638a145f0c6102bee6533204aa3e5a9c07 Author: Oswald Buddenhagen Date: Fri Apr 28 10:07:32 2023 +0200 ALSA: emu10k1: use more existing defines instead of open-coded numbers Using the *_MASK defines for "maximal value" is debatable. I got the idea from FreeBSD, and it sorta makes sense to me. Some hunks look a bit incomplete, because code that is going to be subsequently removed is not touched here. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230428080732.1697695-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 6686317855c6997671982d4489ccdd946f644957 Author: Angelo Dureghello Date: Wed Apr 26 22:28:15 2023 +0200 net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu Add rsvd2cpu capability for mv88e6321 model, to allow proper bpdu processing. Signed-off-by: Angelo Dureghello Fixes: 51c901a775621 ("net: dsa: mv88e6xxx: distinguish Global 2 Rsvd2CPU") Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit dc6456e938e938d64ffb6383a286b2ac9790a37f Author: Antoine Tenart Date: Thu Apr 27 11:21:59 2023 +0200 net: ipv6: fix skb hash for some RST packets The skb hash comes from sk->sk_txhash when using TCP, except for some IPv6 RST packets. This is because in tcp_v6_send_reset when not in TIME_WAIT the hash is taken from sk->sk_hash, while it should come from sk->sk_txhash as those two hashes are not computed the same way. Packetdrill script to test the above, 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 +0 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress) +0 > (flowlabel 0x1) S 0:0(0) <...> // Wrong ack seq, trigger a rst. +0 < S. 0:0(0) ack 0 win 4000 // Check the flowlabel matches prior one from SYN. +0 > (flowlabel 0x1) R 0:0(0) <...> Fixes: 9258b8b1be2e ("ipv6: tcp: send consistent autoflowlabel in RST packets") Signed-off-by: Antoine Tenart Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 46ef24c60f8ee70662968ac55325297ed4624d61 Author: Andrea Mayer Date: Thu Apr 27 11:49:23 2023 +0200 selftests: srv6: make srv6_end_dt46_l3vpn_test more robust On some distributions, the rp_filter is automatically set (=1) by default on a netdev basis (also on VRFs). In an SRv6 End.DT46 behavior, decapsulated IPv4 packets are routed using the table associated with the VRF bound to that tunnel. During lookup operations, the rp_filter can lead to packet loss when activated on the VRF. Therefore, we chose to make this selftest more robust by explicitly disabling the rp_filter during tests (as it is automatically set by some Linux distributions). Fixes: 03a0b567a03d ("selftests: seg6: add selftest for SRv6 End.DT46 Behavior") Reported-by: Hangbin Liu Signed-off-by: Andrea Mayer Tested-by: Hangbin Liu Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 042334a8d424a1917e916e611a8dda7f8caf1491 Author: wuych Date: Thu Apr 27 18:25:31 2023 +0800 atlantic:hw_atl2:hw_atl2_utils_fw: Remove unnecessary (void*) conversions Pointer variables of void * type do not require type cast. Signed-off-by: wuych Signed-off-by: David S. Miller commit c88f8d5cd95fd039cff95d682b8e71100c001df0 Author: Cong Wang Date: Wed Apr 26 23:00:06 2023 -0700 sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() When a tunnel device is bound with the underlying device, its dev->needed_headroom needs to be updated properly. IPv4 tunnels already do the same in ip_tunnel_bind_dev(). Otherwise we may not have enough header room for skb, especially after commit b17f709a2401 ("gue: TX support for using remote checksum offload option"). Fixes: 32b8a8e59c9c ("sit: add IPv4 over IPv4 support") Reported-by: Palash Oswal Link: https://lore.kernel.org/netdev/CAGyP=7fDcSPKu6nttbGwt7RXzE3uyYxLjCSE97J64pRxJP8jPA@mail.gmail.com/ Cc: Kuniyuki Iwashima Cc: Eric Dumazet Signed-off-by: Cong Wang Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit da94a7781fc3c92e7df7832bc2746f4d39bc624e Author: Vlad Buslov Date: Wed Apr 26 14:31:11 2023 +0200 net/sched: cls_api: remove block_cb from driver_list before freeing Error handler of tcf_block_bind() frees the whole bo->cb_list on error. However, by that time the flow_block_cb instances are already in the driver list because driver ndo_setup_tc() callback is called before that up the call chain in tcf_block_offload_cmd(). This leaves dangling pointers to freed objects in the list and causes use-after-free[0]. Fix it by also removing flow_block_cb instances from driver_list before deallocating them. [0]: [ 279.868433] ================================================================== [ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0 [ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963 [ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4 [ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 279.876295] Call Trace: [ 279.876882] [ 279.877413] dump_stack_lvl+0x33/0x50 [ 279.878198] print_report+0xc2/0x610 [ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0 [ 279.879994] kasan_report+0xae/0xe0 [ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0 [ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core] [ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0 [ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0 [ 279.885037] ? tcf_block_setup+0x6b0/0x6b0 [ 279.885901] ? mutex_lock+0x7d/0xd0 [ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0 [ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress] [ 279.888846] tcf_block_get_ext+0x61c/0x1200 [ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress] [ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress] [ 279.891701] qdisc_create+0x401/0xea0 [ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470 [ 279.893473] tc_modify_qdisc+0x6f7/0x16d0 [ 279.894344] ? tc_get_qdisc+0xac0/0xac0 [ 279.895213] ? mutex_lock+0x7d/0xd0 [ 279.896005] ? __mutex_lock_slowpath+0x10/0x10 [ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0 [ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 279.898672] ? __sys_sendmsg+0xb5/0x140 [ 279.899494] ? do_syscall_64+0x3d/0x90 [ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 279.901337] ? kasan_save_stack+0x2e/0x40 [ 279.902177] ? kasan_save_stack+0x1e/0x40 [ 279.903058] ? kasan_set_track+0x21/0x30 [ 279.903913] ? kasan_save_free_info+0x2a/0x40 [ 279.904836] ? ____kasan_slab_free+0x11a/0x1b0 [ 279.905741] ? kmem_cache_free+0x179/0x400 [ 279.906599] netlink_rcv_skb+0x12c/0x360 [ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 279.908360] ? netlink_ack+0x1550/0x1550 [ 279.909192] ? rhashtable_walk_peek+0x170/0x170 [ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390 [ 279.911086] ? _copy_from_iter+0x3d6/0xc70 [ 279.912031] netlink_unicast+0x553/0x790 [ 279.912864] ? netlink_attachskb+0x6a0/0x6a0 [ 279.913763] ? netlink_recvmsg+0x416/0xb50 [ 279.914627] netlink_sendmsg+0x7a1/0xcb0 [ 279.915473] ? netlink_unicast+0x790/0x790 [ 279.916334] ? iovec_from_user.part.0+0x4d/0x220 [ 279.917293] ? netlink_unicast+0x790/0x790 [ 279.918159] sock_sendmsg+0xc5/0x190 [ 279.918938] ____sys_sendmsg+0x535/0x6b0 [ 279.919813] ? import_iovec+0x7/0x10 [ 279.920601] ? kernel_sendmsg+0x30/0x30 [ 279.921423] ? __copy_msghdr+0x3c0/0x3c0 [ 279.922254] ? import_iovec+0x7/0x10 [ 279.923041] ___sys_sendmsg+0xeb/0x170 [ 279.923854] ? copy_msghdr_from_user+0x110/0x110 [ 279.924797] ? ___sys_recvmsg+0xd9/0x130 [ 279.925630] ? __perf_event_task_sched_in+0x183/0x470 [ 279.926656] ? ___sys_sendmsg+0x170/0x170 [ 279.927529] ? ctx_sched_in+0x530/0x530 [ 279.928369] ? update_curr+0x283/0x4f0 [ 279.929185] ? perf_event_update_userpage+0x570/0x570 [ 279.930201] ? __fget_light+0x57/0x520 [ 279.931023] ? __switch_to+0x53d/0xe70 [ 279.931846] ? sockfd_lookup_light+0x1a/0x140 [ 279.932761] __sys_sendmsg+0xb5/0x140 [ 279.933560] ? __sys_sendmsg_sock+0x20/0x20 [ 279.934436] ? fpregs_assert_state_consistent+0x1d/0xa0 [ 279.935490] do_syscall_64+0x3d/0x90 [ 279.936300] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 279.937311] RIP: 0033:0x7f21c814f887 [ 279.938085] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 279.941448] RSP: 002b:00007fff11efd478 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 279.942964] RAX: ffffffffffffffda RBX: 0000000064401979 RCX: 00007f21c814f887 [ 279.944337] RDX: 0000000000000000 RSI: 00007fff11efd4e0 RDI: 0000000000000003 [ 279.945660] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 279.947003] R10: 00007f21c8008708 R11: 0000000000000246 R12: 0000000000000001 [ 279.948345] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400 [ 279.949690] [ 279.950706] Allocated by task 2960: [ 279.951471] kasan_save_stack+0x1e/0x40 [ 279.952338] kasan_set_track+0x21/0x30 [ 279.953165] __kasan_kmalloc+0x77/0x90 [ 279.954006] flow_block_cb_setup_simple+0x3dd/0x7c0 [ 279.955001] tcf_block_offload_cmd.isra.0+0x189/0x2d0 [ 279.956020] tcf_block_get_ext+0x61c/0x1200 [ 279.956881] ingress_init+0x112/0x1c0 [sch_ingress] [ 279.957873] qdisc_create+0x401/0xea0 [ 279.958656] tc_modify_qdisc+0x6f7/0x16d0 [ 279.959506] rtnetlink_rcv_msg+0x5fe/0x9d0 [ 279.960392] netlink_rcv_skb+0x12c/0x360 [ 279.961216] netlink_unicast+0x553/0x790 [ 279.962044] netlink_sendmsg+0x7a1/0xcb0 [ 279.962906] sock_sendmsg+0xc5/0x190 [ 279.963702] ____sys_sendmsg+0x535/0x6b0 [ 279.964534] ___sys_sendmsg+0xeb/0x170 [ 279.965343] __sys_sendmsg+0xb5/0x140 [ 279.966132] do_syscall_64+0x3d/0x90 [ 279.966908] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 279.968407] Freed by task 2960: [ 279.969114] kasan_save_stack+0x1e/0x40 [ 279.969929] kasan_set_track+0x21/0x30 [ 279.970729] kasan_save_free_info+0x2a/0x40 [ 279.971603] ____kasan_slab_free+0x11a/0x1b0 [ 279.972483] __kmem_cache_free+0x14d/0x280 [ 279.973337] tcf_block_setup+0x29d/0x6b0 [ 279.974173] tcf_block_offload_cmd.isra.0+0x226/0x2d0 [ 279.975186] tcf_block_get_ext+0x61c/0x1200 [ 279.976080] ingress_init+0x112/0x1c0 [sch_ingress] [ 279.977065] qdisc_create+0x401/0xea0 [ 279.977857] tc_modify_qdisc+0x6f7/0x16d0 [ 279.978695] rtnetlink_rcv_msg+0x5fe/0x9d0 [ 279.979562] netlink_rcv_skb+0x12c/0x360 [ 279.980388] netlink_unicast+0x553/0x790 [ 279.981214] netlink_sendmsg+0x7a1/0xcb0 [ 279.982043] sock_sendmsg+0xc5/0x190 [ 279.982827] ____sys_sendmsg+0x535/0x6b0 [ 279.983703] ___sys_sendmsg+0xeb/0x170 [ 279.984510] __sys_sendmsg+0xb5/0x140 [ 279.985298] do_syscall_64+0x3d/0x90 [ 279.986076] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 279.987532] The buggy address belongs to the object at ffff888147e2bf00 which belongs to the cache kmalloc-192 of size 192 [ 279.989747] The buggy address is located 32 bytes inside of freed 192-byte region [ffff888147e2bf00, ffff888147e2bfc0) [ 279.992367] The buggy address belongs to the physical page: [ 279.993430] page:00000000550f405c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147e2a [ 279.995182] head:00000000550f405c order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 279.996713] anon flags: 0x200000000010200(slab|head|node=0|zone=2) [ 279.997878] raw: 0200000000010200 ffff888100042a00 0000000000000000 dead000000000001 [ 279.999384] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 [ 280.000894] page dumped because: kasan: bad access detected [ 280.002386] Memory state around the buggy address: [ 280.003338] ffff888147e2be00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 280.004781] ffff888147e2be80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 280.006224] >ffff888147e2bf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 280.007700] ^ [ 280.008592] ffff888147e2bf80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 280.010035] ffff888147e2c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 280.011564] ================================================================== Fixes: 59094b1e5094 ("net: sched: use flow block API") Signed-off-by: Vlad Buslov Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit e0807c430239d62d8dd7a25552e469aad8c3dd28 Author: Christophe JAILLET Date: Thu Apr 27 15:39:48 2023 +0200 mISDN: Use list_count_nodes() count_list_member() really looks the same as list_count_nodes(), so use the latter instead of hand writing it. The first one return an int and the other a size_t, but that should be fine. It is really unlikely that we get so many parties in a conference. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 7e692df3933628d974acb9f5b334d2b3e885e2a6 Author: Eric Dumazet Date: Fri Apr 28 04:32:31 2023 +0000 tcp: fix skb_copy_ubufs() vs BIG TCP David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB. skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages. This assumption broke when BIG TCP was able to put up to 512 KB per skb. We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000. A solution is to use higher order pages if needed. v2: add missing __GFP_COMP, or we leak memory. Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") Reported-by: David Ahern Link: https://lore.kernel.org/netdev/c70000f6-baa4-4a05-46d0-4b3e0dc1ccc8@gmail.com/T/ Signed-off-by: Eric Dumazet Cc: Xin Long Cc: Willem de Bruijn Cc: Coco Li Signed-off-by: David S. Miller commit 6f75cd166a5a3c0bc50441faa8b8304f60522fdd Author: Cosmo Chou Date: Wed Apr 26 16:13:50 2023 +0800 net/ncsi: clear Tx enable mode when handling a Config required AEN ncsi_channel_is_tx() determines whether a given channel should be used for Tx or not. However, when reconfiguring the channel by handling a Configuration Required AEN, there is a misjudgment that the channel Tx has already been enabled, which results in the Enable Channel Network Tx command not being sent. Clear the channel Tx enable flag before reconfiguring the channel to avoid the misjudgment. Fixes: 8d951a75d022 ("net/ncsi: Configure multi-package, multi-channel modes with failover") Signed-off-by: Cosmo Chou Signed-off-by: David S. Miller commit 8c6c78ee3b3330cf8a00a3c6bdecc18d42e969d7 Author: Jeremy Kerr Date: Fri Apr 28 08:18:49 2023 +0800 i3c: ast2600: fix register setting for 545 ohm pullups The 2k register setting is zero, OR-ing it in doesn't parallel the 2k and 750 ohm pullups. We need a separate value for the 545 ohm setting. Reported-by: Lukwinski Zbigniew Signed-off-by: Jeremy Kerr Link: https://lore.kernel.org/r/20230428001849.1775559-1-jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit f2539c20791eb474ae083f60a572f207ffbc3a67 Author: Jeremy Kerr Date: Thu Mar 30 15:50:36 2023 +0800 i3c: ast2600: enable IBI support The ast2600 i3c hardware is capable of IBIs, but we need a workaround for a hardware issue with the I3C state machine handling IBI payloads of specific lengths when PEC is not enabled. To avoid this, we need to unconditionally enable PECs, at the consquence of losing a byte of data when the device does not send a PEC. Enable IBIs on the ast2600 platform, including an implementation of the PEC workaround, which prints a warning when triggered. Signed-off-by: Jeremy Kerr Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/ba923b96d6d129024c975e8a0472c5b2fcb3af32.1680161823.git.jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit f3a3553a51e64379dbb2e980f0024f7a28b74977 Author: Jeremy Kerr Date: Thu Mar 30 15:50:35 2023 +0800 i3c: dw: Add a platform facility for IBI PEC workarounds On the AST2600 i3c controller, we'll need to apply a workaround for a hardware issue with IBI payloads. Introduce a platform hook to allow dw i3c platform implementations to modify the DAT entry in IBI enable/disable to allow this workaround in a future change. Signed-off-by: Jeremy Kerr Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/d5d76a8d2336d2a71886537f42e71d51db184df6.1680161823.git.jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit e389b1d72a6241b326071dd75e1b33f9e8818cd1 Author: Jeremy Kerr Date: Thu Mar 30 15:50:34 2023 +0800 i3c: dw: Add support for in-band interrupts This change adds support for receiving and dequeueing i3c IBIs. By setting struct dw_i3c_master->ibi_capable before probe, a platform implementation can select the IBI-enabled version of the i3c_master_ops, enabling the global IBI infrastrcture for that controller. Signed-off-by: Jeremy Kerr Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/79daeefd7ccb7c935d0c159149df21a6c9a73ffa.1680161823.git.jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit e2d43101f61d6e79510d1cd9e7052b4745b8d809 Author: Jeremy Kerr Date: Thu Mar 30 15:50:33 2023 +0800 i3c: dw: Turn DAT array entry into a struct In an upcoming change, we will want to store additional data about the devices we have in the data address table. Change the type of the DAT entries into a struct, which currently just has the address data. Signed-off-by: Jeremy Kerr Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/9dc0d9e2857e851a0cf04819df48e5d31921f83e.1680161823.git.jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit 79f42b31c2ec78416bc7dd6c9f21c3334879c43a Author: Jeremy Kerr Date: Thu Mar 30 15:50:32 2023 +0800 i3c: dw: Create a generic fifo read function In a future change we'll want to read from the IBI FIFO too, so turn dw_i3c_read_rx_fifo() into a generic read with the FIFO register as a parameter. Signed-off-by: Jeremy Kerr Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/827204789583dd86addffb47ecaeab9d67cf95d5.1680161823.git.jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit 7dc2e0a875645a79f5c1c063019397e8e94008f5 Author: Jeremy Kerr Date: Wed Apr 5 17:41:49 2023 +0800 i3c: Allow OF-alias-based persistent bus numbering Parse the /aliases node to assign any fixed bus numbers, as is done with the i2c subsystem. Numbering for non-aliased busses will start after the highest fixed bus number. This allows an alias node such as: aliases { i3c0 = &bus_a, i3c4 = &bus_b, }; to set the numbering for a set of i3c controllers: /* fixed-numbered bus, assigned "i3c-0" */ bus_a: i3c-master { }; /* another fixed-numbered bus, assigned "i3c-4" */ bus_b: i3c-master { }; /* dynamic-numbered bus, likely assigned "i3c-5" */ bus_c: i3c-master { }; If no i3c device aliases are present, the numbering will stay as-is, starting from 0. Signed-off-by: Jeremy Kerr Link: https://lore.kernel.org/r/20230405094149.1513209-1-jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit 5844564143575a8dbcbcece0084da059faeca5df Author: Jeremy Kerr Date: Fri Mar 31 17:15:01 2023 +0800 i3c: ast2600: Add AST2600 platform-specific driver Now that we have platform-specific infrastructure for the dw i3c driver, add platform support for the ASPEED AST2600 SoC. The AST2600 has a small set of "i3c global" registers, providing platform-level i3c configuration outside of the i3c core. For the ast2600, we need a couple of extra setup operations: - on probe: find the i3c global register set and parse the SDA pullup resistor values - on init: set the pullups accordingly, and set the i3c instance IDs Signed-off-by: Jeremy Kerr Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20230331091501.3800299-4-jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit 21203e098cd3c1760de8112d750ceeedf09a6dad Author: Jeremy Kerr Date: Fri Mar 31 17:15:00 2023 +0800 dt-bindings: i3c: Add AST2600 i3c controller Add a devicetree binding for the ast2600 i3c controller hardware. This is heavily based on the designware i3c core, plus a reset facility and two platform-specific properties: - sda-pullup-ohms: to specify the value of the configurable pullup resistors on the SDA line - aspeed,global-regs: to reference the (ast2600-specific) i3c global register block, and the device index to use within it. Reviewed-by: Krzysztof Kozlowski (on v1) Signed-off-by: Jeremy Kerr Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20230331091501.3800299-3-jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit d782188cbb05a196e46a4838484f020ceeb889ec Author: Jeremy Kerr Date: Fri Mar 31 17:14:59 2023 +0800 i3c: dw: Add infrastructure for platform-specific implementations The dw i3c core can be integrated into various SoC devices. Platforms that use this core may need a little configuration that is specific to that platform. Add some infrastructure to allow platform-specific behaviour: common probe/remove functions, a set of platform hook operations, and a pointer for platform-specific data in struct dw_i3c_master. Move the common api into a new (i3c local) header file. Platforms will provide their own struct platform_driver, which allocates struct dw_i3c_master, does any platform-specific probe behaviour, and calls into the common probe. A future change will add new platform support that uses this infrastructure. Signed-off-by: Jeremy Kerr Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20230331091501.3800299-2-jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit e99ab4abebf825de2ce65f6c6c32ee30e00bb077 Author: Ye Xingchen Date: Wed Mar 22 11:30:31 2023 +0800 rtc: armada38x: use devm_platform_ioremap_resource_byname() Convert platform_get_resource_byname(),devm_ioremap_resource() to a single call to devm_platform_ioremap_resource_byname(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Link: https://lore.kernel.org/r/202303221130316049449@zte.com.cn Signed-off-by: Alexandre Belloni commit 916890539bc8a5674d363a1fc985633200c2117a Author: Ye Xingchen Date: Wed Mar 22 11:31:58 2023 +0800 rtc: sunplus: use devm_platform_ioremap_resource_byname() Convert platform_get_resource_byname(),devm_ioremap_resource() to a single call to devm_platform_ioremap_resource_byname(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Link: https://lore.kernel.org/r/202303221131581039486@zte.com.cn Signed-off-by: Alexandre Belloni commit c7a639dac8e4d7e63450bef2f3a19fb331566fb1 Author: Lars-Peter Clausen Date: Sun Apr 9 09:25:44 2023 -0700 rtc: jz4740: Make sure clock provider gets removed The jz4740 RTC driver registers a clock provider, but never removes it. This leaves a stale clock provider behind that references freed clocks when the device is unbound. Use the managed `devm_of_clk_add_hw_provider()` instead of `of_clk_add_hw_provider()` to make sure the provider gets automatically removed on unbind. Fixes: 5ddfa148de8c ("rtc: jz4740: Register clock provider for the CLK32K pin") Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20230409162544.16155-1-lars@metafoo.de Signed-off-by: Alexandre Belloni commit 33afd4b76393627477e878b3b195d606e585d816 Merge: 7fa8a8ee9400f d88f2f72ca89e Author: Linus Torvalds Date: Thu Apr 27 19:57:00 2023 -0700 Merge tag 'mm-nonmm-stable-2023-04-27-16-01' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: "Mainly singleton patches all over the place. Series of note are: - updates to scripts/gdb from Glenn Washburn - kexec cleanups from Bjorn Helgaas" * tag 'mm-nonmm-stable-2023-04-27-16-01' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (50 commits) mailmap: add entries for Paul Mackerras libgcc: add forward declarations for generic library routines mailmap: add entry for Oleksandr ocfs2: reduce ioctl stack usage fs/proc: add Kthread flag to /proc/$pid/status ia64: fix an addr to taddr in huge_pte_offset() checkpatch: introduce proper bindings license check epoll: rename global epmutex scripts/gdb: add GDB convenience functions $lx_dentry_name() and $lx_i_dentry() scripts/gdb: create linux/vfs.py for VFS related GDB helpers uapi/linux/const.h: prefer ISO-friendly __typeof__ delayacct: track delays from IRQ/SOFTIRQ scripts/gdb: timerlist: convert int chunks to str scripts/gdb: print interrupts scripts/gdb: raise error with reduced debugging information scripts/gdb: add a Radix Tree Parser lib/rbtree: use '+' instead of '|' for setting color. proc/stat: remove arch_idle_time() checkpatch: check for misuse of the link tags checkpatch: allow Closes tags with links ... commit 7fa8a8ee9400fe8ec188426e40e481717bc5e924 Merge: 91ec4b0d11fe1 4d4b6d66db63c Author: Linus Torvalds Date: Thu Apr 27 19:42:02 2023 -0700 Merge tag 'mm-stable-2023-04-27-15-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of switching from a user process to a kernel thread. - More folio conversions from Kefeng Wang, Zhang Peng and Pankaj Raghav. - zsmalloc performance improvements from Sergey Senozhatsky. - Yue Zhao has found and fixed some data race issues around the alteration of memcg userspace tunables. - VFS rationalizations from Christoph Hellwig: - removal of most of the callers of write_one_page() - make __filemap_get_folio()'s return value more useful - Luis Chamberlain has changed tmpfs so it no longer requires swap backing. Use `mount -o noswap'. - Qi Zheng has made the slab shrinkers operate locklessly, providing some scalability benefits. - Keith Busch has improved dmapool's performance, making part of its operations O(1) rather than O(n). - Peter Xu adds the UFFD_FEATURE_WP_UNPOPULATED feature to userfaultd, permitting userspace to wr-protect anon memory unpopulated ptes. - Kirill Shutemov has changed MAX_ORDER's meaning to be inclusive rather than exclusive, and has fixed a bunch of errors which were caused by its unintuitive meaning. - Axel Rasmussen give userfaultfd the UFFDIO_CONTINUE_MODE_WP feature, which causes minor faults to install a write-protected pte. - Vlastimil Babka has done some maintenance work on vma_merge(): cleanups to the kernel code and improvements to our userspace test harness. - Cleanups to do_fault_around() by Lorenzo Stoakes. - Mike Rapoport has moved a lot of initialization code out of various mm/ files and into mm/mm_init.c. - Lorenzo Stoakes removd vmf_insert_mixed_prot(), which was added for DRM, but DRM doesn't use it any more. - Lorenzo has also coverted read_kcore() and vread() to use iterators and has thereby removed the use of bounce buffers in some cases. - Lorenzo has also contributed further cleanups of vma_merge(). - Chaitanya Prakash provides some fixes to the mmap selftesting code. - Matthew Wilcox changes xfs and afs so they no longer take sleeping locks in ->map_page(), a step towards RCUification of pagefaults. - Suren Baghdasaryan has improved mmap_lock scalability by switching to per-VMA locking. - Frederic Weisbecker has reworked the percpu cache draining so that it no longer causes latency glitches on cpu isolated workloads. - Mike Rapoport cleans up and corrects the ARCH_FORCE_MAX_ORDER Kconfig logic. - Liu Shixin has changed zswap's initialization so we no longer waste a chunk of memory if zswap is not being used. - Yosry Ahmed has improved the performance of memcg statistics flushing. - David Stevens has fixed several issues involving khugepaged, userfaultfd and shmem. - Christoph Hellwig has provided some cleanup work to zram's IO-related code paths. - David Hildenbrand has fixed up some issues in the selftest code's testing of our pte state changing. - Pankaj Raghav has made page_endio() unneeded and has removed it. - Peter Xu contributed some rationalizations of the userfaultfd selftests. - Yosry Ahmed has fixed an issue around memcg's page recalim accounting. - Chaitanya Prakash has fixed some arm-related issues in the selftests/mm code. - Longlong Xia has improved the way in which KSM handles hwpoisoned pages. - Peter Xu fixes a few issues with uffd-wp at fork() time. - Stefan Roesch has changed KSM so that it may now be used on a per-process and per-cgroup basis. * tag 'mm-stable-2023-04-27-15-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (369 commits) mm,unmap: avoid flushing TLB in batch if PTE is inaccessible shmem: restrict noswap option to initial user namespace mm/khugepaged: fix conflicting mods to collapse_file() sparse: remove unnecessary 0 values from rc mm: move 'mmap_min_addr' logic from callers into vm_unmapped_area() hugetlb: pte_alloc_huge() to replace huge pte_alloc_map() maple_tree: fix allocation in mas_sparse_area() mm: do not increment pgfault stats when page fault handler retries zsmalloc: allow only one active pool compaction context selftests/mm: add new selftests for KSM mm: add new KSM process and sysfs knobs mm: add new api to enable ksm per process mm: shrinkers: fix debugfs file permissions mm: don't check VMA write permissions if the PTE/PMD indicates write permissions migrate_pages_batch: fix statistics for longterm pin retry userfaultfd: use helper function range_in_vma() lib/show_mem.c: use for_each_populated_zone() simplify code mm: correct arg in reclaim_pages()/reclaim_clean_pages_from_list() fs/buffer: convert create_page_buffers to folio_create_buffers fs/buffer: add folio_create_empty_buffers helper ... commit 952aa344bf4305ab6fa0d9962ef8c2caa2afef4c Author: Eric Blake Date: Mon Apr 10 13:06:11 2023 -0500 docs nbd: userspace NBD now favors github over sourceforge While the sourceforge site for userspace NBD still exists, the code repository moved to github several years ago. Then with a recent patch[1], the github landing page contains just as much information as the sourceforge page, so we might as well point to a single location that also provides the code. [1] https://lists.debian.org/nbd/2023/03/msg00051.html Signed-off-by: Eric Blake Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20230410180611.1051618-5-eblake@redhat.com Signed-off-by: Jens Axboe commit bd9e9916c32fd4b4fb4e879e05bd1568ee02ec93 Author: Eric Blake Date: Mon Apr 10 13:06:10 2023 -0500 block nbd: use req.cookie instead of req.handle The NBD spec was recently changed [1] to refer to the opaque client identifier as a 'cookie' rather than a 'handle', but has for a much longer time listed it as a 64-bit value, and declares that all values in the NBD protocol are sent in network byte order (big-endian). Because the value is opaque to the server, it doesn't usually matter what endianness we send as the client - as long as we are consistent that either we byte-swap on both write and read, or on neither, then we can match server replies back to our requests. That said, our internal use of the cookie is as a 64-bit number (well, as two 32-bit numbers concatenated together), rather than as 8 individual bytes; so prior to this commit, we ARE leaking the native endianness of our internals as a client out to the server. We don't know of any server that will actually inspect the opaque value and behave differently depending on whether a little-endian or big-endian client is sending requests, but since we DO log the cookie value, a wireshark capture of the network traffic is easier to correlate back to the kernel traffic of a big-endian host (where the u64 and char[8] representations are the same) than of a little-endian host (where if wireshark honors the NBD spec and displays a u64 in network byte order, it is byte-swapped from what the kernel logged). The fix in this patch is thus two-part: it now consistently uses network byte order for the opaque value (no difference to a big-endian machine, but an extra byteswap on a little-endian machine; probably in the noise compared to the overhead of network traffic in general), and now uses a 64-bit integer instead of char[8] as its preferred access to the opaque value (direct assignment instead of memcpy()). Signed-off-by: Eric Blake Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20230410180611.1051618-4-eblake@redhat.com Signed-off-by: Jens Axboe commit 2686eb845da7762ee98b17e578b0c081aafb77b9 Author: Eric Blake Date: Mon Apr 10 13:06:09 2023 -0500 uapi nbd: add cookie alias to handle The uapi header declares a 'char handle[8]' per request; which is overloaded in English (are you referring to "handle" the verb, such as handling a signal or writing a callback handler, or "handle" the noun, the value used in a lookup table to correlate a response back to the request). Many user-space NBD implementations (both servers and clients) have instead used 'uint64_t cookie' or similar, as it is easier to directly assign an integer than to futz around with memcpy. In fact, upstream documentation is now encouraging this shift in terminology: https://github.com/NetworkBlockDevice/nbd/commit/ca4392eb2b Accomplish this by use of an anonymous union to provide the alias for anyone getting the definition from the uapi; this does not break existing clients, while exposing the nicer name for those who prefer it. Note that block/nbd.c still uses the term handle (in fact, it actually combines a 32-bit cookie and a 32-bit tag into the 64-bit handle), but that internal usage is not changed by the public uapi, since no compliant NBD server has any reason to inspect or alter the 64 bits sent over the socket. Signed-off-by: Eric Blake Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20230410180611.1051618-3-eblake@redhat.com Signed-off-by: Jens Axboe commit daf376a366fd2d469d66ab83dfdc074777462bab Author: Eric Blake Date: Mon Apr 10 13:06:08 2023 -0500 uapi nbd: improve doc links to userspace spec The uapi header intentionally documents only the NBD server features that the kernel module will utilize as a client. But while it already had one mention of skipped bits due to userspace extensions, it did not actually direct the reader to the canonical source to learn about those extensions. While touching comments, fix an outdated reference that listed only READ and WRITE as commands. Signed-off-by: Eric Blake Reviewed-by: Ming Lei Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20230410180611.1051618-2-eblake@redhat.com Signed-off-by: Jens Axboe commit 91ec4b0d11fe115581ce2835300558802ce55e6c Merge: 513f17f8d6b67 46e614cc91f7b Author: Linus Torvalds Date: Thu Apr 27 17:46:52 2023 -0700 Merge tag 'mips_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - added support for Huawei B593u-12 - added support for virt board aligned to QEMU MIPS virt board - added support for doing DMA coherence on a per device base - reworked handling of RALINK SoCs - cleanup for Loongon64 barriers - removed deprecated support for MIPS_CMP SMP handling method - removed support Sibyte CARMEL and CHRINE boards - cleanups and fixes * tag 'mips_6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (59 commits) MIPS: uprobes: Restore thread.trap_nr MIPS: Don't clear _PAGE_SPECIAL in _PAGE_CHG_MASK MIPS: Sink body of check_bugs_early() into its only call site MIPS: Mark check_bugs() as __init Revert "MIPS: generic: Enable all CPUs supported by virt board in Kconfig" MIPS: octeon_switch: Remove duplicated labels MIPS: loongson2ef: Add missing break in cs5536_isa MIPS: Remove set_swbp() in uprobes.c MIPS: Use def_bool y for ARCH_SUPPORTS_UPROBES MIPS: fw: Allow firmware to pass a empty env MIPS: Remove deprecated CONFIG_MIPS_CMP MIPS: lantiq: remove unused function declaration MIPS: Drop unused positional parameter in local_irq_{dis,en}able MIPS: mm: Remove local_cache_flush_page MIPS: Remove no longer used ide.h MIPS: mm: Remove unused *cache_page_indexed flush functions MIPS: generic: Enable all CPUs supported by virt board in Kconfig MIPS: Add board config for virt board MIPS: Octeon: Disable CVMSEG by default on other platforms MIPS: Loongson: Don't select platform features with CPU ... commit 513f17f8d6b67563d977c730d50bc0db6ea6e1b0 Merge: 35fab9271b7e6 e5c23bec0f121 Author: Linus Torvalds Date: Thu Apr 27 17:41:23 2023 -0700 Merge tag 'sh-for-v6.4-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh updates from John Paul Adrian Glaubitz: "This is a bit larger than my previous one and mainly consists of clean-up work in the arch/sh directory by Geert Uytterhoeven and Randy Dunlap. Additionally, this fixes a bug in the Storage Queue code that was discovered while I was reviewing a patch to switch the code to the bitmap API by Christophe Jaillet. So this contains both a fix for the original bug in the Storage Queue code that can be backported later as well as the Christophe's patch to swich the code to the bitmap API. Summary: - Use generic GCC library routines - sq: Use the bitmap API when applicable - sq: Fix incorrect element size for allocating bitmap buffer - pci: Remove unused variable in SH-7786 PCI Express code - mcount.S: fix build error when PRINTK is not enabled - remove sh5/sh64 last fragments - math-emu: fix macro redefined warning - init: use OF_EARLY_FLATTREE for early init - nmi_debug: fix return value of __setup handler - SH2007: drop the bad URL info" * tag 'sh-for-v6.4-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: Replace by sh: Use generic GCC library routines sh: sq: Use the bitmap API when applicable sh: sq: Fix incorrect element size for allocating bitmap buffer sh: pci: Remove unused variable in SH-7786 PCI Express code sh: mcount.S: fix build error when PRINTK is not enabled sh: remove sh5/sh64 last fragments sh: math-emu: fix macro redefined warning sh: init: use OF_EARLY_FLATTREE for early init sh: nmi_debug: fix return value of __setup handler sh: SH2007: drop the bad URL info commit 35fab9271b7e6d193b47005c4d07369714db4fd1 Merge: da46b58ff8841 cbfac7707ba16 Author: Linus Torvalds Date: Thu Apr 27 17:27:06 2023 -0700 Merge tag 'for-linus-6.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - some cleanups in the Xen blkback driver - fix potential sleeps under lock in various Xen drivers * tag 'for-linus-6.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/blkback: move blkif_get_x86_*_req() into blkback.c xen/blkback: simplify free_persistent_gnts() interface xen/blkback: remove stale prototype xen/blkback: fix white space code style issues xen/pvcalls: don't call bind_evtchn_to_irqhandler() under lock xen/scsiback: don't call scsiback_free_translation_entry() under lock xen/pciback: don't call pcistub_device_put() under lock commit da46b58ff884146f6153064f18d276806f3c114c Merge: 8ccd54fe45713 a494aef23dfc7 Author: Linus Torvalds Date: Thu Apr 27 17:17:12 2023 -0700 Merge tag 'hyperv-next-signed-20230424' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - PCI passthrough for Hyper-V confidential VMs (Michael Kelley) - Hyper-V VTL mode support (Saurabh Sengar) - Move panic report initialization code earlier (Long Li) - Various improvements and bug fixes (Dexuan Cui and Michael Kelley) * tag 'hyperv-next-signed-20230424' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: (22 commits) PCI: hv: Replace retarget_msi_interrupt_params with hyperv_pcpu_input_arg Drivers: hv: move panic report code from vmbus to hv early init code x86/hyperv: VTL support for Hyper-V Drivers: hv: Kconfig: Add HYPERV_VTL_MODE x86/hyperv: Make hv_get_nmi_reason public x86/hyperv: Add VTL specific structs and hypercalls x86/init: Make get/set_rtc_noop() public x86/hyperv: Exclude lazy TLB mode CPUs from enlightened TLB flushes x86/hyperv: Add callback filter to cpumask_to_vpset() Drivers: hv: vmbus: Remove the per-CPU post_msg_page clocksource: hyper-v: make sure Invariant-TSC is used if it is available PCI: hv: Enable PCI pass-thru devices in Confidential VMs Drivers: hv: Don't remap addresses that are above shared_gpa_boundary hv_netvsc: Remove second mapping of send and recv buffers Drivers: hv: vmbus: Remove second way of mapping ring buffers Drivers: hv: vmbus: Remove second mapping of VMBus monitor pages swiotlb: Remove bounce buffer remapping for Hyper-V Driver: VMBus: Add Devicetree support dt-bindings: bus: Add Hyper-V VMBus Drivers: hv: vmbus: Convert acpi_device to more generic platform_device ... commit 8ccd54fe45713cd458015b5b08d6098545e70543 Merge: 0835b5ee8704a c82729e06644f Author: Linus Torvalds Date: Thu Apr 27 17:05:34 2023 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "virtio,vhost,vdpa: features, fixes, and cleanups: - reduction in interrupt rate in virtio - perf improvement for VDUSE - scalability for vhost-scsi - non power of 2 ring support for packed rings - better management for mlx5 vdpa - suspend for snet - VIRTIO_F_NOTIFICATION_DATA - shared backend with vdpa-sim-blk - user VA support in vdpa-sim - better struct packing for virtio and fixes, cleanups all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (52 commits) vhost_vdpa: fix unmap process in no-batch mode MAINTAINERS: make me a reviewer of VIRTIO CORE AND NET DRIVERS tools/virtio: fix build caused by virtio_ring changes virtio_ring: add a struct device forward declaration vdpa_sim_blk: support shared backend vdpa_sim: move buffer allocation in the devices vdpa/snet: use likely/unlikely macros in hot functions vdpa/snet: implement kick_vq_with_data callback virtio-vdpa: add VIRTIO_F_NOTIFICATION_DATA feature support virtio: add VIRTIO_F_NOTIFICATION_DATA feature support vdpa/snet: support the suspend vDPA callback vdpa/snet: support getting and setting VQ state MAINTAINERS: add vringh.h to Virtio Core and Net Drivers vringh: address kdoc warnings vdpa: address kdoc warnings virtio_ring: don't update event idx on get_buf vdpa_sim: add support for user VA vdpa_sim: replace the spinlock with a mutex to protect the state vdpa_sim: use kthread worker vdpa_sim: make devices agnostic for work management ... commit 0835b5ee8704aef4e19b369237a762c52c7b6fb1 Merge: 900941bea3f69 5239a89b06d6b Author: Linus Torvalds Date: Thu Apr 27 17:03:40 2023 -0700 Merge tag 'pstore-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore update from Kees Cook: - Revert pmsg_lock back to a normal mutex (John Stultz) * tag 'pstore-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore: Revert pmsg_lock back to a normal mutex commit 900941bea3f69859c8e4cb17e4fd89c3ff6ade99 Merge: 888d3c9f7f3ae b69edab47f1da Author: Linus Torvalds Date: Thu Apr 27 17:01:04 2023 -0700 Merge tag 'hardening-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening update from Kees Cook: - Fix kheaders array declaration to avoid tripping FORTIFY_SOURCE * tag 'hardening-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: kheaders: Use array declaration instead of char commit 888d3c9f7f3ae44101a3fd76528d3dd6f96e9fd0 Merge: b6a7828502dc7 e3184de9d46c2 Author: Linus Torvalds Date: Thu Apr 27 16:52:33 2023 -0700 Merge tag 'sysctl-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull sysctl updates from Luis Chamberlain: "This only does a few sysctl moves from the kernel/sysctl.c file, the rest of the work has been put towards deprecating two API calls which incur recursion and prevent us from simplifying the registration process / saving memory per move. Most of the changes have been soaking on linux-next since v6.3-rc3. I've slowed down the kernel/sysctl.c moves due to Matthew Wilcox's feedback that we should see if we could *save* memory with these moves instead of incurring more memory. We currently incur more memory since when we move a syctl from kernel/sysclt.c out to its own file we end up having to add a new empty sysctl used to register it. To achieve saving memory we want to allow syctls to be passed without requiring the end element being empty, and just have our registration process rely on ARRAY_SIZE(). Without this, supporting both styles of sysctls would make the sysctl registration pretty brittle, hard to read and maintain as can be seen from Meng Tang's efforts to do just this [0]. Fortunately, in order to use ARRAY_SIZE() for all sysctl registrations also implies doing the work to deprecate two API calls which use recursion in order to support sysctl declarations with subdirectories. And so during this development cycle quite a bit of effort went into this deprecation effort. I've annotated the following two APIs are deprecated and in few kernel releases we should be good to remove them: - register_sysctl_table() - register_sysctl_paths() During this merge window we should be able to deprecate and unexport register_sysctl_paths(), we can probably do that towards the end of this merge window. Deprecating register_sysctl_table() will take a bit more time but this pull request goes with a few example of how to do this. As it turns out each of the conversions to move away from either of these two API calls *also* saves memory. And so long term, all these changes *will* prove to have saved a bit of memory on boot. The way I see it then is if remove a user of one deprecated call, it gives us enough savings to move one kernel/sysctl.c out from the generic arrays as we end up with about the same amount of bytes. Since deprecating register_sysctl_table() and register_sysctl_paths() does not require maintainer coordination except the final unexport you'll see quite a bit of these changes from other pull requests, I've just kept the stragglers after rc3" Link: https://lkml.kernel.org/r/ZAD+cpbrqlc5vmry@bombadil.infradead.org [0] * tag 'sysctl-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: (29 commits) fs: fix sysctls.c built mm: compaction: remove incorrect #ifdef checks mm: compaction: move compaction sysctl to its own file mm: memory-failure: Move memory failure sysctls to its own file arm: simplify two-level sysctl registration for ctl_isa_vars ia64: simplify one-level sysctl registration for kdump_ctl_table utsname: simplify one-level sysctl registration for uts_kern_table ntfs: simplfy one-level sysctl registration for ntfs_sysctls coda: simplify one-level sysctl registration for coda_table fs/cachefiles: simplify one-level sysctl registration for cachefiles_sysctls xfs: simplify two-level sysctl registration for xfs_table nfs: simplify two-level sysctl registration for nfs_cb_sysctls nfs: simplify two-level sysctl registration for nfs4_cb_sysctls lockd: simplify two-level sysctl registration for nlm_sysctls proc_sysctl: enhance documentation xen: simplify sysctl registration for balloon md: simplify sysctl registration hv: simplify sysctl registration scsi: simplify sysctl registration with register_sysctl() csky: simplify alignment sysctl registration ... commit b6a7828502dc769e1a5329027bc5048222fa210a Merge: d06f5a3f71409 8660484ed1cf3 Author: Linus Torvalds Date: Thu Apr 27 16:36:55 2023 -0700 Merge tag 'modules-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull module updates from Luis Chamberlain: "The summary of the changes for this pull requests is: - Song Liu's new struct module_memory replacement - Nick Alcock's MODULE_LICENSE() removal for non-modules - My cleanups and enhancements to reduce the areas where we vmalloc module memory for duplicates, and the respective debug code which proves the remaining vmalloc pressure comes from userspace. Most of the changes have been in linux-next for quite some time except the minor fixes I made to check if a module was already loaded prior to allocating the final module memory with vmalloc and the respective debug code it introduces to help clarify the issue. Although the functional change is small it is rather safe as it can only *help* reduce vmalloc space for duplicates and is confirmed to fix a bootup issue with over 400 CPUs with KASAN enabled. I don't expect stable kernels to pick up that fix as the cleanups would have also had to have been picked up. Folks on larger CPU systems with modules will want to just upgrade if vmalloc space has been an issue on bootup. Given the size of this request, here's some more elaborate details: The functional change change in this pull request is the very first patch from Song Liu which replaces the 'struct module_layout' with a new 'struct module_memory'. The old data structure tried to put together all types of supported module memory types in one data structure, the new one abstracts the differences in memory types in a module to allow each one to provide their own set of details. This paves the way in the future so we can deal with them in a cleaner way. If you look at changes they also provide a nice cleanup of how we handle these different memory areas in a module. This change has been in linux-next since before the merge window opened for v6.3 so to provide more than a full kernel cycle of testing. It's a good thing as quite a bit of fixes have been found for it. Jason Baron then made dynamic debug a first class citizen module user by using module notifier callbacks to allocate / remove module specific dynamic debug information. Nick Alcock has done quite a bit of work cross-tree to remove module license tags from things which cannot possibly be module at my request so to: a) help him with his longer term tooling goals which require a deterministic evaluation if a piece a symbol code could ever be part of a module or not. But quite recently it is has been made clear that tooling is not the only one that would benefit. Disambiguating symbols also helps efforts such as live patching, kprobes and BPF, but for other reasons and R&D on this area is active with no clear solution in sight. b) help us inch closer to the now generally accepted long term goal of automating all the MODULE_LICENSE() tags from SPDX license tags In so far as a) is concerned, although module license tags are a no-op for non-modules, tools which would want create a mapping of possible modules can only rely on the module license tag after the commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"). Nick has been working on this *for years* and AFAICT I was the only one to suggest two alternatives to this approach for tooling. The complexity in one of my suggested approaches lies in that we'd need a possible-obj-m and a could-be-module which would check if the object being built is part of any kconfig build which could ever lead to it being part of a module, and if so define a new define -DPOSSIBLE_MODULE [0]. A more obvious yet theoretical approach I've suggested would be to have a tristate in kconfig imply the same new -DPOSSIBLE_MODULE as well but that means getting kconfig symbol names mapping to modules always, and I don't think that's the case today. I am not aware of Nick or anyone exploring either of these options. Quite recently Josh Poimboeuf has pointed out that live patching, kprobes and BPF would benefit from resolving some part of the disambiguation as well but for other reasons. The function granularity KASLR (fgkaslr) patches were mentioned but Joe Lawrence has clarified this effort has been dropped with no clear solution in sight [1]. In the meantime removing module license tags from code which could never be modules is welcomed for both objectives mentioned above. Some developers have also welcomed these changes as it has helped clarify when a module was never possible and they forgot to clean this up, and so you'll see quite a bit of Nick's patches in other pull requests for this merge window. I just picked up the stragglers after rc3. LWN has good coverage on the motivation behind this work [2] and the typical cross-tree issues he ran into along the way. The only concrete blocker issue he ran into was that we should not remove the MODULE_LICENSE() tags from files which have no SPDX tags yet, even if they can never be modules. Nick ended up giving up on his efforts due to having to do this vetting and backlash he ran into from folks who really did *not understand* the core of the issue nor were providing any alternative / guidance. I've gone through his changes and dropped the patches which dropped the module license tags where an SPDX license tag was missing, it only consisted of 11 drivers. To see if a pull request deals with a file which lacks SPDX tags you can just use: ./scripts/spdxcheck.py -f \ $(git diff --name-only commid-id | xargs echo) You'll see a core module file in this pull request for the above, but that's not related to his changes. WE just need to add the SPDX license tag for the kernel/module/kmod.c file in the future but it demonstrates the effectiveness of the script. Most of Nick's changes were spread out through different trees, and I just picked up the slack after rc3 for the last kernel was out. Those changes have been in linux-next for over two weeks. The cleanups, debug code I added and final fix I added for modules were motivated by David Hildenbrand's report of boot failing on a systems with over 400 CPUs when KASAN was enabled due to running out of virtual memory space. Although the functional change only consists of 3 lines in the patch "module: avoid allocation if module is already present and ready", proving that this was the best we can do on the modules side took quite a bit of effort and new debug code. The initial cleanups I did on the modules side of things has been in linux-next since around rc3 of the last kernel, the actual final fix for and debug code however have only been in linux-next for about a week or so but I think it is worth getting that code in for this merge window as it does help fix / prove / evaluate the issues reported with larger number of CPUs. Userspace is not yet fixed as it is taking a bit of time for folks to understand the crux of the issue and find a proper resolution. Worst come to worst, I have a kludge-of-concept [3] of how to make kernel_read*() calls for modules unique / converge them, but I'm currently inclined to just see if userspace can fix this instead" Link: https://lore.kernel.org/all/Y/kXDqW+7d71C4wz@bombadil.infradead.org/ [0] Link: https://lkml.kernel.org/r/025f2151-ce7c-5630-9b90-98742c97ac65@redhat.com [1] Link: https://lwn.net/Articles/927569/ [2] Link: https://lkml.kernel.org/r/20230414052840.1994456-3-mcgrof@kernel.org [3] * tag 'modules-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: (121 commits) module: add debugging auto-load duplicate module support module: stats: fix invalid_mod_bytes typo module: remove use of uninitialized variable len module: fix building stats for 32-bit targets module: stats: include uapi/linux/module.h module: avoid allocation if module is already present and ready module: add debug stats to help identify memory pressure module: extract patient module check into helper modules/kmod: replace implementation with a semaphore Change DEFINE_SEMAPHORE() to take a number argument module: fix kmemleak annotations for non init ELF sections module: Ignore L0 and rename is_arm_mapping_symbol() module: Move is_arm_mapping_symbol() to module_symbol.h module: Sync code of is_arm_mapping_symbol() scripts/gdb: use mem instead of core_layout to get the module address interconnect: remove module-related code interconnect: remove MODULE_LICENSE in non-modules zswap: remove MODULE_LICENSE in non-modules zpool: remove MODULE_LICENSE in non-modules x86/mm/dump_pagetables: remove MODULE_LICENSE in non-modules ... commit d06f5a3f7140921ada47d49574ae6fa4de5e2a89 Author: Linus Torvalds Date: Thu Apr 27 16:21:32 2023 -0700 cdx: fix build failure due to sysfs 'bus_type' argument needing to be const Commit 75cff725d956 ("driver core: bus: mark the struct bus_type for sysfs callbacks as constant") missed at least one case - the CDX bus driver. Probably because Greg didn't notice the build failure, because it only ends up being enabled on arm64. And I missed it during the merge, because while I do arm64 builds these days, I don't do them in between each pull. So it took a while for me to notice the breakage, rather than me just fixing it in the driver core merge that brought this failure case in. Maybe we should remove the CDX_BUS dependency on arm64 when COMPILE_TEST is on? Cc: Greg Kroah-Hartman Cc: Nipun Gupta Cc: Nikhil Agarwal Signed-off-by: Linus Torvalds commit 9280c577431401544e63dfb489a830a42bee25eb Author: Chuck Lever Date: Thu Apr 20 13:56:31 2023 -0400 NFSD: Handle new xprtsec= export option Enable administrators to require clients to use transport layer security when accessing particular exports. Signed-off-by: Chuck Lever commit b3cbf98e2fdf3cb147a95161560cd25987284330 Author: Chuck Lever Date: Thu Apr 20 13:56:24 2023 -0400 SUNRPC: Support TLS handshake in the server-side TCP socket code This patch adds opportunitistic RPC-with-TLS to the Linux in-kernel NFS server. If the client requests RPC-with-TLS and the user space handshake agent is running, the server will set up a TLS session. There are no policy settings yet. For example, the server cannot yet require the use of RPC-with-TLS to access its data. Signed-off-by: Chuck Lever commit 22b620ec0bf454cfd1c464f57cfce9afb3fb1e70 Author: Chuck Lever Date: Thu Apr 20 11:02:33 2023 -0400 NFSD: Clean up xattr memory allocation flags Tetsuo Handa points out: > Since GFP_KERNEL is "GFP_NOFS | __GFP_FS", usage like > "GFP_KERNEL | GFP_NOFS" does not make sense. The original intent was to hold the inode lock while estimating the buffer requirements for the requested information. Frank van der Linden, the author of NFSD's xattr code, says: > ... you need inode_lock to get an atomic view of an xattr. Since > both nfsd_getxattr and nfsd_listxattr to the standard trick of > querying the xattr length with a NULL buf argument (just getting > the length back), allocating the right buffer size, and then > querying again, they need to hold the inode lock to avoid having > the xattr changed from under them while doing that. > > From that then flows the requirement that GFP_FS could cause > problems while holding i_rwsem, so I added GFP_NOFS. However, Dave Chinner states: > You can do GFP_KERNEL allocations holding the i_rwsem just fine. > All that it requires is the caller holds a reference to the > inode ... Since these code paths acquire a dentry, they do indeed hold a reference. It is therefore safe to use GFP_KERNEL for these memory allocations. In particular, that's what this code is already doing; but now the C source code looks sane too. At a later time we can revisit in order to remove the inode lock in favor of simply retrying if the estimated buffer size is too small. Reported-by: Tetsuo Handa Signed-off-by: Chuck Lever commit 147abcacee33781e75588869e944ddb07528a897 Author: Dai Ngo Date: Wed Apr 19 10:53:18 2023 -0700 NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop The following request sequence to the same file causes the NFS client and server getting into an infinite loop with COMMIT and NFS4ERR_DELAY: OPEN REMOVE WRITE COMMIT Problem reported by recall11, recall12, recall14, recall20, recall22, recall40, recall42, recall48, recall50 of nfstest suite. This patch restores the handling of race condition in nfsd_file_do_acquire with unlink to that prior of the regression. Fixes: ac3a2585f018 ("nfsd: rework refcounting in filecache") Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 695bc1f32c6bc806218b322096b23dfd601e59ca Author: Chuck Lever Date: Mon Apr 17 22:15:28 2023 -0400 SUNRPC: Clear rq_xid when receiving a new RPC Call This is an eye-catcher for tracepoints that record the XID: it means svc_rqst() has not received a full RPC Call with an XID yet. Signed-off-by: Chuck Lever commit 5e052dda121e2870dd87181783da4a95d7d2927b Author: Chuck Lever Date: Mon Apr 17 09:42:14 2023 -0400 SUNRPC: Recognize control messages in server-side TCP socket code To support kTLS, the server-side TCP socket receive path needs to watch for CMSGs. Acked-by: Jakub Kicinski Signed-off-by: Chuck Lever commit 6a0cdf56bfc9a1791ddd6955d60f3678523e599c Author: Chuck Lever Date: Fri Apr 14 20:18:15 2023 -0400 SUNRPC: Be even lazier about releasing pages A single RPC transaction that touches only a couple of pages means rq_pvec will not be even close to full in svc_xpt_release(). This is a common case. Instead, just leave the pages in rq_pvec until it is completely full. This improves the efficiency of the batch release mechanism on workloads that involve small RPC messages. The rq_pvec is also fully emptied just before thread exit. Reviewed-by: Calum Mackay Signed-off-by: Chuck Lever commit 675751bb20634f981498c7d66161584080cc061e Author: Johannes Berg Date: Thu Apr 27 17:59:20 2023 +0200 ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN): BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0 CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab3 60f224fc 600477fa 60f35687 60c4f20f 601273dd 00000008 6101eb00 6101eab0 615be548 Call Trace: [<60047a58>] show_stack+0x25e/0x282 [<60c609e0>] dump_stack_lvl+0x96/0xfd [<60c50d4c>] print_report+0x1a7/0x5a8 [<603078d3>] kasan_report+0xc1/0xe9 [<60308950>] __asan_report_load8_noabort+0x1b/0x1d [<60232844>] irq_work_run_list+0x11a/0x13a [<602328b4>] irq_work_tick+0x24/0x34 [<6017f9dc>] update_process_times+0x162/0x196 [<6019f335>] tick_sched_handle+0x1a4/0x1c3 [<6019fd9e>] tick_sched_timer+0x79/0x10c [<601812b9>] __hrtimer_run_queues.constprop.0+0x425/0x695 [<60182913>] hrtimer_interrupt+0x16c/0x2c4 [<600486a3>] um_timer+0x164/0x183 [...] Allocated by task 411: save_stack_trace+0x99/0xb5 stack_trace_save+0x81/0x9b kasan_save_stack+0x2d/0x54 kasan_set_track+0x34/0x3e kasan_save_alloc_info+0x25/0x28 ____kasan_kmalloc+0x8b/0x97 __kasan_kmalloc+0x10/0x12 __kmalloc+0xb2/0xe8 load_elf_phdrs+0xee/0x182 [...] The buggy address belongs to the object at 000000006d640800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 584 bytes inside of freed 1024-byte region [000000006d640800, 000000006d640c00) Add the appropriate irq_work_sync() so the work finishes before the buffers are destroyed. Prior to the commit in the Fixes tag below, there was only a single global IRQ work, so this issue didn't exist. Link: https://lore.kernel.org/linux-trace-kernel/20230427175920.a76159263122.I8295e405c44362a86c995e9c2c37e3e03810aa56@changeid Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Fixes: 15693458c4bc ("tracing/ring-buffer: Move poll wake ups into ring buffer code") Signed-off-by: Johannes Berg Signed-off-by: Steven Rostedt (Google) commit 66b32e3d2c6daeeafb80fa41f3a41e4c0ab85cc6 Author: Jeremy Kerr Date: Thu Mar 30 14:15:33 2023 +0800 i3c: dw: use bus mode rather than device reg for conditional tCAS setting In the clock setup path, we set the hardware DEV_CTRL_I2C_SLAVE_PRESENT bit on a shared mode bus, then read-back this bit for the conditional tCAS set. Instead, just use the bus->mode setting for the conditional test. While we're at it, add a little comment about why the conditional is there. Signed-off-by: Jeremy Kerr Link: https://lore.kernel.org/r/92a933566f7846708a00ad7f5a16ee8e6ed32d0e.1680156630.git.jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit 67df5ce9dd8870d3e53de5ebd6aecf609b713044 Author: Matt Johnston Date: Thu Mar 30 14:15:32 2023 +0800 i3c: dw: Return the length from a read priv_xfer We currently assume that the rx_len of a read command will be as submitted, but we may have a shorter read than expected. This change populates the output i3c xfer length from the actually-read length. Signed-off-by: Matt Johnston Signed-off-by: Jeremy Kerr Link: https://lore.kernel.org/r/f4fff7ab18dee1f662dc7a5a4111fcd921e6792b.1680156630.git.jk@codeconstruct.com.au Signed-off-by: Alexandre Belloni commit 3302212f0384ab286b65683bc340f3953f88f70a Author: Philippe De Muyter Date: Wed Apr 26 21:33:02 2023 +0200 regulator: consumer.rst: fix 'regulator_enable' typo. Removing an erroneous 'd' at the end of 'regulator_enable'. Signed-off-by: Philippe De Muyter Cc: Liam Girdwood Cc: Mark Brown Link: https://lore.kernel.org/r/1682537582-2314-1-git-send-email-Philippe.DeMuyter@macq.eu Signed-off-by: Mark Brown commit 110ccfa9dd6ca1272e50fbea614aa31f01d2c17e Author: Enrico Belleri Date: Thu Apr 27 21:16:45 2023 +0200 ASoC: amd: yc: Add ASUS M3402RA into DMI table Fix builtin microphone on ASUS Vivobook S 14 OLED 2022 (M3402RA) Same issue with this model as apparently with other Rembrandt laptops: https://bugzilla.kernel.org/show_bug.cgi?id=216270 Signed-off-by: Enrico Belleri Link: https://lore.kernel.org/r/20230427191645.24519-1-kilgore.trout@idesmi.eu Signed-off-by: Mark Brown commit b413281876292de44ae84e9a9ce9d62e47f266e9 Author: Lucas Tanure Date: Mon Apr 24 12:38:46 2023 +0100 of: fdt: Scan /memreserve/ last Change the scanning /memreserve/ and /reserved-memory node order to fix Kernel panic on Khadas Vim3 Board. If /memreserve/ goes first, the memory is reserved, but nomap can't be applied to the region. So the memory won't be used by Linux, but it is still present in the linear map as normal memory, which allows speculation. Legitimate access to adjacent pages will cause the CPU to end up prefetching into them leading to Kernel panic. So /reserved-memory node should go first, as it has a more updated description of the memory regions and can apply flags, like nomap. Link: https://lore.kernel.org/all/CAJX_Q+1Tjc+-TjZ6JW9X0NxEdFe=82a9626yL63j7uVD4LpxEA@mail.gmail.com/ Signed-off-by: Lucas Tanure Link: https://lore.kernel.org/r/20230424113846.46382-1-tanure@linux.com Signed-off-by: Rob Herring commit d88f2f72ca89ead8743ee15e547274ba248e7c59 Author: Paul Mackerras Date: Mon Apr 24 17:01:32 2023 +1000 mailmap: add entries for Paul Mackerras Link: https://lkml.kernel.org/r/ZEYpTAufVHTvsO1n@cleo Signed-off-by: Paul Mackerras Signed-off-by: Andrew Morton commit 4f20b7471c57032860065591a17efd3325216bde Author: Geert Uytterhoeven Date: Fri Apr 21 16:54:24 2023 +0200 libgcc: add forward declarations for generic library routines With W=1 on platforms that use the generic gcc library routines (csky/loongarch/mips/riscv/sh/xtensa): lib/ashldi3.c:9:19: warning: no previous prototype for '__ashldi3' [-Wmissing-prototypes] 9 | long long notrace __ashldi3(long long u, word_type b) | ^~~~~~~~~ CC lib/ashrdi3.o lib/ashrdi3.c:9:19: warning: no previous prototype for '__ashrdi3' [-Wmissing-prototypes] 9 | long long notrace __ashrdi3(long long u, word_type b) | ^~~~~~~~~ CC lib/cmpdi2.o lib/cmpdi2.c:9:19: warning: no previous prototype for '__cmpdi2' [-Wmissing-prototypes] 9 | word_type notrace __cmpdi2(long long a, long long b) | ^~~~~~~~ CC lib/lshrdi3.o lib/lshrdi3.c:9:19: warning: no previous prototype for '__lshrdi3' [-Wmissing-prototypes] 9 | long long notrace __lshrdi3(long long u, word_type b) | ^~~~~~~~~ CC lib/muldi3.o lib/muldi3.c:49:19: warning: no previous prototype for '__muldi3' [-Wmissing-prototypes] 49 | long long notrace __muldi3(long long u, long long v) | ^~~~~~~~ CC lib/ucmpdi2.o lib/ucmpdi2.c:8:19: warning: no previous prototype for '__ucmpdi2' [-Wmissing-prototypes] 8 | word_type notrace __ucmpdi2(unsigned long long a, unsigned long long b) | ^~~~~~~~~ Fix this by adding forward declarations to the common libgcc header file. Link: https://lkml.kernel.org/r/5cdbe08296693dd53849f199c3933e16e97b33c1.1682088593.git.geert+renesas@glider.be Signed-off-by: Geert Uytterhoeven Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202303272214.RxzpA6bP-lkp@intel.com/ Acked-by: Arnd Bergmann Cc: Chris Zankel Cc: Max Filippov Signed-off-by: Andrew Morton commit 4d4b6d66db63ceed399f1fb1a4b24081d2590eb1 Author: Huang Ying Date: Mon Apr 24 14:54:08 2023 +0800 mm,unmap: avoid flushing TLB in batch if PTE is inaccessible 0Day/LKP reported a performance regression for commit 7e12beb8ca2a ("migrate_pages: batch flushing TLB"). In the commit, the TLB flushing during page migration is batched. So, in try_to_migrate_one(), ptep_clear_flush() is replaced with set_tlb_ubc_flush_pending(). In further investigation, it is found that the TLB flushing can be avoided in ptep_clear_flush() if the PTE is inaccessible. In fact, we can optimize in similar way for the batched TLB flushing too to improve the performance. So in this patch, we check pte_accessible() before set_tlb_ubc_flush_pending() in try_to_unmap/migrate_one(). Tests show that the benchmark score of the anon-cow-rand-mt test case of vm-scalability test suite can improve up to 2.1% with the patch on a Intel server machine. The TLB flushing IPI can reduce up to 44.3%. Link: https://lore.kernel.org/oe-lkp/202303192325.ecbaf968-yujie.liu@intel.com Link: https://lore.kernel.org/oe-lkp/ab92aaddf1b52ede15e2c608696c36765a2602c1.camel@intel.com/ Link: https://lkml.kernel.org/r/20230424065408.188498-1-ying.huang@intel.com Fixes: 7e12beb8ca2a ("migrate_pages: batch flushing TLB") Signed-off-by: "Huang, Ying" Reported-by: kernel test robot Reviewed-by: Nadav Amit Reviewed-by: Xin Hao Cc: Mel Gorman Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 01106e140835ff94fdef79d66f166b87b0c89824 Author: Christian Brauner Date: Thu Apr 20 10:57:43 2023 +0200 shmem: restrict noswap option to initial user namespace Prevent tmpfs instances mounted in an unprivileged namespaces from evading accounting of locked memory by using the "noswap" mount option. Link: https://lkml.kernel.org/r/20230420-faxen-advokat-40abb4c1a152@brauner Signed-off-by: Christian Brauner Reported-by: Hugh Dickins Link: https://lore.kernel.org/lkml/79eae9fe-7818-a65c-89c6-138b55d609a@google.com Reviewed-by: Luis Chamberlain Cc: Adam Manzanares Cc: Davidlohr Bueso Cc: Kees Cook Cc: Matthew Wilcox (Oracle) Cc: Pankaj Raghav Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit 0175ab610c2df7c21d93e4bd63b4e67cfa86737c Author: Hugh Dickins Date: Sat Apr 22 21:47:20 2023 -0700 mm/khugepaged: fix conflicting mods to collapse_file() Inserting Ivan Orlov's syzbot fix commit 2ce0bdfebc74 ("mm: khugepaged: fix kernel BUG in hpage_collapse_scan_file()") ahead of Jiaqi Yan's and David Stevens's commits 12904d953364 ("mm/khugepaged: recover from poisoned file-backed memory") cae106dd67b9 ("mm/khugepaged: refactor collapse_file control flow") ac492b9c70ca ("mm/khugepaged: skip shmem with userfaultfd") (all of which restructure collapse_file()) did not work out well. xfstests generic/086 on huge tmpfs (with accelerated khugepaged) freezes (if not on the first attempt, then the 2nd or 3rd) in find_lock_entries() while doing drop_caches: the file's xarray seems to have been corrupted, with find_get_entry() returning nonsense which makes no progress. Bisection led to ac492b9c70ca; and diff against earlier working linux-next suggested that it's probably down to an errant xas_store(), which does not belong with the later changes (and nor does the positioning of warnings). The later changes look as if they fix the syzbot issue independently. Remove most of what's left of 2ce0bdfebc74: just leave one WARN_ON_ONCE (xas_error) after the final xas_store() of the multi-index entry. Link: https://lkml.kernel.org/r/b6c881-c352-bb91-85a8-febeb09dfd71@google.com Signed-off-by: Hugh Dickins Cc: David Stevens Cc: Ivan Orlov Cc: Jiaqi Yan Signed-off-by: Andrew Morton commit cec24b8b6bb841a19b5c5555b600a511a8988100 Merge: 556eb8b791901 2025b2ca8004c Author: Linus Torvalds Date: Thu Apr 27 12:07:50 2023 -0700 Merge tag 'char-misc-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc drivers updates from Greg KH: "Here is the "big" set of char/misc and other driver subsystems for 6.4-rc1. It's pretty big, but due to the removal of pcmcia drivers, almost breaks even for number of lines added vs. removed, a nice change. Included in here are: - removal of unused PCMCIA drivers (finally!) - Interconnect driver updates and additions - Lots of IIO driver updates and additions - MHI driver updates - Coresight driver updates - NVMEM driver updates, which required some OF updates - W1 driver updates and a new maintainer to manage the subsystem - FPGA driver updates - New driver subsystem, CDX, for AMD systems - lots of other small driver updates and additions All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (196 commits) mcb-lpc: Reallocate memory region to avoid memory overlapping mcb-pci: Reallocate memory region to avoid memory overlapping mcb: Return actual parsed size when reading chameleon table kernel/configs: Drop Android config fragments virt: acrn: Replace obsolete memalign() with posix_memalign() spmi: Add a check for remove callback when removing a SPMI driver spmi: fix W=1 kernel-doc warnings spmi: mtk-pmif: Drop of_match_ptr for ID table spmi: pmic-arb: Convert to platform remove callback returning void spmi: mtk-pmif: Convert to platform remove callback returning void spmi: hisi-spmi-controller: Convert to platform remove callback returning void w1: gpio: remove unnecessary ENOMEM messages w1: omap-hdq: remove unnecessary ENOMEM messages w1: omap-hdq: add SPDX tag w1: omap-hdq: allow compile testing w1: matrox: remove unnecessary ENOMEM messages w1: matrox: use inline over __inline__ w1: matrox: switch from asm to linux header w1: ds2482: do not use assignment in if condition w1: ds2482: drop unnecessary header ... commit 556eb8b79190151506187bf0b16dda423c34d9a8 Merge: 97b2ff294381d 046b6a171009e Author: Linus Torvalds Date: Thu Apr 27 11:53:57 2023 -0700 Merge tag 'driver-core-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the large set of driver core changes for 6.4-rc1. Once again, a busy development cycle, with lots of changes happening in the driver core in the quest to be able to move "struct bus" and "struct class" into read-only memory, a task now complete with these changes. This will make the future rust interactions with the driver core more "provably correct" as well as providing more obvious lifetime rules for all busses and classes in the kernel. The changes required for this did touch many individual classes and busses as many callbacks were changed to take const * parameters instead. All of these changes have been submitted to the various subsystem maintainers, giving them plenty of time to review, and most of them actually did so. Other than those changes, included in here are a small set of other things: - kobject logging improvements - cacheinfo improvements and updates - obligatory fw_devlink updates and fixes - documentation updates - device property cleanups and const * changes - firwmare loader dependency fixes. All of these have been in linux-next for a while with no reported problems" * tag 'driver-core-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (120 commits) device property: make device_property functions take const device * driver core: update comments in device_rename() driver core: Don't require dynamic_debug for initcall_debug probe timing firmware_loader: rework crypto dependencies firmware_loader: Strip off \n from customized path zram: fix up permission for the hot_add sysfs file cacheinfo: Add use_arch[|_cache]_info field/function arch_topology: Remove early cacheinfo error message if -ENOENT cacheinfo: Check cache properties are present in DT cacheinfo: Check sib_leaf in cache_leaves_are_shared() cacheinfo: Allow early level detection when DT/ACPI info is missing/broken cacheinfo: Add arm64 early level initializer implementation cacheinfo: Add arch specific early level initializer tty: make tty_class a static const structure driver core: class: remove struct class_interface * from callbacks driver core: class: mark the struct class in struct class_interface constant driver core: class: make class_register() take a const * driver core: class: mark class_release() as taking a const * driver core: remove incorrect comment for device_create* MIPS: vpe-cmp: remove module owner pointer from struct class usage. ... commit 97b2ff294381d05e59294a931c4db55276470cb5 Merge: b39667abcdcc7 3fac2397f562e Author: Linus Torvalds Date: Thu Apr 27 11:49:35 2023 -0700 Merge tag 'staging-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the large set of staging driver updates for 6.4-rc1. Once again, we removed more code than was added, a nice trend. It was a calm cycle, mostly all just small coding style cleanups, included in here are: - removal of the greybus loopback testing tools, userspace code that didn't belong in a driver subdirectory and was causing problems for some build systems - platform remove callback cleanups - rtl8192e huge cleanups - other small staging driver cleanups. All of these have been in linux-next for a while with no reported problems" * tag 'staging-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (185 commits) staging: rtl8192e: Fix W_DISABLE# does not work after stop/start staging: rtl8192e: Remove unchanged variables bfsync_processing and more staging: rtl8192e: Remove unchanged variable frame_sync_monitor staging: rtl8192e: Remove unchanged variable chan_forced staging: rtl8192e: Remove set to true while true of bfirst_after_down staging: rtl8192e: Remove second initialization of bActuallySet staging: rtl8192e: Remove unused macro RT_SET_PS_LEVEL staging: rtl8192e: Remove unused function rtl92e_disable_nic staging: rtl8192e: Remove unchanged variable RegRfPsLevel staging: rtl8172: Add blank lines after declarations staging: rtl8192e: Remove unused variable RF_Type staging: rtl8192e: Remove one of two checks for hardware RTL8192SE staging: rtl8192e: Remove unused function _rtl92e_dm_init_wa_broadcom_iot staging: rtl8192e: Remove macro IS_HARDWARE_TYPE_8192SE staging: greybus: drop loopback test files staging: rtl8192e: Add blank lines after declarations staging: rtl8192e: avoid CamelCase staging: rtl8192e: avoid CamelCase staging: rtl8192e: avoid CamelCase staging: rtl8192e: fix alignment to match open parenthesis ... commit b39667abcdcc754e32a0eb0df9cf49d45333d4ae Merge: 4010e62b5b684 2b3174c96696c Author: Linus Torvalds Date: Thu Apr 27 11:46:26 2023 -0700 Merge tag 'tty-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial updates from Greg KH: "Here is the big set of tty/serial driver updates for 6.4-rc1. Nothing major, just lots of tiny, constant, forward development. This includes: - obligatory n_gsm updates and feature additions - 8250_em driver updates - sh-sci driver updates - dts cleanups and updates - general cleanups and improvements by Ilpo and Jiri - other small serial driver core fixes and driver updates All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (87 commits) n_gsm: Use array_index_nospec() with index that comes from userspace tty: vt: drop checks for undefined VT_SINGLE_DRIVER tty: vt: distribute EXPORT_SYMBOL() tty: vt: simplify some cases in tioclinux() tty: vt: reformat tioclinux() tty: serial: sh-sci: Fix end of transmission on SCI tty: serial: sh-sci: Add support for tx end interrupt handling tty: serial: sh-sci: Fix TE setting on SCI IP tty: serial: sh-sci: Add RZ/G2L SCIFA DMA rx support tty: serial: sh-sci: Add RZ/G2L SCIFA DMA tx support serial: max310x: fix IO data corruption in batched operations serial: core: Disable uart_start() on uart_remove_one_port() serial: 8250: Reinit port->pm on port specific driver unbind serial: 8250: Add missing wakeup event reporting tty: serial: fsl_lpuart: use UARTMODIR register bits for lpuart32 platform tty: serial: fsl_lpuart: adjust buffer length to the intended size serial: fix TIOCSRS485 locking serial: make SiFive serial drivers depend on ARCH_ symbols tty: synclink_gt: don't allocate and pass dummy flags tty: serial: simplify qcom_geni_serial_send_chunk_fifo() ... commit 4010e62b5b684d7a6090f3f9c69f8a5be31910e5 Merge: b02847fc2e7a5 8f40fc0808137 Author: Linus Torvalds Date: Thu Apr 27 11:42:11 2023 -0700 Merge tag 'usb-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the large set of USB and Thunderbolt changes for 6.4-rc1. The "biggest" thing in here is the removal of two obsolete drivers, u132-hcd and ftdi-elan, making this a net-removal of code overall. Other than the driver removals, included in here are: - Thunderbolt updates for new hardware and features - xhci driver updates and fixes - dwc3 driver updates and fixes - gadget core and driver updates and features added - mtu3 driver updates - dwc2 driver fixes and updates - usb-serial driver updates - typec driver updates and fixes - platform remove callback changes - dts updates and conversions - other small changes All have been in linux-next for a while with no reported problems" * tag 'usb-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (177 commits) usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API usb: dwc3: gadget: Execute gadget stop after halting the controller media: radio-shark: Add endpoint checks USB: sisusbvga: Add endpoint checks USB: core: Add routines for endpoint checks in old drivers usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive dt-bindings: usb: snps,dwc3: Add 'snps,parkmode-disable-hs-quirk' quirk usb: dwc3: core: add support for disabling High-speed park mode dt-bindings: usb: ci-hdrc-usb2: allow multiple PHYs usb: mtu3: add optional clock xhci_ck and frmcnt_ck dt-bindings: usb: mtu3: add two optional clocks usb: mtu3: expose role-switch control to userspace usb: mtu3: unlock @mtu->lock just before giving back request usb: mtu3: fix kernel panic at qmu transfer done irq handler usb: mtu3: use boolean return value usb: mtu3: give back request when rx error happens usb: chipidea: fix missing goto in `ci_hdrc_probe` usb: gadget: udc: core: Prevent redundant calls to pullup usb: gadget: udc: core: Invoke usb_gadget_connect only when started usb: typec: ucsi: don't print PPM init deferred errors ... commit b02847fc2e7a55b7247cf80c14527555bdc965af Merge: 34da76dca4673 02dc51a0a07a3 Author: Linus Torvalds Date: Thu Apr 27 11:27:48 2023 -0700 Merge tag 'firewire-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: "The pull request includes a few changes, Its main purpose is to prepare for my future work by taking over maintainership from Stefan Richter. I have plans to work on several items; e.g. packet processing in workqueue context instead of tasklet. As you may be aware, the IEEE 1394 technology is outdated. However, we still have users. It is better to ensure a smooth transition for the users to shift to other categories of devices" * tag 'firewire-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: init_ohci1394_dma: use correct function names in comments MAINTAINERS: replace maintainer of FireWire subsystem commit 34da76dca4673ab1819830b4924bb5b436325b26 Merge: 725a345b2ee3c c3a6ef330a08e Author: Linus Torvalds Date: Thu Apr 27 11:23:36 2023 -0700 Merge tag 'for-linus-2023042601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - import a bunch of HID selftests from out-of-tree hid-tools project (Benjamin Tissoires) - drastically reducing Bluetooth disconnects on hid-nintendo driven devices (Daniel J. Ogorchock) - lazy initialization of battery interfaces in wacom driver (Jason Gerecke) - generic support for all Kye tablets (David Yang) - proper rumble queue overrun handling in hid-nintendo (Daniel J. Ogorchock) - support for ADC measurement in logitech-hidpp driver (Bastien Nocera) - reset GPIO support in i2c-hid (Hans de Goede) - improved handling of generic "Digitizer" usage (Jason Gerecke) - support for KEY_CAMERA_FOCUS (Feng Qi) - quirks for Apple Geyser 3 and Apple Geyser 4 (Alex Henrie) - assorted functional fixes and device ID additions * tag 'for-linus-2023042601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (54 commits) HID: amd_sfh: Fix max supported HID devices HID: wacom: generic: Set battery quirk only when we see battery data HID: wacom: Lazy-init batteries HID: Ignore battery for ELAN touchscreen on ROG Flow X13 GV301RA HID: asus: explicitly include linux/leds.h HID: lg-g15: explicitly include linux/leds.h HID: steelseries: explicitly include linux/leds.h HID: apple: Set the tilde quirk flag on the Geyser 3 HID: apple: explicitly include linux/leds.h HID: mcp2221: fix get and get_direction for gpio HID: mcp2221: fix report layout for gpio get HID: wacom: Set a default resolution for older tablets HID: i2c-hid-of: Add reset GPIO support to i2c-hid-of HID: i2c-hid-of: Allow using i2c-hid-of on non OF platforms HID: i2c-hid-of: Consistenly use dev local variable in probe() HID: kye: Fix rdesc for kye tablets HID: amd_sfh: Support for additional light sensor HID: amd_sfh: Handle "no sensors" enabled for SFH1.1 HID: amd_sfh: Increase sensor command timeout for SFH1.1 HID: amd_sfh: Correct the stop all command ... commit 725a345b2ee3c24f9ac2078eb73667e22a1b7214 Merge: 89555eebb9fb6 60ed3cd85b951 Author: Linus Torvalds Date: Thu Apr 27 11:19:51 2023 -0700 Merge tag 'fbdev-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "Nothing really exiting in here. The majority of lines changed is due to Uwe's preparation patches to change the return value of the .remove() callback to void. Summary: - vt_buffer.h: Fix build on alpha (Randy Dunlap) - mmp: Clock handling fix (Christophe JAILLET) - 68328fb, ps3fb, vfb: Init .owner field of struct fb_ops (Thomas Zimmermann) - fbdev: cg14: Convert to platform remove callback returning void - Preparation patches to convert drivers to return void in .remove() callback (Uwe Kleine-König) - Drop Paul Mackerras as rage128 maintainer" * tag 'fbdev-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (51 commits) MAINTAINERS: Remove rage128 framebuffer driver maintainer fbdev: vfb: Init owner field of struct fb_ops fbdev: ps3fb: Init owner field of struct fb_ops fbdev: 68328fb: Init owner field of struct fb_ops fbdev: mmp: Fix deferred clk handling in mmphw_probe() linux/vt_buffer.h: allow either builtin or modular for macros fbdev: xilinxfb: Convert to platform remove callback returning void fbdev: wmt_ge_rops: Convert to platform remove callback returning void fbdev: wm8505fb: Convert to platform remove callback returning void fbdev: vt8500lcdfb: Convert to platform remove callback returning void fbdev: via: Convert to platform remove callback returning void fbdev: vga16fb: Convert to platform remove callback returning void fbdev: vfb: Convert to platform remove callback returning void fbdev: vesafb: Convert to platform remove callback returning void fbdev: uvesafb: Convert to platform remove callback returning void fbdev: tcx: Convert to platform remove callback returning void fbdev: sm501fb: Convert to platform remove callback returning void fbdev: simplefb: Convert to platform remove callback returning void fbdev: sh_mobile_lcdcfb: Convert to platform remove callback returning void fbdev: sh7760fb: Convert to platform remove callback returning void ... commit 89555eebb9fb603ad43c0def8ab35e76c210002f Merge: d91f6a7307d27 38c87827ffd3c Author: Linus Torvalds Date: Thu Apr 27 11:15:36 2023 -0700 Merge tag 'i2c-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "Mostly fixes for DTs or DT handling this time. And a few driver bugfixes" * tag 'i2c-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (28 commits) i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path i2c: omap: Improve error reporting for problems during .remove() i2c: cadence: Add reset controller support dt-bindings: i2c: cadence: Document `resets` property i2c: mediatek: add support for MT7981 SoC dt-bindings: i2c: i2c-mt65xx: add MediaTek MT7981 SoC dt-bindings: i2c: Drop unneeded quotes i2c: brcmstb: use devm_platform_ioremap_resource_byname() i2c: cadence: Detect maximum transfer size i2c: cadence: Allow to specify the FIFO depth dt-bindings: i2c: cadence: Document `fifo-depth` property i2c: xiic: Use devm_platform_get_and_ioremap_resource() i2c: mpc: Use i2c-scl-clk-low-timeout-us i2c property i2c: mpc: Use of_property_read_u32 instead of of_get_property dt-bindings: i2c: mpc: Mark "fsl,timeout" as deprecated i2c: xiic: hide OF related data for COMPILE_TEST i2c: synquacer: mark OF related data as maybe unused dt-bindings: i2c: i2c-mt65xx: Add compatible for MT6795 Helio X10 i2c: imx: Simplify using devm_clk_get_enabled() ... commit d91f6a7307d27eae7b954c82bebf55071914c3f2 Merge: fc2e58b8b7c94 d08076678ce72 Author: Linus Torvalds Date: Thu Apr 27 11:07:18 2023 -0700 Merge tag 'for-linus-6.4-1' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Minor bug fixes for the IPMI driver There was a bug in the SSIF driver where in certain conditions it could stop working. Outside of that: spelling fixes, removing some dead code, re-adding a missing statistic increment, and removal of register_sysctl_table()" * tag 'for-linus-6.4-1' of https://github.com/cminyard/linux-ipmi: ipmi:ssif: Drop if blocks with always false condition ipmi: fix SSIF not responding under certain cond. ipmi:ssif: Add send_retries increment char:ipmi:Fix spelling mistake "asychronously" -> "asynchronously" ipmi: simplify sysctl registration ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it commit fc2e58b8b7c94b8fe23977775550de00472f6a74 Merge: 1c15ca4e4efad cc5f6fa4f6590 Author: Linus Torvalds Date: Thu Apr 27 11:02:26 2023 -0700 Merge tag 'spi-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "A fairly standard release for SPI with the exception of a change to the API for specifying chip selects done in preparation for supporting devices with more than one chip select, this required some mechanical changes throughout the tree which have been cooking in -next happily for a while. There's also a new API to allow us to support TPM chips on half duplex controllers. Summary: - Refactoring in preparation for supporting multiple chip selects for a single device, needed by some flash devices, which required a change in the SPI device API visible throughout the tree - Support for hardware assisted interaction with SPI TPMs on half duplex controllers, implemented on nVidia Tedra210 QuadSPI - Optimisation for large transfers on fsl-cpm devices - Cleanups around device property use which fix some sisues with fwnode - Use of both void remove() and devm_platform_.*ioremap_resource() - Support for AMD Pensando Elba, Amlogic A1, Cadence device mode, Intel MetorLake-S and StarFive J7110 QuadSPI" * tag 'spi-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (185 commits) spi: bcm63xx: use macro DEFINE_SIMPLE_DEV_PM_OPS spi: tegra210-quad: Enable TPM wait polling spi: Add TPM HW flow flag spi: bcm63xx: remove PM_SLEEP based conditional compilation spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS spi: spi-cadence: Add support for Slave mode spi: spi-cadence: Switch to spi_controller structure spi: cadence-quadspi: fix suspend-resume implementations spi: dw: Add support for AMD Pensando Elba SoC spi: dw: Add AMD Pensando Elba SoC SPI Controller spi: cadence-quadspi: Disable the SPI before reconfiguring spi: cadence-quadspi: Update the read timeout based on the length spi: spi-loopback-test: Add module param for iteration length spi: add support for Amlogic A1 SPI Flash Controller dt-bindings: spi: add Amlogic A1 SPI controller spi: fsl-spi: No need to check transfer length versus word size spi: fsl-spi: Change mspi_apply_cpu_mode_quirks() to void spi: fsl-cpm: Use 16 bit mode for large transfers with even size spi: fsl-spi: Re-organise transfer bits_per_word adaptation spi: fsl-spi: Fix CPM/QE mode Litte Endian ... commit 1c15ca4e4efaddb78f83eed31eeee34c522c3ae2 Merge: 34b62f186db96 baa6584a24494 Author: Linus Torvalds Date: Thu Apr 27 10:58:37 2023 -0700 Merge tag 'sound-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "At this time, it's an interesting mixture of changes for both old and new stuff. Majority of changes are about ASoC (lots of systematic changes for converting remove callbacks to void, and cleanups), while we got the fixes and the enhancements of very old PCI cards, too. Here are some highlights: ALSA/ASoC Core: - Continued effort of more ASoC core cleanups - Minor improvements for XRUN handling in indirect PCM helpers - Code refactoring of PCM core code ASoC: - Continued feature and simplification work on SOF, including addition of a no-DSP mode for bringup, HDA MLink and extensions to the IPC4 protocol - Hibernation support for CS35L45 - More DT binding conversions - Support for Cirrus Logic CS35L56, Freescale QMC, Maxim MAX98363, nVidia systems with MAX9809x and RT5631, Realtek RT712, Renesas R-Car Gen4, Rockchip RK3588 and TI TAS5733 ALSA: - Lots of works for legacy emu10k1 and ymfpci PCI drivers - PCM kselftest fixes and enhancements" * tag 'sound-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (586 commits) ALSA: emu10k1: use high-level I/O in set_filterQ() ALSA: emu10k1: use high-level I/O functions also during init ALSA: emu10k1: fix error handling in snd_audigy_i2c_volume_put() ALSA: emu10k1: don't stop DSP in _snd_emu10k1_{,audigy_}init_efx() ALSA: emu10k1: fix SNDRV_EMU10K1_IOCTL_SINGLE_STEP ALSA: emu10k1: skip Sound Blaster-specific hacks for E-MU cards ALSA: emu10k1: fixup DSP defines ALSA: emu10k1: pull in some register definitions from kX-project ALSA: emu10k1: remove some bogus defines ALSA: emu10k1: eliminate some unused defines ALSA: emu10k1: fix lineup of EMU_HANA_* defines ALSA: emu10k1: comment updates ALSA: emu10k1: fix snd_emu1010_fpga_read() input masking for rev2 cards ALSA: emu10k1: remove unused emu->pcm_playback_efx_substream field ALSA: emu10k1: remove unused `resume` parameter from snd_emu10k1_init() ALSA: emu10k1: minor optimizations ALSA: emu10k1: remove remaining cruft from snd_emu10k1_emu1010_init() ALSA: emu10k1: remove apparently pointless EMU_HANA_OPTION_CARDS reads ALSA: emu10k1: remove apparently pointless FPGA reads ALSA: emu10k1: stop doing weird things with HCFG in snd_emu10k1_emu1010_init() ... commit 34b62f186db9614e55d021f8c58d22fc44c57911 Merge: cb6fe2ceb667e 09a8e5f01dfb3 Author: Linus Torvalds Date: Thu Apr 27 10:45:30 2023 -0700 Merge tag 'pci-v6.4-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Resource management: - Add pci_dev_for_each_resource() and pci_bus_for_each_resource() iterators PCIe native device hotplug: - Fix AB-BA deadlock between reset_lock and device_lock Power management: - Wait longer for devices to become ready after resume (as we do for reset) to accommodate Intel Titan Ridge xHCI devices - Extend D3hot delay for NVIDIA HDA controllers to avoid unrecoverable devices after a bus reset Error handling: - Clear PCIe Device Status after EDR since generic error recovery now only clears it when AER is native ASPM: - Work around Chromebook firmware defect that clobbers Capability list (including ASPM L1 PM Substates Cap) when returning from D3cold to D0 Freescale i.MX6 PCIe controller driver: - Install imprecise external abort handler only when DT indicates PCIe support Freescale Layerscape PCIe controller driver: - Add ls1028a endpoint mode support Qualcomm PCIe controller driver: - Add SM8550 DT binding and driver support - Add SDX55 DT binding and driver support - Use bulk APIs for clocks of IP 1.0.0, 2.3.2, 2.3.3 - Use bulk APIs for reset of IP 2.1.0, 2.3.3, 2.4.0 - Add DT "mhi" register region for supported SoCs - Expose link transition counts via debugfs to help debug low power issues - Support system suspend and resume; reduce interconnect bandwidth and turn off clock and PHY if there are no active devices - Enable async probe by default to reduce boot time Miscellaneous: - Sort controller Kconfig entries by vendor" * tag 'pci-v6.4-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (56 commits) PCI: xilinx: Drop obsolete dependency on COMPILE_TEST PCI: mobiveil: Sort Kconfig entries by vendor PCI: dwc: Sort Kconfig entries by vendor PCI: Sort controller Kconfig entries by vendor PCI: Use consistent controller Kconfig menu entry language PCI: xilinx-nwl: Add 'Xilinx' to Kconfig prompt PCI: hv: Add 'Microsoft' to Kconfig prompt PCI: meson: Add 'Amlogic' to Kconfig prompt PCI: Use of_property_present() for testing DT property presence PCI/PM: Extend D3hot delay for NVIDIA HDA controllers dt-bindings: PCI: qcom: Document msi-map and msi-map-mask properties PCI: qcom: Add SM8550 PCIe support dt-bindings: PCI: qcom: Add SM8550 compatible PCI: qcom: Add support for SDX55 SoC dt-bindings: PCI: qcom-ep: Fix the unit address used in example dt-bindings: PCI: qcom: Add SDX55 SoC dt-bindings: PCI: qcom: Update maintainers entry PCI: qcom: Enable async probe by default PCI: qcom: Add support for system suspend and resume PCI/PM: Drop pci_bridge_wait_for_secondary_bus() timeout parameter ... commit bd4468295e7a335319c10affdf594b56f1e6c0a4 Author: Artem Bityutskiy Date: Wed Apr 19 17:39:47 2023 +0300 intel_idle: mark few variables as __read_mostly The intention is to clean up the code and make it look a bit more consistent. Mark all unitialized module parameter variables as __read_mostly, not just one of them. The other parameters are read-mostly too. Signed-off-by: Artem Bityutskiy Signed-off-by: Rafael J. Wysocki commit 4152379a701ad66b6c4e1c9fc93704d993e49615 Author: Artem Bityutskiy Date: Thu Apr 20 09:47:21 2023 +0300 intel_idle: do not sprinkle module parameter definitions around This is a cleanup which improves code consistency. Move the force_irq_on module parameter variable and definition to the same place where we have variables and definitions for other module parameters. Signed-off-by: Artem Bityutskiy Reviewed-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit db1ae0c99950502d10e09d0c57ed1e16cd854b20 Author: Artem Bityutskiy Date: Wed Apr 19 17:39:45 2023 +0300 intel_idle: fix confusing message By default, all non-POLL C-states are entered with interrupts disabled. There are 2 ways to make 'intel_idle' enter C-states with interrupts enabled: 1. Mark the C-state with the CPUIDLE_FLAG_IRQ_ENABLE flag. 2. Use the force_irq_on module parameter. The former is the "proper" way of doing it, it is per-C-state and per-platform. The latter is for debugging purposes only. The problem is that intel_idle prints the "forced intel_idle_irq" message in both cases, even though the former case does not needed this message, because nothing is forced there. This patch addresses the problem. Signed-off-by: Artem Bityutskiy Reviewed-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 00433eae1771d355f20c152ddc5976baedb427e2 Author: Artem Bityutskiy Date: Wed Apr 19 17:39:44 2023 +0300 intel_idle: improve C-state flags handling robustness The following C-state flags are currently mutually-exclusive and should not be combined: * IRQ_ENABLE * IBRS * XSTATE There is a warning for the situation when the IRQ_ENABLE flag is combined with the IBRS flag, but no warnings for other combinations. This is inconsistent and prone to errors. Improve the situation by adding warnings for all the unexpected combinations. Add a couple of helpful commentaries too. Signed-off-by: Artem Bityutskiy Reviewed-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 1abffbd827668b3b44c34b168ccb5ee2866714a8 Author: Artem Bityutskiy Date: Wed Apr 19 17:39:43 2023 +0300 intel_idle: further intel_idle_init_cstates_icpu() cleanup Introduce a temporary 'state' variable for referencing the currently processed C-state in the intel_idle_init_cstates_icpu() function. This makes code lines shorter and easier to read. Signed-off-by: Artem Bityutskiy Reviewed-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit a78032e94bf16e9c53238cd83c82095b4a251d4b Author: Artem Bityutskiy Date: Thu Apr 20 09:47:18 2023 +0300 intel_idle: clean up intel_idle_init_cstates_icpu() The intel_idle_init_cstates_icpu() function includes a loop that iterates over every C-state. Inside the loop, the same C-state data is referenced 2 ways: 1. as cpuidle_state_table[cstate] 2. as drv->states[drv->state_count] (but it is a copy of #1, not the same object). Make the code be more consistent and easier to read by using only the 2nd way. So the code structure would be as follows: 1. Use cpuidle_state_table[cstate] 2. Copy cpuidle_state_table[cstate] to drv->states[drv->state_count] 3. Use only drv->states[drv->state_count] from this point. Note, this change introduces a checkpatch.pl warning (too long line), but it will be addressed in the next patch. Signed-off-by: Artem Bityutskiy Reviewed-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 91048ce4227868000bfe624707e42274ef2198aa Author: Artem Bityutskiy Date: Wed Apr 19 17:39:41 2023 +0300 intel_idle: use pr_info() instead of printk() Substitute 'printk()' with 'pr_info()', because 'intel_idle' already uses 'pr_debug()', so using 'pr_info()' will be more consistent. In addition to this, this patch addresses the following checkpatch.pl warning: WARNING: printk() should include KERN_ facility level Signed-off-by: Artem Bityutskiy Reviewed-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 2b6a7409ac390d3edb49822ea602ac129486ea3f Author: Rafael J. Wysocki Date: Wed Apr 26 18:46:05 2023 +0200 thermal: intel: menlow: Get rid of this driver According to my information, there are no active users of this driver in the field. Moreover, it does some really questionable things and gets in the way of thermal core improvements, so drop it. Signed-off-by: Rafael J. Wysocki Acked-by: Daniel Lezcano commit a4b81715a58e0ddf10bc2df2185566b73b9ae616 Author: Daniel Lezcano Date: Wed Apr 19 10:33:42 2023 +0200 ACPI: thermal: Move to dedicated function sysfs extra attr creation The ACPI thermal driver creates extra sysfs attributes in its own directory pointing to the thermal zone it is related to and add a pointer to the sysfs ACPI thermal device from the thermal zone sysfs entry. This is very specific to this ACPI thermal driver, let's encapsulate the related creation/deletion code to group it inside a function we can identify later for removal if needed. Signed-off-by: Daniel Lezcano [ rjw: Subject adjustment, removal of trailing white space ] Signed-off-by: Rafael J. Wysocki commit 66d39e74bf490fb1ef90e13086b68d6df6e6ad06 Author: Daniel Lezcano Date: Wed Apr 19 10:33:40 2023 +0200 ACPI: thermal: Use thermal_zone_device() In order to get the device associated with the thermal zone, let's use the wrapper thermal_zone_device() instead of accessing directly the content of the thermal zone device structure. Signed-off-by: Daniel Lezcano [ rjw: Subject adjustment, removal of trailing white space ] Signed-off-by: Rafael J. Wysocki commit ba7894be5e57d5c154c793e5411889275e68644e Author: Daniel Lezcano Date: Wed Apr 19 10:33:39 2023 +0200 thermal: intel: pch_thermal: Use thermal driver device to write a trace The pch_critical() callback accesses the thermal zone device structure internals, it dereferences the thermal zone struct device and the 'type'. Use the available accessors instead of accessing the structure directly. Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 7cefbaf081eb7c114299f7478ed4fa0d90ec90bb Author: Daniel Lezcano Date: Wed Apr 19 10:33:38 2023 +0200 thermal: core: Encapsulate tz->device field There are still some drivers needing to play with the thermal zone device internals. That is not the best but until we can figure out if the information is really needed, let's encapsulate the field used in the thermal zone device structure, so we can move forward relocating the thermal zone device structure definition in the thermal framework private headers. Some drivers are accessing tz->device, that implies they need to have the knowledge of the thermal_zone_device structure but we want to self-encapsulate this structure and reduce the scope of the structure to the thermal core only. By adding this wrapper, these drivers won't need the thermal zone device structure definition and are no longer an obstacle to its relocation to the private thermal core headers. Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit e4006bfec12cec4fb251de860d384dd34e6df346 Author: Zhang Rui Date: Tue Mar 21 13:47:14 2023 +0800 thermal: gov_step_wise: Adjust code logic to match comment For the algorithm of choosing the next target state in step_wise governor, the code does the right thing but is implemented in a way different from what the comment describes. And this hurts the code readability. As the logic in the comment is simpler, adjust the code logic to align with the comment. No functional change. Signed-off-by: Zhang Rui [ rjw: Subject edit ] Signed-off-by: Rafael J. Wysocki commit cead266cdbcfa471f54590ebfd3ebf303f99123f Author: Zhang Rui Date: Tue Mar 21 13:47:13 2023 +0800 thermal: gov_step_wise: Delete obsolete comment Commit 4102c4042a33 ("thermal/core: Remove DROP_FULL and RAISE_FULL") removes support for THERMAL_TREND_RAISE_FULL/DROP_FULL but leaves the comment unchanged. Delete the obsolte comment about THERMAL_TREND_RAISE_FULL/DROP_FULL. Fixes: 4102c4042a33 ("thermal/core: Remove DROP_FULL and RAISE_FULL") Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit cb6fe2ceb667eb78f252d473b03deb23999ab1cf Merge: d42b1c47570eb 1c5e9170ad93d Author: Linus Torvalds Date: Thu Apr 27 10:09:05 2023 -0700 Merge tag 'devicetree-for-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull more devicetree updates from Rob Herring: - First part of DT header detangling dropping cpu.h from of_device.h and replacing some includes with forward declarations. A handful of drivers needed some adjustment to their includes as a result. - Refactor of_device.h to be used by bus drivers rather than various device drivers. This moves non-bus related functions out of of_device.h. The end goal is for of_platform.h and of_device.h to stop including each other. - Refactor open coded parsing of "ranges" in some bus drivers to use DT address parsing functions - Add some new address parsing functions of_property_read_reg(), of_range_count(), and of_range_to_resource() in preparation to convert more open coded parsing of DT addresses to use them. - Treewide clean-ups to use of_property_read_bool() and of_property_present() as appropriate. The ones here are the ones that didn't get picked up elsewhere. * tag 'devicetree-for-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (34 commits) bus: tegra-gmi: Replace of_platform.h with explicit includes hte: Use of_property_present() for testing DT property presence w1: w1-gpio: Use of_property_read_bool() for boolean properties virt: fsl: Use of_property_present() for testing DT property presence soc: fsl: Use of_property_present() for testing DT property presence sbus: display7seg: Use of_property_read_bool() for boolean properties sparc: Use of_property_read_bool() for boolean properties sparc: Use of_property_present() for testing DT property presence bus: mvebu-mbus: Remove open coded "ranges" parsing of/address: Add of_property_read_reg() helper of/address: Add of_range_count() helper of/address: Add support for 3 address cell bus of/address: Add of_range_to_resource() helper of: unittest: Add bus address range parsing tests of: Drop cpu.h include from of_device.h OPP: Adjust includes to remove of_device.h irqchip: loongson-eiointc: Add explicit include for cpuhotplug.h cpuidle: Adjust includes to remove of_device.h cpufreq: sun50i: Add explicit include for cpu.h cpufreq: Adjust includes to remove of_device.h ... commit 5904de0d735bbb3b4afe9375c5b4f9748f882945 Author: Chen Yu Date: Fri Apr 14 20:10:42 2023 +0800 PM: hibernate: Do not get block device exclusively in test_resume mode The system refused to do a test_resume because it found that the swap device has already been taken by someone else. Specifically, the swsusp_check()->blkdev_get_by_dev(FMODE_EXCL) is supposed to do this check. Steps to reproduce: dd if=/dev/zero of=/swapfile bs=$(cat /proc/meminfo | awk '/MemTotal/ {print $2}') count=1024 conv=notrunc mkswap /swapfile swapon /swapfile swap-offset /swapfile echo 34816 > /sys/power/resume_offset echo test_resume > /sys/power/disk echo disk > /sys/power/state PM: Using 3 thread(s) for compression PM: Compressing and saving image data (293150 pages)... PM: Image saving progress: 0% PM: Image saving progress: 10% ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) ata1.00: configured for UDMA/100 ata2: SATA link down (SStatus 0 SControl 300) ata5: SATA link down (SStatus 0 SControl 300) ata6: SATA link down (SStatus 0 SControl 300) ata3: SATA link down (SStatus 0 SControl 300) ata4: SATA link down (SStatus 0 SControl 300) PM: Image saving progress: 20% PM: Image saving progress: 30% PM: Image saving progress: 40% PM: Image saving progress: 50% pcieport 0000:00:02.5: pciehp: Slot(0-5): No device found PM: Image saving progress: 60% PM: Image saving progress: 70% PM: Image saving progress: 80% PM: Image saving progress: 90% PM: Image saving done PM: hibernation: Wrote 1172600 kbytes in 2.70 seconds (434.29 MB/s) PM: S| PM: hibernation: Basic memory bitmaps freed PM: Image not found (code -16) This is because when using the swapfile as the hibernation storage, the block device where the swapfile is located has already been mounted by the OS distribution(usually mounted as the rootfs). This is not an issue for normal hibernation, because software_resume()->swsusp_check() happens before the block device(rootfs) mount. But it is a problem for the test_resume mode. Because when test_resume happens, the block device has been mounted already. Thus remove the FMODE_EXCL for test_resume mode. This would not be a problem because in test_resume stage, the processes have already been frozen, and the race condition described in Commit 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in swsusp_check()") is unlikely to happen. Fixes: 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in swsusp_check()") Reported-by: Yifan Li Suggested-by: Pavankumar Kondeti Tested-by: Pavankumar Kondeti Tested-by: Wendy Wang Signed-off-by: Chen Yu Signed-off-by: Rafael J. Wysocki commit 08169a162f97819d3e5b4a342bb9cf5137787154 Author: Chen Yu Date: Fri Apr 14 20:10:26 2023 +0800 PM: hibernate: Turn snapshot_test into global variable There is need to check snapshot_test and open block device in different mode, so as to avoid the race condition. No functional changes intended. Suggested-by: Pavankumar Kondeti Signed-off-by: Chen Yu Signed-off-by: Rafael J. Wysocki commit dd2358321e1aa0cf3808b353e02fae2ddf005a72 Merge: 5e0ca0bfc33b7 2afa82d1fc648 Author: Rafael J. Wysocki Date: Thu Apr 27 18:55:15 2023 +0200 Merge tag 'thermal-v6.4-rc1-3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull more thermal control changes for 6.4-rc1 from Daniel Lezcano: "- Add compatible strings DT bindings for imx6sll and imx6ul to fix dtbs check warning (Stefan Wahren) - Update the example in the DT bindings to reflect changes with the ADC node name for QCom TM and TM5 (Marijn Suijten) - Fix the comments for the cpuidle_cooling_register() function to match the function prototype (Chenggang Wang) - Fix inconsistent temperature read and some Mediatek variant board reboot by reverting a change and handling the temperature differently (AngeloGioacchino Del Regno) - Fix a memory leak in the initialization error path for the Mediatek driver (Kang Chen) - Use of_address_to_resource() in the Mediatek driver (Rob Herring) - Fix unit address in the QCom tsens driver DT bindings (Krzysztof Kozlowski)" * tag 'thermal-v6.4-rc1-3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: dt-bindings: thermal: qcom-tsens: Correct unit address thermal/drivers/mediatek: Use of_address_to_resource() thermal/drivers/mediatek: Change clk_prepare_enable to devm_clk_get_enabled in mtk_thermal_probe thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe thermal/drivers/mediatek: Add temperature constraints to validate read Revert "thermal/drivers/mediatek: Add delay after thermal banks initialization" thermal/drivers/cpuidle_cooling: Delete unmatched comments dt-bindings: thermal: Use generic ADC node name in examples dt-bindings: imx-thermal: Add imx6sll and imx6ul compatible commit 9bde7fb8940f636f4338bf233883ae37844dcdb7 Author: Hector Martin Date: Mon Apr 24 15:46:57 2023 +0900 ACPI: property: Support strings in Apple _DSM props The Wi-Fi module in x86 Apple machines has a "module-instance" device property that specifies the platform type and is used for firmware selection. Its value is a string, so add support for string values in acpi_extract_apple_properties(). Reviewed-by: Lukas Wunner Acked-by: Linus Walleij Signed-off-by: Hector Martin Signed-off-by: Rafael J. Wysocki commit 61711941d8515c6d2a8a95d89e132902b56feebd Author: Marius Hoch Date: Sat Apr 22 18:44:01 2023 +0200 ACPI: x86: utils: Remove Lenovo Yoga Tablet 2's MAGN0001 The LSM303D on the Lenovo Yoga Tablet 2 series is present as both ACCL0001 and MAGN0001. As we can only ever register an i2c client for one of them, ignore MAGN0001. Currently this errors: i2c i2c-4: Failed to register i2c client MAGN0001:00 at 0x1d (-16) Tested on a Lenovo Yoga Tablet 2 1051-F. Signed-off-by: Marius Hoch Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 9b04d99788cf475cbd277f30ec66230ccb7e99f4 Author: Hans de Goede Date: Thu Apr 20 13:02:20 2023 +0200 ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini The CPR3 power resource on the Toshiba Click Mini toggles a GPIO which is called SISP (for SIS touchscreen power?) on/off. This CPR3 power resource is not listed in any _PR? lists, let alone in a _PR0 list for the SIS0817 touchscreen ACPI device which needs it. Before commit a1224f34d72a ("ACPI: PM: Check states of power resources during initialization") this was not an issue because since nothing referenced the CPR3 power resource its state was always ACPI_POWER_RESOURCE_STATE_UNKNOWN and power resources with this state get ignored by acpi_turn_off_unused_power_resources(). This clearly is a bug in the DSDT of this device. Add a DMI quirk to make acpi_turn_off_unused_power_resources() a no-op on this model to fix the touchscreen no longer working since kernel 5.16 . This quirk also causes 2 other power resources to not get turned off, but the _OFF method on these already was a no-op, so this makes no difference for the other 2 power resources. Fixes: a1224f34d72a ("ACPI: PM: Check states of power resources during initialization") Reported-by: Gé Koerkamp Link: https://bugzilla.kernel.org/show_bug.cgi?id=216946 Link: https://lore.kernel.org/regressions/32a14a8a-9795-4c8c-7e00-da9012f548f8@leemhuis.info/ Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 8325642d2757eba80210dec727bb0bcffb837ff1 Author: Andreas Kemnade Date: Wed Apr 19 13:18:06 2023 +0200 leds: bd2606mvv: Driver for the Rohm 6 Channel i2c LED driver The device provides 6 channels which can be individually turned off and on but groups of two channels share a common brightness register. Limitation: The GPIO to enable the device is not used yet. Signed-off-by: Andreas Kemnade Reviewed-by: Matti Vaittinen Acked-by: Pavel Machek Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230419111806.1100437-3-andreas@kemnade.info commit d42b1c47570eb2ed818dc3fe94b2678124af109d Merge: 6df969b77ecc2 66ae053516766 Author: Linus Torvalds Date: Thu Apr 27 09:23:57 2023 -0700 Merge tag 'devicetree-for-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "Bindings: - Convert Qcom IOMMU, Amlogic timer, Freescale sec-v4.0, Toshiba TC358764 display bridge, Parade PS8622 display bridge, and Xilinx FPGA bindings to DT schema format - Add qdu1000 and sa8775p SoC support to Qcom PDC interrupt controller - Add MediaTek MT8365 UART and SYSIRQ bindings - Add Arm Cortex-A78C and X1C core compatibles - Add vendor prefix for Novatek - Remove bindings for stih415, sti416, stid127 platforms - Drop uneeded quotes in schema files. This is preparation for yamllint checking quoting for us. - Add missing (unevaluated|additional)Properties constraints on child node schemas - Clean-up schema comments formatting - Fix I2C and SPI node bus names in schema examples - Clean-up some display compatibles schema syntax - Fix incorrect references to lvds.yaml - Gather all cache controller bindings in a common directory DT core: - Convert unittest to new void .remove platform device hook - kerneldoc fixes for DT address of_pci_range_to_resource/ of_address_to_resource functions" * tag 'devicetree-for-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (46 commits) dt-bindings: rng: Drop unneeded quotes dt-bindings: arm/soc: mediatek: Drop unneeded quotes dt-bindings: soc: qcom: Drop unneeded quotes dt-bindings: i2c: samsung: Fix 'deprecated' value dt-bindings: display: Fix lvds.yaml references dt-bindings: display: simplify compatibles syntax dt-bindings: display: mediatek: simplify compatibles syntax dt-bindings: drm/bridge: ti-sn65dsi86: Fix the video-interfaces.yaml references dt-bindings: timer: Drop unneeded quotes dt-bindings: interrupt-controller: qcom,pdc: document qcom,qdu1000-pdc dt-bindings: interrupt-controller: qcom-pdc: add compatible for sa8775p dt-bindings: reset: remove stih415/stih416 reset dt-bindings: net: dwmac: sti: remove stih415/sti416/stid127 dt-bindings: irqchip: sti: remove stih415/stih416 and stid127 dt-bindings: iommu: Convert QCOM IOMMU to YAML dt-bindings: irqchip: ti,sci-inta: Add optional power-domains property dt-bindings: Add missing (unevaluated|additional)Properties on child node schemas of: address: Reshuffle to remove forward declarations of: address: Fix documented return value of of_pci_range_to_resource() of: address: Document return value of of_address_to_resource() ... commit 6df969b77ecc2ba21dcd0e57f416e58bec2a5ca1 Merge: 32f7ad0fbe752 62e37c86bf071 Author: Linus Torvalds Date: Thu Apr 27 09:08:08 2023 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "Two series: - Reorganize how the hardware page table objects are managed, particularly their destruction flow. Increase the selftest test coverage in this area by creating a more complete mock iommu driver. This is preparation to add a replace operation for HWPT binding, which is done but waiting for the VFIO parts to complete so there is a user. - Split the iommufd support for "access" to make it two step - allocate an access then link it to an IOAS. Update VFIO and have VFIO always create an access even for the VFIO mdevs that never do DMA. This is also preperation for the replace VFIO series that will allow replace to work on access types as well. Three minor fixes: - Sykzaller found the selftest code didn't check for overflow when processing user VAs - smatch noted a .data item should have been static - Add a selftest that reproduces a syzkaller bug for batch carry already fixed in rc" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: (21 commits) iommufd/selftest: Cover domain unmap with huge pages and access iommufd/selftest: Set varaiable mock_iommu_device storage-class-specifier to static vfio: Check the presence for iommufd callbacks in __vfio_register_dev() vfio/mdev: Uses the vfio emulated iommufd ops set in the mdev sample drivers vfio-iommufd: Make vfio_iommufd_emulated_bind() return iommufd_access ID vfio-iommufd: No need to record iommufd_ctx in vfio_device iommufd: Create access in vfio_iommufd_emulated_bind() iommu/iommufd: Pass iommufd_ctx pointer in iommufd_get_ioas() iommufd/selftest: Catch overflow of uptr and length iommufd/selftest: Add a selftest for iommufd_device_attach() with a hwpt argument iommufd/selftest: Make selftest create a more complete mock device iommufd/selftest: Rename the remaining mock device_id's to stdev_id iommufd/selftest: Rename domain_id to hwpt_id for FIXTURE iommufd_mock_domain iommufd/selftest: Rename domain_id to stdev_id for FIXTURE iommufd_ioas iommufd/selftest: Rename the sefltest 'device_id' to 'stdev_id' iommufd: Make iommufd_hw_pagetable_alloc() do iopt_table_add_domain() iommufd: Move iommufd_device to iommufd_private.h iommufd: Move ioas related HWPT destruction into iommufd_hw_pagetable_destroy() iommufd: Consistently manage hwpt_item iommufd: Add iommufd_lock_obj() around the auto-domains hwpts ... commit d906be3fa571f6fc9381911304a0eca99f1b6951 Author: Bharath SM Date: Wed Apr 26 14:05:16 2023 +0000 SMB3: Close deferred file handles in case of handle lease break We should not cache deferred file handles if we dont have handle lease on a file. And we should immediately close all deferred handles in case of handle lease break. Fixes: 9e31678fb403 ("SMB3: fix lease break timeout when multiple deferred close handles for the same file.") Signed-off-by: Bharath SM Signed-off-by: Steve French commit 6e0c2bf2ca34046fe17a978a092925d411ce3a8c Author: Chris Paterson Date: Wed Apr 26 11:09:25 2023 +0100 dt-bindings: clock: r9a06g032-sysctrl: Change maintainer to Fabrizio Castro Gareth no longer works for Renesas. Signed-off-by: Chris Paterson Acked-by: Fabrizio Castro Link: https://lore.kernel.org/r/20230426100925.12063-1-chris.paterson2@renesas.com Signed-off-by: Rob Herring commit d25728563dc950c813ee963c14a8493931612e8d Author: Chris Paterson Date: Wed Apr 26 11:08:32 2023 +0100 dt-bindings: pinctrl: renesas,rzv2m: Change maintainer to Fabrizio Castro Phil no longer works for Renesas. Signed-off-by: Chris Paterson Acked-by: Fabrizio Castro Link: https://lore.kernel.org/r/20230426100832.11945-1-chris.paterson2@renesas.com Signed-off-by: Rob Herring commit ae98cbffcb4b15140f36ec3172b085deffda48f4 Author: Chris Paterson Date: Wed Apr 26 11:08:02 2023 +0100 dt-bindings: pinctrl: renesas,rzn1: Change maintainer to Fabrizio Castro Gareth no longer works for Renesas. Signed-off-by: Chris Paterson Acked-by: Fabrizio Castro Link: https://lore.kernel.org/r/20230426100802.11860-1-chris.paterson2@renesas.com Signed-off-by: Rob Herring commit f30ec5df80a0a3328ad6b9c2434ccaa331505307 Author: Chris Paterson Date: Wed Apr 26 11:07:36 2023 +0100 dt-bindings: i2c: renesas,rzv2m: Change maintainer to Fabrizio Castro Phil no longer works for Renesas. Signed-off-by: Chris Paterson Acked-by: Fabrizio Castro Link: https://lore.kernel.org/r/20230426100736.11808-1-chris.paterson2@renesas.com Signed-off-by: Rob Herring commit ab9ddc87a9055c4bebd6524d5d761d605d52e557 Author: Bharath SM Date: Thu Apr 20 13:54:33 2023 +0000 SMB3: Add missing locks to protect deferred close file list cifs_del_deferred_close function has a critical section which modifies the deferred close file list. We must acquire deferred_lock before calling cifs_del_deferred_close function. Fixes: ca08d0eac020 ("cifs: Fix memory leak on the deferred close") Signed-off-by: Bharath SM Acked-off-by: Paulo Alcantara (SUSE) Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit 32f7ad0fbe7521de2a5e8f79c33d46110247fd7c Merge: 7e7757876f258 cf03e2956af30 Author: Linus Torvalds Date: Thu Apr 27 08:28:08 2023 -0700 Merge tag 'drm-next-2023-04-27' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "A bit out of routine fixes pull for rc1. There's a build breakage on some platforms due to ttm, this has that fix + qaic uapi removal + minor panel fixes. ttm: - Fix TTM build on archs where PMD_SHIFT is not constant qaic: - Revert uAPI from accel/qaic panel: - Improve error handling in nt35950 - Fix double unregister in otm8009a when removing the driver" * tag 'drm-next-2023-04-27' of git://anongit.freedesktop.org/drm/drm: drm/panel: novatek-nt35950: Only unregister DSI1 if it exists drm/panel: otm8009a: Set backlight parent to panel device drm/panel: novatek-nt35950: Improve error handling drm/ttm: revert "Reduce the number of used allocation orders for TTM pages" Revert "accel/qaic: Add mhi_qaic_cntl" commit 7e7757876f258d99266e7b3c559639289a2a45fe Author: Vlastimil Babka Date: Thu Apr 27 16:09:59 2023 +0200 mm/mremap: fix vm_pgoff in vma_merge() case 3 After upgrading build guests to v6.3, rpm started segfaulting for specific packages, which was bisected to commit 0503ea8f5ba7 ("mm/mmap: remove __vma_adjust()"). rpm is doing many mremap() operations with file mappings of its db. The problem is that in vma_merge() case 3 (we merge with the next vma, expanding it downwards) vm_pgoff is not adjusted as it should when vm_start changes. As a result the rpm process most likely sees data from the wrong offset of the file. Fix the vm_pgoff calculation. For case 8 this is a non-functional change as the resulting vm_pgoff is the same. Reported-and-bisected-by: Jiri Slaby Reported-and-tested-by: Fabian Vogt Link: https://bugzilla.suse.com/show_bug.cgi?id=1210903 Fixes: 0503ea8f5ba7 ("mm/mmap: remove __vma_adjust()") Signed-off-by: Vlastimil Babka Cc: Signed-off-by: Linus Torvalds commit 067eb084592819ad59d07afcb5de3e61cee2757c Author: Vitaly Rodionov Date: Thu Apr 27 12:04:52 2023 +0100 ALSA: hda/realtek: Add quirk for ThinkPad P1 Gen 6 Lenovo ThinkPad P1 Gen 6 laptop has 2 CS35L41 amplifies on I2C bus connected to Realtek codec. Signed-off-by: Vitaly Rodionov Cc: Link: https://lore.kernel.org/r/20230427110452.13787-1-vitalyr@opensource.cirrus.com Signed-off-by: Takashi Iwai commit ea3292986cc90fdd9ad9aa7018ee0651736a4529 Merge: c51e431052e2e 2ae147d643d32 Author: Takashi Iwai Date: Thu Apr 27 14:21:18 2023 +0200 Merge branch 'for-linus' into for-next Merge 6.3-devel branch back in order to apply the more Realtek HD-audio changes cleanly. Signed-off-by: Takashi Iwai commit 075cafffce2429dfa0085c98162657e88d11aa1d Merge: c23ae5091a8b3 3c99bace4ad08 Author: Paolo Abeni Date: Thu Apr 27 12:39:11 2023 +0200 Merge branch 'macsec-fixes-for-cn10kb' Geetha sowjanya says: ==================== Macsec fixes for CN10KB This patch set has fixes for the issues encountered while testing macsec on CN10KB silicon. Below is the description of patches: Patch 1: For each LMAC two MCSX_MCS_TOP_SLAVE_CHANNEL_CFG registers exist in CN10KB. Bypass has to be disabled in two registers. Patch 2: Add workaround for errata w.r.t accessing TCAM DATA and MASK registers. Patch 3: Fixes the parser configuration to allow PTP traffic. Patch 4: Addresses the IP vector and block level interrupt mask changes. Patch 5: Fix NULL pointer crashes when rebooting Patch 6: Since MCS is global block shared by all LMACS the TCAM match must include macsec DMAC also to distinguish each macsec interface Patch 7: Before freeing MCS hardware resource to AF clear the stats also. Patch 8: Stats which share single counter in hardware are tracked in software. This tracking was based on wrong secy mode params. Use correct secy mode params Patch 9: When updating secy mode params, PN number was also reset to initial values. Hence do not write to PN value register when updating secy. ==================== Link: https://lore.kernel.org/r/20230426062528.20575-1-gakula@marvell.com Signed-off-by: Paolo Abeni commit 3c99bace4ad08ad0264285ba8ad73117560992c2 Author: Subbaraya Sundeep Date: Wed Apr 26 11:55:28 2023 +0530 octeontx2-pf: mcs: Do not reset PN while updating secy After creating SecYs, SCs and SAs a SecY can be modified to change attributes like validation mode, protect frames mode etc. During this SecY update, packet number is reset to initial user given value by mistake. Hence do not reset PN when updating SecY parameters. Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit 9bdfe61054fb2b989eb58df20bf99c0cf67e3038 Author: Subbaraya Sundeep Date: Wed Apr 26 11:55:27 2023 +0530 octeontx2-pf: mcs: Fix shared counters logic Macsec stats like InPktsLate and InPktsDelayed share same counter in hardware. If SecY replay_protect is true then counter represents InPktsLate otherwise InPktsDelayed. This mode change was tracked based on protect_frames instead of replay_protect mistakenly. Similarly InPktsUnchecked and InPktsOk share same counter and mode change was tracked based on validate_check instead of validate_disabled. This patch fixes those problems. Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit 815debbbf7b52026462c37eea3be70d6377a7a9a Author: Subbaraya Sundeep Date: Wed Apr 26 11:55:26 2023 +0530 octeontx2-pf: mcs: Clear stats before freeing resource When freeing MCS hardware resources like SecY, SC and SA the corresponding stats needs to be cleared. Otherwise previous stats are shown in newly created macsec interfaces. Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit 57d00d4364f314485092667d2a48718985515deb Author: Subbaraya Sundeep Date: Wed Apr 26 11:55:25 2023 +0530 octeontx2-pf: mcs: Match macsec ethertype along with DMAC On CN10KB silicon a single hardware macsec block is present and offloads macsec operations for all the ethernet LMACs. TCAM match with macsec ethertype 0x88e5 alone at RX side is not sufficient to distinguish all the macsec interfaces created on top of netdevs. Hence append the DMAC of the macsec interface too. Otherwise the first created macsec interface only receives all the macsec traffic. Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit 699af748c61574125d269db260dabbe20436d74e Author: Subbaraya Sundeep Date: Wed Apr 26 11:55:24 2023 +0530 octeontx2-pf: mcs: Fix NULL pointer dereferences When system is rebooted after creating macsec interface below NULL pointer dereference crashes occurred. This patch fixes those crashes by using correct order of teardown [ 3324.406942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 3324.415726] Mem abort info: [ 3324.418510] ESR = 0x96000006 [ 3324.421557] EC = 0x25: DABT (current EL), IL = 32 bits [ 3324.426865] SET = 0, FnV = 0 [ 3324.429913] EA = 0, S1PTW = 0 [ 3324.433047] Data abort info: [ 3324.435921] ISV = 0, ISS = 0x00000006 [ 3324.439748] CM = 0, WnR = 0 .... [ 3324.575915] Call trace: [ 3324.578353] cn10k_mdo_del_secy+0x24/0x180 [ 3324.582440] macsec_common_dellink+0xec/0x120 [ 3324.586788] macsec_notify+0x17c/0x1c0 [ 3324.590529] raw_notifier_call_chain+0x50/0x70 [ 3324.594965] call_netdevice_notifiers_info+0x34/0x7c [ 3324.599921] rollback_registered_many+0x354/0x5bc [ 3324.604616] unregister_netdevice_queue+0x88/0x10c [ 3324.609399] unregister_netdev+0x20/0x30 [ 3324.613313] otx2_remove+0x8c/0x310 [ 3324.616794] pci_device_shutdown+0x30/0x70 [ 3324.620882] device_shutdown+0x11c/0x204 [ 966.664930] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 966.673712] Mem abort info: [ 966.676497] ESR = 0x96000006 [ 966.679543] EC = 0x25: DABT (current EL), IL = 32 bits [ 966.684848] SET = 0, FnV = 0 [ 966.687895] EA = 0, S1PTW = 0 [ 966.691028] Data abort info: [ 966.693900] ISV = 0, ISS = 0x00000006 [ 966.697729] CM = 0, WnR = 0 [ 966.833467] Call trace: [ 966.835904] cn10k_mdo_stop+0x20/0xa0 [ 966.839557] macsec_dev_stop+0xe8/0x11c [ 966.843384] __dev_close_many+0xbc/0x140 [ 966.847298] dev_close_many+0x84/0x120 [ 966.851039] rollback_registered_many+0x114/0x5bc [ 966.855735] unregister_netdevice_many.part.0+0x14/0xa0 [ 966.860952] unregister_netdevice_many+0x18/0x24 [ 966.865560] macsec_notify+0x1ac/0x1c0 [ 966.869303] raw_notifier_call_chain+0x50/0x70 [ 966.873738] call_netdevice_notifiers_info+0x34/0x7c [ 966.878694] rollback_registered_many+0x354/0x5bc [ 966.883390] unregister_netdevice_queue+0x88/0x10c [ 966.888173] unregister_netdev+0x20/0x30 [ 966.892090] otx2_remove+0x8c/0x310 [ 966.895571] pci_device_shutdown+0x30/0x70 [ 966.899660] device_shutdown+0x11c/0x204 [ 966.903574] __do_sys_reboot+0x208/0x290 [ 966.907487] __arm64_sys_reboot+0x20/0x30 [ 966.911489] el0_svc_handler+0x80/0x1c0 [ 966.915316] el0_svc+0x8/0x180 [ 966.918362] Code: f9400000 f9400a64 91220014 f94b3403 (f9400060) [ 966.924448] ---[ end trace 341778e799c3d8d7 ]--- Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit b8aebeaaf9ffb1e99c642eb3751e28981f9be475 Author: Geetha sowjanya Date: Wed Apr 26 11:55:23 2023 +0530 octeontx2-af: mcs: Fix MCS block interrupt On CN10KB, MCS IP vector number, BBE and PAB interrupt mask got changed to support more block level interrupts. To address this changes, this patch fixes the bbe and pab interrupt handlers. Fixes: 6c635f78c474 ("octeontx2-af: cn10k: mcs: Handle MCS block interrupts") Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit 65cdc2b637a5749c7dec0ce14fe2c48f1f91f671 Author: Geetha sowjanya Date: Wed Apr 26 11:55:22 2023 +0530 octeontx2-af: mcs: Config parser to skip 8B header When ptp timestamp is enabled in RPM, RPM will append 8B timestamp header for all RX traffic. MCS need to skip these 8 bytes header while parsing the packet header, so that correct tcam key is created for lookup. This patch fixes the mcs parser configuration to skip this 8B header for ptp packets. Fixes: ca7f49ff8846 ("octeontx2-af: cn10k: Introduce driver for macsec block.") Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit b51612198603fce33d6cf57b4864e3018a1cd9b8 Author: Subbaraya Sundeep Date: Wed Apr 26 11:55:21 2023 +0530 octeontx2-af: mcs: Write TCAM_DATA and TCAM_MASK registers at once As per hardware errata on CN10KB, all the four TCAM_DATA and TCAM_MASK registers has to be written at once otherwise write to individual registers will fail. Hence write to all TCAM_DATA registers and then to all TCAM_MASK registers. Fixes: cfc14181d497 ("octeontx2-af: cn10k: mcs: Manage the MCS block hardware resources") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Geetha sowjanya Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit c222b292a3568754828ffd30338d2909b14ed160 Author: Geetha sowjanya Date: Wed Apr 26 11:55:20 2023 +0530 octeonxt2-af: mcs: Fix per port bypass config For each lmac port, MCS has two MCS_TOP_SLAVE_CHANNEL_CONFIGX registers. For CN10KB both register need to be configured for the port level mcs bypass to work. This patch also sets bitmap of flowid/secy entry reserved for default bypass so that these entries can be shown in debugfs. Fixes: bd69476e86fc ("octeontx2-af: cn10k: mcs: Install a default TCAM for normal traffic") Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Reviewed-by: Leon Romanovsky Signed-off-by: Paolo Abeni commit c23ae5091a8b3e50fe755257df020907e7c029bb Author: John Hickey Date: Tue Apr 25 10:03:08 2023 -0700 ixgbe: Fix panic during XDP_TX with > 64 CPUs Commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus") adds support to allow XDP programs to run on systems with more than 64 CPUs by locking the XDP TX rings and indexing them using cpu % 64 (IXGBE_MAX_XDP_QS). Upon trying this out patch on a system with more than 64 cores, the kernel paniced with an array-index-out-of-bounds at the return in ixgbe_determine_xdp_ring in ixgbe.h, which means ixgbe_determine_xdp_q_idx was just returning the cpu instead of cpu % IXGBE_MAX_XDP_QS. An example splat: ========================================================================== UBSAN: array-index-out-of-bounds in /var/lib/dkms/ixgbe/5.18.6+focal-1/build/src/ixgbe.h:1147:26 index 65 is out of range for type 'ixgbe_ring *[64]' ========================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000058 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 65 PID: 408 Comm: ksoftirqd/65 Tainted: G IOE 5.15.0-48-generic #54~20.04.1-Ubuntu Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.5.4 01/13/2020 RIP: 0010:ixgbe_xmit_xdp_ring+0x1b/0x1c0 [ixgbe] Code: 3b 52 d4 cf e9 42 f2 ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 55 b9 00 00 00 00 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 <44> 0f b7 47 58 0f b7 47 5a 0f b7 57 54 44 0f b7 76 08 66 41 39 c0 RSP: 0018:ffffbc3fcd88fcb0 EFLAGS: 00010282 RAX: ffff92a253260980 RBX: ffffbc3fe68b00a0 RCX: 0000000000000000 RDX: ffff928b5f659000 RSI: ffff928b5f659000 RDI: 0000000000000000 RBP: ffffbc3fcd88fce0 R08: ffff92b9dfc20580 R09: 0000000000000001 R10: 3d3d3d3d3d3d3d3d R11: 3d3d3d3d3d3d3d3d R12: 0000000000000000 R13: ffff928b2f0fa8c0 R14: ffff928b9be20050 R15: 000000000000003c FS: 0000000000000000(0000) GS:ffff92b9dfc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 000000011dd6a002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ixgbe_poll+0x103e/0x1280 [ixgbe] ? sched_clock_cpu+0x12/0xe0 __napi_poll+0x30/0x160 net_rx_action+0x11c/0x270 __do_softirq+0xda/0x2ee run_ksoftirqd+0x2f/0x50 smpboot_thread_fn+0xb7/0x150 ? sort_range+0x30/0x30 kthread+0x127/0x150 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x1f/0x30 I think this is how it happens: Upon loading the first XDP program on a system with more than 64 CPUs, ixgbe_xdp_locking_key is incremented in ixgbe_xdp_setup. However, immediately after this, the rings are reconfigured by ixgbe_setup_tc. ixgbe_setup_tc calls ixgbe_clear_interrupt_scheme which calls ixgbe_free_q_vectors which calls ixgbe_free_q_vector in a loop. ixgbe_free_q_vector decrements ixgbe_xdp_locking_key once per call if it is non-zero. Commenting out the decrement in ixgbe_free_q_vector stopped my system from panicing. I suspect to make the original patch work, I would need to load an XDP program and then replace it in order to get ixgbe_xdp_locking_key back above 0 since ixgbe_setup_tc is only called when transitioning between XDP and non-XDP ring configurations, while ixgbe_xdp_locking_key is incremented every time ixgbe_xdp_setup is called. Also, ixgbe_setup_tc can be called via ethtool --set-channels, so this becomes another path to decrement ixgbe_xdp_locking_key to 0 on systems with more than 64 CPUs. Since ixgbe_xdp_locking_key only protects the XDP_TX path and is tied to the number of CPUs present, there is no reason to disable it upon unloading an XDP program. To avoid confusion, I have moved enabling ixgbe_xdp_locking_key into ixgbe_sw_init, which is part of the probe path. Fixes: 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus") Signed-off-by: John Hickey Reviewed-by: Maciej Fijalkowski Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230425170308.2522429-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit 1b483d9f5805c7e3d628d4995e97f4311fcb82eb Author: Pedro Tammela Date: Tue Apr 25 11:47:25 2023 -0300 net/sched: act_pedit: free pedit keys on bail from offset check Ido Schimmel reports a memleak on a syzkaller instance: BUG: memory leak unreferenced object 0xffff88803d45e400 (size 1024): comm "syz-executor292", pid 563, jiffies 4295025223 (age 51.781s) hex dump (first 32 bytes): 28 bd 70 00 fb db df 25 02 00 14 1f ff 02 00 02 (.p....%........ 00 32 00 00 1f 00 00 00 ac 14 14 3e 08 00 07 00 .2.........>.... backtrace: [] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [] slab_post_alloc_hook mm/slab.h:772 [inline] [] slab_alloc_node mm/slub.c:3452 [inline] [] __kmem_cache_alloc_node+0x25c/0x320 mm/slub.c:3491 [] __do_kmalloc_node mm/slab_common.c:966 [inline] [] __kmalloc+0x59/0x1a0 mm/slab_common.c:980 [] kmalloc include/linux/slab.h:584 [inline] [] tcf_pedit_init+0x793/0x1ae0 net/sched/act_pedit.c:245 [] tcf_action_init_1+0x453/0x6e0 net/sched/act_api.c:1394 [] tcf_action_init+0x5a8/0x950 net/sched/act_api.c:1459 [] tcf_action_add+0x118/0x4e0 net/sched/act_api.c:1985 [] tc_ctl_action+0x377/0x490 net/sched/act_api.c:2044 [] rtnetlink_rcv_msg+0x46d/0xd70 net/core/rtnetlink.c:6395 [] netlink_rcv_skb+0x185/0x490 net/netlink/af_netlink.c:2575 [] rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:6413 [] netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] [] netlink_unicast+0x5be/0x8a0 net/netlink/af_netlink.c:1365 [] netlink_sendmsg+0x9af/0xed0 net/netlink/af_netlink.c:1942 [] sock_sendmsg_nosec net/socket.c:724 [inline] [] sock_sendmsg net/socket.c:747 [inline] [] ____sys_sendmsg+0x3ef/0xaa0 net/socket.c:2503 [] ___sys_sendmsg+0x122/0x1c0 net/socket.c:2557 [] __sys_sendmsg+0x11f/0x200 net/socket.c:2586 [] __do_sys_sendmsg net/socket.c:2595 [inline] [] __se_sys_sendmsg net/socket.c:2593 [inline] [] __x64_sys_sendmsg+0x80/0xc0 net/socket.c:2593 The recently added static offset check missed a free to the key buffer when bailing out on error. Fixes: e1201bc781c2 ("net/sched: act_pedit: check static offsets a priori") Reported-by: Ido Schimmel Signed-off-by: Pedro Tammela Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Link: https://lore.kernel.org/r/20230425144725.669262-1-pctammela@mojatatu.com Signed-off-by: Paolo Abeni commit 32eff6bacec2cb574677c15378169a9fa30043ef Author: Ivan Vecera Date: Tue Apr 25 16:06:04 2023 +0200 net/sched: flower: Fix wrong handle assignment during filter change Commit 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier") moved filter handle initialization but an assignment of the handle to fnew->handle is done regardless of fold value. This is wrong because if fold != NULL (so fold->handle == handle) no new handle is allocated and passed handle is assigned to fnew->handle. Then if any subsequent action in fl_change() fails then the handle value is removed from IDR that is incorrect as we will have still valid old filter instance with handle that is not present in IDR. Fix this issue by moving the assignment so it is done only when passed fold == NULL. Prior the patch: [root@machine tc-testing]# ./tdc.py -d enp1s0f0np0 -e 14be Test 14be: Concurrently replace same range of 100k flower filters from 10 tc instances exit: 123 exit: 0 RTNETLINK answers: Invalid argument We have an error talking to the kernel Command failed tmp/replace_6:1885 All test results: 1..1 not ok 1 14be - Concurrently replace same range of 100k flower filters from 10 tc instances Command exited with 123, expected 0 RTNETLINK answers: Invalid argument We have an error talking to the kernel Command failed tmp/replace_6:1885 After the patch: [root@machine tc-testing]# ./tdc.py -d enp1s0f0np0 -e 14be Test 14be: Concurrently replace same range of 100k flower filters from 10 tc instances All test results: 1..1 ok 1 14be - Concurrently replace same range of 100k flower filters from 10 tc instances Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier") Signed-off-by: Ivan Vecera Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230425140604.169881-1-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 2b5fdc0f5caa505afe34d608e2eefadadf2ee67a Author: David Howells Date: Tue Apr 25 13:56:35 2023 +0100 rxrpc: Fix potential data race in rxrpc_wait_to_be_connected() Inside the loop in rxrpc_wait_to_be_connected() it checks call->error to see if it should exit the loop without first checking the call state. This is probably safe as if call->error is set, the call is dead anyway, but we should probably wait for the call state to have been set to completion first, lest it cause surprise on the way out. Fix this by only accessing call->error if the call is complete. We don't actually need to access the error inside the loop as we'll do that after. This caused the following report: BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_set_call_completion write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1: rxrpc_set_call_completion+0x71/0x1c0 net/rxrpc/call_state.c:22 rxrpc_send_data_packet+0xba9/0x1650 net/rxrpc/output.c:479 rxrpc_transmit_one+0x1e/0x130 net/rxrpc/output.c:714 rxrpc_decant_prepared_tx net/rxrpc/call_event.c:326 [inline] rxrpc_transmit_some_data+0x496/0x600 net/rxrpc/call_event.c:350 rxrpc_input_call_event+0x564/0x1220 net/rxrpc/call_event.c:464 rxrpc_io_thread+0x307/0x1d80 net/rxrpc/io_thread.c:461 kthread+0x1ac/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 read to 0xffff888159cf3c50 of 4 bytes by task 25672 on cpu 0: rxrpc_send_data+0x29e/0x1950 net/rxrpc/sendmsg.c:296 rxrpc_do_sendmsg+0xb7a/0xc20 net/rxrpc/sendmsg.c:726 rxrpc_sendmsg+0x413/0x520 net/rxrpc/af_rxrpc.c:565 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2501 ___sys_sendmsg net/socket.c:2555 [inline] __sys_sendmmsg+0x263/0x500 net/socket.c:2641 __do_sys_sendmmsg net/socket.c:2670 [inline] __se_sys_sendmmsg net/socket.c:2667 [inline] __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 -> 0xffffffea Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread") Reported-by: syzbot+ebc945fdb4acd72cba78@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/000000000000e7c6d205fa10a3cd@google.com/ Signed-off-by: David Howells cc: Marc Dionne cc: Dmitry Vyukov cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/508133.1682427395@warthog.procyon.org.uk Signed-off-by: Paolo Abeni commit d893f39320e1248d1c97fde0d6e51e5ea008a76b Author: Leo Chen Date: Tue Apr 11 10:49:38 2023 -0400 drm/amd/display: Lowering min Z8 residency time [Why & How] Per HW team request, we're lowering the minimum Z8 residency time to 2000us. This enables Z8 support for additional modes we were previously blocking like 2k>60hz Cc: stable@vger.kernel.org Tested-by: Daniel Wheeler Reviewed-by: Nicholas Kazlauskas Acked-by: Rodrigo Siqueira Signed-off-by: Leo Chen Signed-off-by: Alex Deucher commit 08da182175db4c7f80850354849d95f2670e8cd9 Author: Hamza Mahfooz Date: Fri Apr 14 14:26:27 2023 -0400 drm/amd/display: fix flickering caused by S/G mode Currently, on a handful of ASICs. We allow the framebuffer for a given plane to exist in either VRAM or GTT. However, if the plane's new framebuffer is in a different memory domain than it's previous framebuffer, flipping between them can cause the screen to flicker. So, to fix this, don't perform an immediate flip in the aforementioned case. Cc: stable@vger.kernel.org Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2354 Reviewed-by: Roman Li Fixes: 81d0bcf99009 ("drm/amdgpu: make display pinning more flexible (v2)") Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit 9675b3ba99ec79273d94afa09e9b69e2b8c0d238 Author: Igor Kravchenko Date: Fri Jul 10 16:24:30 2020 -0400 drm/amd/display: Set min_width and min_height capability for DCN30 Add min_width, min_height fields to dc_plane_cap structure. Set values to 16x16 for discrete ASICs, and 64x64 for others. Reviewed-by: Rodrigo Siqueira Signed-off-by: Igor Kravchenko Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3caab67db1f69e077fb12ac194d3cd2a4de06d8d Author: Jasdeep Dhillon Date: Tue Feb 28 11:46:31 2023 -0500 drm/amd/display: Isolate remaining FPU code in DCN32 [Why] DCN32 resource contains code that uses FPU. [How] Moved code into DCN32 FPU Reviewed-by: Rodrigo Siqueira Signed-off-by: Jasdeep Dhillon Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 989cd3e76a4aab76fe7dd50090ac3fa501c537f6 Author: Aurabindo Pillai Date: Thu Apr 6 15:59:45 2023 -0400 drm/amd/display: Update bounding box values for DCN321 [Why&how] Update bounding box values as per hardware spec Fixes: 197485c69543 ("drm/amd/display: Create dcn321_fpu file") Acked-by: Leo Li Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 99d92eaca5d915763b240aae24669f5bf3227ecf Author: Aurabindo Pillai Date: Thu Apr 6 15:48:48 2023 -0400 drm/amd/display: Do not clear GPINT register when releasing DMUB from reset [Why & How] There's no need to clear GPINT register for DMUB when releasing it from reset. Fix that. Fixes: ac2e555e0a7f ("drm/amd/display: Add DMCUB source files and changes for DCN32/321") Reviewed-by: Leo Li Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 425afa0ac99a05b39e6cd00704fa0e3e925cee2b Author: Cruise Hung Date: Fri May 13 09:16:42 2022 +0800 drm/amd/display: Reset OUTBOX0 r/w pointer on DMUB reset [Why & How] We missed resetting OUTBOX0 mailbox r/w pointer on DMUB reset. Fix it. Fixes: 6ecf9773a503 ("drm/amd/display: Fix DMUB outbox trace in S4 (#4465)") Signed-off-by: Cruise Hung Acked-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d1c5c3e252b8a911a524e6ee33b82aca81397745 Author: Aurabindo Pillai Date: Thu Apr 6 12:28:59 2023 -0400 drm/amd/display: Fixes for dcn32_clk_mgr implementation [Why&How] Fix CLK MGR early initialization and add logging. Fixes: 265280b99822 ("drm/amd/display: add CLKMGR changes for DCN32/321") Reviewed-by: Leo Li Reviewed-by: Qingqing Zhuo Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b1bcdd409d2d158867ce0b71cfa9bcefe83ce07f Author: Tianci Yin Date: Mon Feb 6 15:58:46 2023 +0800 drm/amd/display: Disable migration to ensure consistency of per-CPU variable [why] Since the variable fpu_recursion_depth is per-CPU type, it has one copy on each CPU, thread migration causes data consistency issue, then the call trace shows up. And preemption disabling can't prevent migration. [how] Disable migration to ensure consistency of fpu_recursion_depth. Reviewed-by: Aurabindo Pillai Signed-off-by: Tianci Yin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fc3888fe2c63b35a22db8234d142823a5ffda9d8 Author: Aurabindo Pillai Date: Wed Apr 5 16:17:42 2023 -0400 drm/amd/display: remove incorrect early return [Why&How] Remove incorrect early return in a device specific fifo reset workaround Reviewed-by: Leo Li Reviewed-by: Qingqing Zhuo Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit dd24662d9dfbad281bbf030f06d68c7938fa0c66 Author: Hersen Wu Date: Sun May 29 10:54:30 2022 -0400 drm/amd/display: Return error code on DSC atomic check failure [Why&How] We were not returning -EINVAL on DSC atomic check fail. Add it. Fixes: 71be4b16d39a ("drm/amd/display: dsc validate fail not pass to atomic check") Reviewed-by: Aurabindo Pillai Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e0cce122514ff76c3c986103c94de68fbb401949 Author: Jingwen Zhu Date: Thu Mar 30 16:38:59 2023 +0800 drm/amd/display: Improvement for handling edp link training fails [Why] The eDP retrain will cause the DPCD 300 to be reset to default. And cause the brightness can't be set correctly. [How] delete the call to edp panel power control in both enable_link_output/disable_link_output entirely and only call edp panel control in enable_link_dp and  disable_link_dp once. Reviewed-by: Charlene Liu Acked-by: Qingqing Zhuo Signed-off-by: Jingwen Zhu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 56d8ce9d8c17bea955b0c2551ee86149486890ae Author: Michael Mityushkin Date: Thu Mar 30 11:35:08 2023 -0400 drm/amd/display: Apply correct panel mode when reinitializing hardware [Why] When link training during engine recovery, ASSR might fail causing panel mode to be reset to default. This should not happen for eDP as it will prevent the panel from turning back on. [How] Added dp_panel_mode to struct dc_link to remember previously applied panel mode. Do not reset panel mode to default while performing link training if previously used panel mode = eDP. Reviewed-by: Nicholas Kazlauskas Acked-by: Qingqing Zhuo Signed-off-by: Michael Mityushkin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3cf7cd3f770a0b89dc5f06e19edb52e65b93b214 Author: Hersen Wu Date: Tue Mar 28 10:45:24 2023 -0400 drm/amd/display: fix access hdcp_workqueue assert [Why] hdcp are enabled for asics from raven. for old asics which hdcp are not enabled, hdcp_workqueue are null. some access to hdcp work queue are not guarded with pointer check. [How] add hdcp_workqueue pointer check before access workqueue. Fixes: 82986fd631fa ("drm/amd/display: save restore hdcp state when display is unplugged from mst hub") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2444 Reported-by: Niklāvs Koļesņikovs <89q1r14hd@relay.firefox.com> Reviewed-by: Bhawanpreet Lakha Acked-by: Qingqing Zhuo Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 0c0463ff010b80a0c03937ca8cf85587ded2f20e Author: Alvin Lee Date: Tue Mar 28 09:53:33 2023 -0400 drm/amd/display: Reduce SubVP + DRR stretch margin [Description] - Having excessively large margin causes failure in the static schedulability check in some cases for SubVP + DRR - 100us of DRR margin is sufficient based on a weeks worth of stress testing on different display configs Reviewed-by: Michael Strauss Acked-by: Qingqing Zhuo Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 025ce392b5f213696ca0af3e07735d0fae020694 Author: Hersen Wu Date: Mon Mar 27 09:10:48 2023 -0400 drm/amd/display: fix memleak in aconnector->timing_requested [Why] when amdgpu_dm_update_connector_after_detect is called two times successively with valid sink, memory allocated of aconnector->timing_requested for the first call is not free. this causes memeleak. [How] allocate memory only when aconnector->timing_requested is null. Reviewed-by: Qingqing Zhuo Acked-by: Qingqing Zhuo Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit da5e14909776edea4462672fb4a3007802d262e7 Author: Aurabindo Pillai Date: Fri Mar 24 10:42:37 2023 -0400 drm/amd/display: Fix hang when skipping modeset [Why&How] When skipping full modeset since the only state change was a front porch change, the DC commit sequence requires extra checks to handle non existant plane states being asked to be removed from context. Reviewed-by: Alvin Lee Acked-by: Qingqing Zhuo Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3fb7efd6866e5d43770e999b33d619a3b345dc2f Author: Alex Hung Date: Wed Mar 15 19:09:15 2023 +0800 drm/amd/display: allow edp updates for virtual signal [Why] When IGT's kms_hdmi_inject forces EDID for HDMI audio, dc rejects the request because virtual signal is not in dc_is_audio_capable_signal function. [How] Includes SIGNAL_TYPE_VIRTUAL as audio capable. Reviewed-by: Chao-kai Wang Acked-by: Qingqing Zhuo Signed-off-by: Alex Hung Signed-off-by: Wenchieh Chien Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f11aee97b13ea6817287cd8dbed9b09a260ff0e7 Author: Josip Pavic Date: Fri May 14 14:04:02 2021 -0400 drm/amd/display: copy dmub caps to dc on dcn31 [Why & How] Add code path to copy dmub caps to dc, which is missing on dcn31 Acked-by: Qingqing Zhuo Signed-off-by: Josip Pavic Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 822b84ecfc646da0f87fd947fa00dc3be5e45ecc Author: Rodrigo Siqueira Date: Tue Apr 4 14:54:05 2023 -0600 drm/amd/display: Add missing WA and MCLK validation When the commit fff7eb56b376 ("drm/amd/display: Don't set dram clock change requirement for SubVP") was merged, we missed some parts associated with the MCLK switch. This commit adds all the missing parts. Fixes: fff7eb56b376 ("drm/amd/display: Don't set dram clock change requirement for SubVP") Reviewed-by: Aurabindo Pillai Signed-off-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ce560ac40272a5c8b5b68a9d63a75edd9e66aed2 Author: Wesley Chalmers Date: Tue Feb 28 13:48:00 2023 -0500 drm/amd/display: Block optimize on consecutive FAMS enables [WHY] It is possible to commit state multiple times in rapid succession with FAMS enabled; if each of these commits were to set optimized_required, then the user may see latency. [HOW] fw_based_mclk_switching is currently not used in dc->clk_mgr; use it to track whether the current state has FAMS enabled; if it has, then do not disable FAMS in prepare_bandwidth, and do not set optimized_required. Reviewed-by: Rodrigo Siqueira Signed-off-by: Wesley Chalmers Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 474f01015ffdb74e01c2eb3584a2822c64e7b2be Author: Wesley Chalmers Date: Thu Nov 3 22:29:31 2022 -0400 drm/amd/display: Do not set drr on pipe commit [WHY] Writing to DRR registers such as OTG_V_TOTAL_MIN on the same frame as a pipe commit can cause underflow. [HOW] Move DMUB p-state delegate into optimze_bandwidth; enabling FAMS sets optimized_required. This change expects that Freesync requests are blocked when optimized_required is true. Reviewed-by: Rodrigo Siqueira Signed-off-by: Wesley Chalmers Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit cf03e2956af307dc25e8c41fd4cffe44482a6ec1 Merge: 289af45508ca8 a50be876f4fe2 Author: Dave Airlie Date: Thu Apr 27 11:29:33 2023 +1000 Merge tag 'drm-misc-next-fixes-2023-04-26' of git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next-fixes for v6.4-rc1: - Revert uAPI from accel/qaic. - Fix TTM build on archs where PMD_SHIFT is not constant. - Improve error handling in nt35950. - Fix double unregister in otm8009a when removing the driver. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/45757de9-75d8-5b41-f1f9-562a7c4675b9@linux.intel.com commit ff53cd52d9bdbf4074d2bbe9b591729997780bd3 Author: Thomas Weißschuh Date: Sat Mar 18 17:36:25 2023 +0000 blk-integrity: register sysfs attributes on struct device The "integrity" kobject only acted as a holder for static sysfs entries. It also was embedded into struct gendisk without managing it, violating assumptions of the driver core. Instead register the sysfs entries directly onto the struct device. Also drop the now unused member integrity_kobj from struct gendisk. Suggested-by: Christoph Hellwig Signed-off-by: Thomas Weißschuh Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20230309-kobj_release-gendisk_integrity-v3-3-ceccb4493c46@weissschuh.net Signed-off-by: Jens Axboe commit 76b8c319f02715e14abdbbbdd6508e83a1059bcc Author: Thomas Weißschuh Date: Sat Mar 18 17:36:24 2023 +0000 blk-integrity: convert to struct device_attribute An upcoming patch will register the integrity attributes directly with the struct device kobject. For this the attributes have to be implemented in terms of struct device_attribute. Signed-off-by: Thomas Weißschuh Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20230309-kobj_release-gendisk_integrity-v3-2-ceccb4493c46@weissschuh.net Signed-off-by: Jens Axboe commit 3315e169b446249c1b61ff988d157238f4b2c5a0 Author: Thomas Weißschuh Date: Sat Mar 18 17:36:23 2023 +0000 blk-integrity: use sysfs_emit The correct way to emit data into sysfs is via sysfs_emit(), use it. Also perform some trivial syntactic cleanups. Signed-off-by: Thomas Weißschuh Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20230309-kobj_release-gendisk_integrity-v3-1-ceccb4493c46@weissschuh.net Signed-off-by: Jens Axboe commit 202c044203ac5860e3025169105368d99f9bc6a2 Author: Marijn Suijten Date: Thu Apr 27 00:37:22 2023 +0200 drm/msm/dpu: Remove duplicate register defines from INTF The INTF_FRAME_LINE_COUNT_EN, INTF_FRAME_COUNT and INTF_LINE_COUNT registers are already defined higher up, in the right place when sorted numerically. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Marijn Suijten Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/534231/ Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-8-27ce1a5ab5c6@somainline.org Signed-off-by: Abhinav Kumar commit 7557f58b6383e560dd5dc5267aceb8372f2a4426 Author: Marijn Suijten Date: Thu Apr 27 00:37:21 2023 +0200 drm/msm/dpu: Set PINGPONG block length to zero for DPU >= 7.0.0 Despite downstream DTS stating otherwise, the PINGPONG block has no registers starting with DPU revision 7.0.0. TEAR registers are gone since DPU 5.0.0 after being moved to the INTF block, and DSC registers are gone since 7.0.0, leaving only the dither sub-block. A future patch, part of the DSC 1.2 series, should disable DSC functions on the PINGPONG block for all DPU >= 7.0.0 hardware. Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") Fixes: 0e91bcbb0016 ("drm/msm/dpu: Add SM8350 to hw catalog") Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450") Signed-off-by: Marijn Suijten Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/534206/ Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-7-27ce1a5ab5c6@somainline.org Signed-off-by: Abhinav Kumar commit fe47a3084789fd653a3465ba39ea4afe33fc6d19 Author: Marijn Suijten Date: Thu Apr 27 00:37:20 2023 +0200 drm/msm/dpu: Use V2 DITHER PINGPONG sub-block in SM8[34]50/SC8280XP According to downstream sources this DITHER sub-block sits at an offset of 0xe0 with version 0x20000. Lets fix this by using sc7280_pp_sblk instead of sdm845_pp_sblk. Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") Fixes: 0e91bcbb0016 ("drm/msm/dpu: Add SM8350 to hw catalog") Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450") Signed-off-by: Marijn Suijten Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/534208/ Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-6-27ce1a5ab5c6@somainline.org [quic_abhinavk@quicinc.com: minor fix in the commit message] Signed-off-by: Abhinav Kumar commit 701f69183d4d52533fb2af0d6948b7d1b00d1a09 Author: Marijn Suijten Date: Thu Apr 27 00:37:19 2023 +0200 drm/msm/dpu: Fix PP_BLK_DIPHER -> DITHER typo SM8550 exclusively has a DITHER sub-block inside the PINGPONG block and no other registers, hence the DITHER name of the macro and a corresponding PINGPONG block length of zero. However, the PP_BLK_ macro name was typo'd to DIPHER rather than DITHER. Fixes: efcd0107727c ("drm/msm/dpu: add support for SM8550") Signed-off-by: Marijn Suijten Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/534214/ Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-5-27ce1a5ab5c6@somainline.org Signed-off-by: Abhinav Kumar commit 85340c0256f9b85b47c5867e411df37d76df5858 Author: Marijn Suijten Date: Thu Apr 27 00:37:18 2023 +0200 drm/msm/dpu: Reindent REV_7xxx interrupt masks with tabs Use tabs for consistency with the other interrupt register definitions, rather than spaces. Fixes: ed6154a136e4 ("drm/msm/disp/dpu1: add intf offsets for SC7280 target") Fixes: 89688e2119b2 ("drm/msm/dpu: Add more of the INTF interrupt regions") Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") Signed-off-by: Marijn Suijten Reviewed-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/534212/ Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-4-27ce1a5ab5c6@somainline.org Signed-off-by: Abhinav Kumar commit e9d9ce5462fecdeefec87953de71df4d025cbc72 Author: Marijn Suijten Date: Thu Apr 27 00:37:17 2023 +0200 drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header These offsets do not fall under the MDP TOP block and do not fit the comment right above. Move them to dpu_hw_interrupts.c next to the repsective MDP_INTF_x_OFF interrupt block offsets. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Marijn Suijten Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/534203/ Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-3-27ce1a5ab5c6@somainline.org Signed-off-by: Abhinav Kumar commit cfbc21d1c0f9bc2f74acab84031fbaefdbb49ae1 Author: Marijn Suijten Date: Thu Apr 27 00:37:16 2023 +0200 drm/msm/dpu: Remove TE2 block and feature from DPU >= 5.0.0 hardware No hardware beyond kona (sm8250, DPU 6.0.0) defines the TE2 PINGPONG sub-block offset downstream, and according to insiders no DPU >= 5.0.0 hardware has support for it either. Especially since neither downstream nor upstream utilize these registers in any way, remove the erroneous specification from SM8150, SC8180X, SM8250, SC7180, SM8350, SC8280XP and SM8450 to prevent confusion. Note that downstream enables the PPSPLIT (split-FIFO) topology (single LM for 2 PP and 2 INTF) based on the presence of a TE2 block. Fixes: 386fced3f76f ("drm/msm/dpu: add SM8150 to hw catalog") Fixes: 7bdc0c4b8126 ("msm:disp:dpu1: add support for display for SC7180 target") Fixes: 0e91bcbb0016 ("drm/msm/dpu: Add SM8350 to hw catalog") Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450") Signed-off-by: Marijn Suijten Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/534210/ Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-2-27ce1a5ab5c6@somainline.org Signed-off-by: Abhinav Kumar commit f9d5bb73c260f0478f43b07d9fb3dae7d7a8b36b Author: Marijn Suijten Date: Thu Apr 27 00:37:15 2023 +0200 drm/msm/dpu: Remove unused INTF0 interrupt mask from SM6115/QCM2290 Neither of these SoCs has INTF0, they only have a DSI interface on index 1. Stop enabling an interrupt that can't fire. Fixes: 3581b7062cec ("drm/msm/disp/dpu1: add support for display on SM6115") Fixes: 5334087ee743 ("drm/msm: add support for QCM2290 MDSS") Signed-off-by: Marijn Suijten Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/534204/ Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-1-27ce1a5ab5c6@somainline.org Signed-off-by: Abhinav Kumar commit 686eb89b103631a41c7f69b8ac5fbca4a6b07fa0 Author: Arnaud Vrac Date: Wed Apr 19 16:41:17 2023 +0200 drm/msm/dpu: tweak lm pairings in msm8998 hw catalog Change lm blocks pairs so that lm blocks with the same features are paired together: LM_0 and LM_1 with PP and DSPP LM_2 and LM_5 with PP LM_3 and LM_4 This matches the sdm845 configuration and allows using pp or dspp when 2 lm blocks are needed in the topology. In the previous config the reservation code could never find an lm pair without a matching feature set. Signed-off-by: Arnaud Vrac Fixes: 94391a14fc27 ("drm/msm/dpu1: Add MSM8998 to hw catalog") Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/532905/ Link: https://lore.kernel.org/r/20230419-dpu-tweaks-v1-10-d1bac46db075@freebox.fr Signed-off-by: Abhinav Kumar commit 3f23a52fc2b890884828747111f7a3291d2a1b3d Author: Arnaud Vrac Date: Wed Apr 19 16:41:08 2023 +0200 drm/msm/dpu: tweak msm8998 hw catalog values Match the values found in the downstream msm-4.4 kernel sde driver. Signed-off-by: Arnaud Vrac Fixes: 94391a14fc27 ("drm/msm/dpu1: Add MSM8998 to hw catalog") Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/532900/ Link: https://lore.kernel.org/r/20230419-dpu-tweaks-v1-1-d1bac46db075@freebox.fr Signed-off-by: Abhinav Kumar commit a432fc31f03db2546a48bcf5dd69ca28ceb732bf Author: Marijn Suijten Date: Wed Apr 26 01:11:09 2023 +0200 drm/msm/dpu: Assign missing writeback log_mask The WB debug log mask ended up never being assigned, leading to writes to this block to never be logged even if the mask is enabled in dpu_hw_util_log_mask via debugfs. Fixes: 84a33d0fd921 ("drm/msm/dpu: add dpu_hw_wb abstraction for writeback blocks") Signed-off-by: Marijn Suijten Reviewed-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/533860/ Link: https://lore.kernel.org/r/20230418-dpu-drop-useless-for-lookup-v3-1-e8d869eea455@somainline.org Signed-off-by: Abhinav Kumar commit 85c636284cb63b7740b4ae98881ace92158068d3 Author: Srinivas Kandagatla Date: Fri Apr 21 15:56:57 2023 +0100 drm/msm/dp: unregister audio driver during unbind while binding the code always registers a audio driver, however there is no corresponding unregistration done in unbind. This leads to multiple redundant audio platform devices if dp_display_bind and dp_display_unbind happens multiple times during startup. On X13s platform this resulted in 6 to 9 audio codec device instead of just 3 codec devices for 3 dp ports. Fix this by unregistering codecs on unbind. Signed-off-by: Srinivas Kandagatla Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM") Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/533324/ Link: https://lore.kernel.org/r/20230421145657.12186-1-srinivas.kandagatla@linaro.org Signed-off-by: Abhinav Kumar commit 6e98b09da931a00bf4e0477d0fa52748bf28fcce Merge: b68ee1c6131c5 9b78d919632b7 Author: Linus Torvalds Date: Wed Apr 26 16:07:23 2023 -0700 Merge tag 'net-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Paolo Abeni: "Core: - Introduce a config option to tweak MAX_SKB_FRAGS. Increasing the default value allows for better BIG TCP performances - Reduce compound page head access for zero-copy data transfers - RPS/RFS improvements, avoiding unneeded NET_RX_SOFTIRQ when possible - Threaded NAPI improvements, adding defer skb free support and unneeded softirq avoidance - Address dst_entry reference count scalability issues, via false sharing avoidance and optimize refcount tracking - Add lockless accesses annotation to sk_err[_soft] - Optimize again the skb struct layout - Extends the skb drop reasons to make it usable by multiple subsystems - Better const qualifier awareness for socket casts BPF: - Add skb and XDP typed dynptrs which allow BPF programs for more ergonomic and less brittle iteration through data and variable-sized accesses - Add a new BPF netfilter program type and minimal support to hook BPF programs to netfilter hooks such as prerouting or forward - Add more precise memory usage reporting for all BPF map types - Adds support for using {FOU,GUE} encap with an ipip device operating in collect_md mode and add a set of BPF kfuncs for controlling encap params - Allow BPF programs to detect at load time whether a particular kfunc exists or not, and also add support for this in light skeleton - Bigger batch of BPF verifier improvements to prepare for upcoming BPF open-coded iterators allowing for less restrictive looping capabilities - Rework RCU enforcement in the verifier, add kptr_rcu and enforce BPF programs to NULL-check before passing such pointers into kfunc - Add support for kptrs in percpu hashmaps, percpu LRU hashmaps and in local storage maps - Enable RCU semantics for task BPF kptrs and allow referenced kptr tasks to be stored in BPF maps - Add support for refcounted local kptrs to the verifier for allowing shared ownership, useful for adding a node to both the BPF list and rbtree - Add BPF verifier support for ST instructions in convert_ctx_access() which will help new -mcpu=v4 clang flag to start emitting them - Add ARM32 USDT support to libbpf - Improve bpftool's visual program dump which produces the control flow graph in a DOT format by adding C source inline annotations Protocols: - IPv4: Allow adding to IPv4 address a 'protocol' tag. Such value indicates the provenance of the IP address - IPv6: optimize route lookup, dropping unneeded R/W lock acquisition - Add the handshake upcall mechanism, allowing the user-space to implement generic TLS handshake on kernel's behalf - Bridge: support per-{Port, VLAN} neighbor suppression, increasing resilience to nodes failures - SCTP: add support for Fair Capacity and Weighted Fair Queueing schedulers - MPTCP: delay first subflow allocation up to its first usage. This will allow for later better LSM interaction - xfrm: Remove inner/outer modes from input/output path. These are not needed anymore - WiFi: - reduced neighbor report (RNR) handling for AP mode - HW timestamping support - support for randomized auth/deauth TA for PASN privacy - per-link debugfs for multi-link - TC offload support for mac80211 drivers - mac80211 mesh fast-xmit and fast-rx support - enable Wi-Fi 7 (EHT) mesh support Netfilter: - Add nf_tables 'brouting' support, to force a packet to be routed instead of being bridged - Update bridge netfilter and ovs conntrack helpers to handle IPv6 Jumbo packets properly, i.e. fetch the packet length from hop-by-hop extension header. This is needed for BIT TCP support - The iptables 32bit compat interface isn't compiled in by default anymore - Move ip(6)tables builtin icmp matches to the udptcp one. This has the advantage that icmp/icmpv6 match doesn't load the iptables/ip6tables modules anymore when iptables-nft is used - Extended netlink error report for netdevice in flowtables and netdev/chains. Allow for incrementally add/delete devices to netdev basechain. Allow to create netdev chain without device Driver API: - Remove redundant Device Control Error Reporting Enable, as PCI core has already error reporting enabled at enumeration time - Move Multicast DB netlink handlers to core, allowing devices other then bridge to use them - Allow the page_pool to directly recycle the pages from safely localized NAPI - Implement lockless TX queue stop/wake combo macros, allowing for further code de-duplication and sanitization - Add YNL support for user headers and struct attrs - Add partial YNL specification for devlink - Add partial YNL specification for ethtool - Add tc-mqprio and tc-taprio support for preemptible traffic classes - Add tx push buf len param to ethtool, specifies the maximum number of bytes of a transmitted packet a driver can push directly to the underlying device - Add basic LED support for switch/phy - Add NAPI documentation, stop relaying on external links - Convert dsa_master_ioctl() to netdev notifier. This is a preparatory work to make the hardware timestamping layer selectable by user space - Add transceiver support and improve the error messages for CAN-FD controllers New hardware / drivers: - Ethernet: - AMD/Pensando core device support - MediaTek MT7981 SoC - MediaTek MT7988 SoC - Broadcom BCM53134 embedded switch - Texas Instruments CPSW9G ethernet switch - Qualcomm EMAC3 DWMAC ethernet - StarFive JH7110 SoC - NXP CBTX ethernet PHY - WiFi: - Apple M1 Pro/Max devices - RealTek rtl8710bu/rtl8188gu - RealTek rtl8822bs, rtl8822cs and rtl8821cs SDIO chipset - Bluetooth: - Realtek RTL8821CS, RTL8851B, RTL8852BS - Mediatek MT7663, MT7922 - NXP w8997 - Actions Semi ATS2851 - QTI WCN6855 - Marvell 88W8997 - Can: - STMicroelectronics bxcan stm32f429 Drivers: - Ethernet NICs: - Intel (1G, icg): - add tracking and reporting of QBV config errors - add support for configuring max SDU for each Tx queue - Intel (100G, ice): - refactor mailbox overflow detection to support Scalable IOV - GNSS interface optimization - Intel (i40e): - support XDP multi-buffer - nVidia/Mellanox: - add the support for linux bridge multicast offload - enable TC offload for egress and engress MACVLAN over bond - add support for VxLAN GBP encap/decap flows offload - extend packet offload to fully support libreswan - support tunnel mode in mlx5 IPsec packet offload - extend XDP multi-buffer support - support MACsec VLAN offload - add support for dynamic msix vectors allocation - drop RX page_cache and fully use page_pool - implement thermal zone to report NIC temperature - Netronome/Corigine: - add support for multi-zone conntrack offload - Solarflare/Xilinx: - support offloading TC VLAN push/pop actions to the MAE - support TC decap rules - support unicast PTP - Other NICs: - Broadcom (bnxt): enforce software based freq adjustments only on shared PHC NIC - RealTek (r8169): refactor to addess ASPM issues during NAPI poll - Micrel (lan8841): add support for PTP_PF_PEROUT - Cadence (macb): enable PTP unicast - Engleder (tsnep): add XDP socket zero-copy support - virtio-net: implement exact header length guest feature - veth: add page_pool support for page recycling - vxlan: add MDB data path support - gve: add XDP support for GQI-QPL format - geneve: accept every ethertype - macvlan: allow some packets to bypass broadcast queue - mana: add support for jumbo frame - Ethernet high-speed switches: - Microchip (sparx5): Add support for TC flower templates - Ethernet embedded switches: - Broadcom (b54): - configure 6318 and 63268 RGMII ports - Marvell (mv88e6xxx): - faster C45 bus scan - Microchip: - lan966x: - add support for IS1 VCAP - better TX/RX from/to CPU performances - ksz9477: add ETS Qdisc support - ksz8: enhance static MAC table operations and error handling - sama7g5: add PTP capability - NXP (ocelot): - add support for external ports - add support for preemptible traffic classes - Texas Instruments: - add CPSWxG SGMII support for J7200 and J721E - Intel WiFi (iwlwifi): - preparation for Wi-Fi 7 EHT and multi-link support - EHT (Wi-Fi 7) sniffer support - hardware timestamping support for some devices/firwmares - TX beacon protection on newer hardware - Qualcomm 802.11ax WiFi (ath11k): - MU-MIMO parameters support - ack signal support for management packets - RealTek WiFi (rtw88): - SDIO bus support - better support for some SDIO devices (e.g. MAC address from efuse) - RealTek WiFi (rtw89): - HW scan support for 8852b - better support for 6 GHz scanning - support for various newer firmware APIs - framework firmware backwards compatibility - MediaTek WiFi (mt76): - P2P support - mesh A-MSDU support - EHT (Wi-Fi 7) support - coredump support" * tag 'net-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2078 commits) net: phy: hide the PHYLIB_LEDS knob net: phy: marvell-88x2222: remove unnecessary (void*) conversions tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. net: amd: Fix link leak when verifying config failed net: phy: marvell: Fix inconsistent indenting in led_blink_set lan966x: Don't use xdp_frame when action is XDP_TX tsnep: Add XDP socket zero-copy TX support tsnep: Add XDP socket zero-copy RX support tsnep: Move skb receive action to separate function tsnep: Add functions for queue enable/disable tsnep: Rework TX/RX queue initialization tsnep: Replace modulo operation with mask net: phy: dp83867: Add led_brightness_set support net: phy: Fix reading LED reg property drivers: nfc: nfcsim: remove return value check of `dev_dir` net: phy: dp83867: Remove unnecessary (void*) conversions net: ethtool: coalesce: try to make user settings stick twice net: mana: Check if netdev/napi_alloc_frag returns single page net: mana: Rename mana_refill_rxoob and remove some empty lines net: veth: add page_pool stats ... commit 9419092fb2630c30e4ffeb9ef61007ef0c61827a Author: Dave Chinner Date: Thu Apr 27 09:02:11 2023 +1000 xfs: fix livelock in delayed allocation at ENOSPC On a filesystem with a non-zero stripe unit and a large sequential write, delayed allocation will set a minimum allocation length of the stripe unit. If allocation fails because there are no extents long enough for an aligned minlen allocation, it is supposed to fall back to unaligned allocation which allows single block extents to be allocated. When the allocator code was rewritting in the 6.3 cycle, this fallback was broken - the old code used args->fsbno as the both the allocation target and the allocation result, the new code passes the target as a separate parameter. The conversion didn't handle the aligned->unaligned fallback path correctly - it reset args->fsbno to the target fsbno on failure which broke allocation failure detection in the high level code and so it never fell back to unaligned allocations. This resulted in a loop in writeback trying to allocate an aligned block, getting a false positive success, trying to insert the result in the BMBT. This did nothing because the extent already was in the BMBT (merge results in an unchanged extent) and so it returned the prior extent to the conversion code as the current iomap. Because the iomap returned didn't cover the offset we tried to map, xfs_convert_blocks() then retries the allocation, which fails in the same way and now we have a livelock. Reported-and-tested-by: Brian Foster Fixes: 85843327094f ("xfs: factor xfs_bmap_btalloc()") Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit edbdb43fc96b11b3bfa531be306a1993d9fe89ec Author: Sean Christopherson Date: Wed Apr 26 15:03:23 2023 -0700 KVM: x86: Preserve TDP MMU roots until they are explicitly invalidated Preserve TDP MMU roots until they are explicitly invalidated by gifting the TDP MMU itself a reference to a root when it is allocated. Keeping a reference in the TDP MMU fixes a flaw where the TDP MMU exhibits terrible performance, and can potentially even soft-hang a vCPU, if a vCPU frequently unloads its roots, e.g. when KVM is emulating SMI+RSM. When KVM emulates something that invalidates _all_ TLB entries, e.g. SMI and RSM, KVM unloads all of the vCPUs roots (KVM keeps a small per-vCPU cache of previous roots). Unloading roots is a simple way to ensure KVM flushes and synchronizes all roots for the vCPU, as KVM flushes and syncs when allocating a "new" root (from the vCPU's perspective). In the shadow MMU, KVM keeps track of all shadow pages, roots included, in a per-VM hash table. Unloading a shadow MMU root just wipes it from the per-vCPU cache; the root is still tracked in the per-VM hash table. When KVM loads a "new" root for the vCPU, KVM will find the old, unloaded root in the per-VM hash table. Unlike the shadow MMU, the TDP MMU doesn't track "inactive" roots in a per-VM structure, where "active" in this case means a root is either in-use or cached as a previous root by at least one vCPU. When a TDP MMU root becomes inactive, i.e. the last vCPU reference to the root is put, KVM immediately frees the root (asterisk on "immediately" as the actual freeing may be done by a worker, but for all intents and purposes the root is gone). The TDP MMU behavior is especially problematic for 1-vCPU setups, as unloading all roots effectively frees all roots. The issue is mitigated to some degree in multi-vCPU setups as a different vCPU usually holds a reference to an unloaded root and thus keeps the root alive, allowing the vCPU to reuse its old root after unloading (with a flush+sync). The TDP MMU flaw has been known for some time, as until very recently, KVM's handling of CR0.WP also triggered unloading of all roots. The CR0.WP toggling scenario was eventually addressed by not unloading roots when _only_ CR0.WP is toggled, but such an approach doesn't Just Work for emulating SMM as KVM must emulate a full TLB flush on entry and exit to/from SMM. Given that the shadow MMU plays nice with unloading roots at will, teaching the TDP MMU to do the same is far less complex than modifying KVM to track which roots need to be flushed before reuse. Note, preserving all possible TDP MMU roots is not a concern with respect to memory consumption. Now that the role for direct MMUs doesn't include information about the guest, e.g. CR0.PG, CR0.WP, CR4.SMEP, etc., there are _at most_ six possible roots (where "guest_mode" here means L2): 1. 4-level !SMM !guest_mode 2. 4-level SMM !guest_mode 3. 5-level !SMM !guest_mode 4. 5-level SMM !guest_mode 5. 4-level !SMM guest_mode 6. 5-level !SMM guest_mode And because each vCPU can track 4 valid roots, a VM can already have all 6 root combinations live at any given time. Not to mention that, in practice, no sane VMM will advertise different guest.MAXPHYADDR values across vCPUs, i.e. KVM won't ever use both 4-level and 5-level roots for a single VM. Furthermore, the vast majority of modern hypervisors will utilize EPT/NPT when available, thus the guest_mode=%true cases are also unlikely to be utilized. Reported-by: Jeremi Piotrowski Link: https://lore.kernel.org/all/959c5bce-beb5-b463-7158-33fc4a4f910c@linux.microsoft.com Link: https://lkml.kernel.org/r/20220209170020.1775368-1-pbonzini%40redhat.com Link: https://lore.kernel.org/all/20230322013731.102955-1-minipli@grsecurity.net Link: https://lore.kernel.org/all/000000000000a0bc2b05f9dd7fab@google.com Link: https://lore.kernel.org/all/000000000000eca0b905fa0f7756@google.com Cc: Ben Gardon Cc: David Matlack Cc: stable@vger.kernel.org Tested-by: Jeremi Piotrowski Link: https://lore.kernel.org/r/20230426220323.3079789-1-seanjc@google.com Signed-off-by: Sean Christopherson commit ca3d1a4b419acad3fca6828884acb03614f7558b Author: Linus Walleij Date: Wed Feb 8 19:33:28 2023 +0200 hte: tegra-194: Use proper includes The test driver uses the gpiod consumer API so include the right header. This may cause a problem with struct of_device_id being implcitly pulled in by the legacy header so include explicitly as well. While at it, drop explicit moduleparam.h (it's included with module.h) and sort the headers. Signed-off-by: Linus Walleij Signed-off-by: Andy Shevchenko Acked-by: Dipen Patel Signed-off-by: Dipen Patel commit 9e0c2d40a40733fba605ff47a08f3eba2fab4fbb Author: ye xingchen Date: Thu Nov 17 15:17:29 2022 +0800 hte: Use device_match_of_node() Replace the open-code with device_match_of_node(). Signed-off-by: ye xingchen Acked-by: Dipen Patel Signed-off-by: Dipen Patel commit e078180d66848a6a890daf0a3ce28dc43cc66790 Author: Dan Carpenter Date: Wed Apr 19 17:30:00 2023 +0300 hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id() The "map_sz" is the number of elements in the "m" array so the > comparison needs to be changed to >= to prevent an out of bounds read. Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider") Signed-off-by: Dan Carpenter Acked-by: Dipen Patel Signed-off-by: Dipen Patel commit 6680c835ada1b34e882d0a32612f7294c62e27e0 Author: Arnd Bergmann Date: Thu Dec 15 17:46:19 2022 +0100 hte: tegra: fix 'struct of_device_id' build error Without the extra #include, this driver produces a build failure in some configurations. drivers/hte/hte-tegra194-test.c:96:34: error: array type has incomplete element type 'struct of_device_id' 96 | static const struct of_device_id tegra_hte_test_of_match[] = { Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver") Signed-off-by: Arnd Bergmann Acked-by: Dipen Patel Signed-off-by: Dipen Patel commit 902dea62b3dda532172c0f4d0410fe595266b22c Author: Rob Herring Date: Fri Mar 10 08:47:06 2023 -0600 hte: Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Signed-off-by: Rob Herring Acked-by: Dipen Patel Signed-off-by: Dipen Patel commit 7d507452048d9a6971998339243d16a09c95a842 Author: Dipen Patel Date: Thu Apr 13 17:44:55 2023 -0700 gpio: tegra186: Add Tegra234 hte support To enable timestamp support for the Tegra234, has_gte variable needs to be set true. Signed-off-by: Dipen Patel Acked-by: Thierry Reding Acked-by: Bartosz Golaszewski Reviewed-by: Linus Walleij commit d02b1cabc7c6fe0e237bf8a2a6a8813302cfd87c Author: Dipen Patel Date: Thu Apr 13 17:44:54 2023 -0700 hte: handle nvidia,gpio-controller property The dt binding adds nvidia,gpio-controller property from Tegra234 SoC onwards to simplify code handling gpio chip search. The gpio chip search is needed for the AON GPIO GTE instances to map the hardware timestamp GPIO request (coming from the GPIO framework) to the tegra HTE providers. The patch also adds new gpio chip match function to match from the fwnode instead of the gpio controller label. The addition of the property does not break ABI for the existing Tegra194 code. Signed-off-by: Dipen Patel Reviewed-by: Linus Walleij commit 0ebc475fb636df12222faa04dd989a4e3c87f31a Author: Dipen Patel Date: Thu Apr 13 17:44:53 2023 -0700 hte: Deprecate nvidia,slices property The relevant DT bindings deprecates nvidia,slices property from Tegra234 SoC onwards, moving the slices value per SoC data structure instead. Signed-off-by: Dipen Patel commit b003fb5c9df8a8923bf46e0c00cc54edcfb0fbe3 Author: Dipen Patel Date: Thu Apr 13 17:44:52 2023 -0700 hte: Add Tegra234 provider The Tegra234 AON GPIO instance and LIC IRQ support HTE. For the GPIO HTE support, it also requires to add mapping between GPIO and HTE framework same as it was done with Tegra194 SoC. Signed-off-by: Dipen Patel commit 59cc80a6d8695e7b4b51154ea2d08af551b6c359 Author: Dipen Patel Date: Thu Apr 13 17:44:51 2023 -0700 hte: Re-phrase tegra API document Make Tegra194 API document generic to make it applicable for current and future tegra hte providers. Signed-off-by: Dipen Patel Reviewed-by: Bagas Sanjaya commit 29662d622641af8866aac904c8aa264844086af3 Author: Dipen Patel Date: Thu Apr 13 17:44:50 2023 -0700 arm64: tegra: Add Tegra234 GTE nodes Add GTE LIC and AON GPIO nodes for the tegra234 SoC. Signed-off-by: Dipen Patel Acked-by: Thierry Reding commit 1815e37b6e67f2a543e36628bfe6a834aad3ea1b Author: Dipen Patel Date: Thu Apr 13 17:44:49 2023 -0700 dt-bindings: timestamp: Deprecate nvidia,slices property The property is not necessary as it is a constant value and can be hardcoded in the driver code. Signed-off-by: Dipen Patel Reviewed-by: Linus Walleij Acked-by: Rob Herring commit d0672fa4931dcb9d9d53002e855f25dd7507a300 Author: Dipen Patel Date: Thu Apr 13 17:44:48 2023 -0700 dt-bindings: timestamp: Add Tegra234 support Added timestamp provider support for the Tegra234 in devicetree bindings. From Tegra234 SoC onwards, the nvidia,gpio-controller property is required. This is needed as the tegra always-on (AON) GPIO HTE/GTE provider depends on the AON GPIO controller where it needs to do namespace conversion between GPIO line number (belonging to AON GPIO controller instance) and the GTE slice bits. Signed-off-by: Dipen Patel Reviewed-by: Krzysztof Kozlowski commit fdd1e3489b30ba6ba3075d38ce6f448e04119c71 Author: Dipen Patel Date: Thu Apr 13 17:44:47 2023 -0700 MAINTAINERS: Add HTE/timestamp subsystem details Add tree, mailing list and patchwork details. Signed-off-by: Dipen Patel Acked-by: Thierry Reding commit b68ee1c6131c540a62ecd443be89c406401df091 Merge: 36006b1d5c046 3c85f087faeca Author: Linus Torvalds Date: Wed Apr 26 15:39:25 2023 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (megaraid_sas, scsi_debug, lpfc, target, mpi3mr, hisi_sas, arcmsr). The major core change is the constification of the host templates (which touches everything) along with other minor fixups and clean ups" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (207 commits) scsi: ufs: mcq: Use pointer arithmetic in ufshcd_send_command() scsi: ufs: mcq: Annotate ufshcd_inc_sq_tail() appropriately scsi: cxlflash: s/semahpore/semaphore/ scsi: lpfc: Silence an incorrect device output scsi: mpi3mr: Use IRQ save variants of spinlock to protect chain frame allocation scsi: scsi_debug: Fix missing error code in scsi_debug_init() scsi: hisi_sas: Work around build failure in suspend function scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() scsi: mpt3sas: Fix an issue when driver is being removed scsi: mpt3sas: Remove HBA BIOS version in the kernel log scsi: target: core: Fix invalid memory access scsi: scsi_debug: Drop sdebug_queue scsi: scsi_debug: Only allow sdebug_max_queue be modified when no shosts scsi: scsi_debug: Use scsi_host_busy() in delay_store() and ndelay_store() scsi: scsi_debug: Use blk_mq_tagset_busy_iter() in stop_all_queued() scsi: scsi_debug: Use blk_mq_tagset_busy_iter() in sdebug_blk_mq_poll() scsi: scsi_debug: Dynamically allocate sdebug_queued_cmd scsi: scsi_debug: Use scsi_block_requests() to block queues scsi: scsi_debug: Protect block_unblock_all_queues() with mutex scsi: scsi_debug: Change shost list lock to a mutex ... commit 158009f1b4a33bc0f354b994eea361362bd83226 Author: Geert Uytterhoeven Date: Wed Apr 26 15:43:34 2023 +0200 timekeeping: Fix references to nonexistent ktime_get_fast_ns() There was never a function named ktime_get_fast_ns(). Presumably these should refer to ktime_get_mono_fast_ns() instead. Fixes: c1ce406e80fb15fa ("timekeeping: Fix up function documentation for the NMI safe accessors") Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/r/06df7b3cbd94f016403bbf6cd2b38e4368e7468f.1682516546.git.geert+renesas@glider.be commit c3a6ef330a08eba406f82b0b8cbca4e4d9b7c4ba Merge: ab396fb2f37da bea407a427baa Author: Jiri Kosina Date: Wed Apr 26 23:09:07 2023 +0200 Merge branch 'for-6.4/wacom' into for-linus - improved handling of battery quirk (Jason Gerecke) - lazy initialization of battery interfaces (Jason Gerecke) commit ab396fb2f37dabc436bbe52ac0d287f95080ee65 Merge: 67471b89989d9 bf81de760a836 Author: Jiri Kosina Date: Wed Apr 26 23:08:04 2023 +0200 Merge branch 'for-6.4/tests' into for-linus - import of bunch of HID selftests from out-of-tree hid-tools project (Benjamin Tissoires) commit 026b85796ab4d52af56f8a1c60d2613983ecd845 Author: Ard Biesheuvel Date: Tue Apr 18 15:49:52 2023 +0200 efi/zboot: arm64: Grab code size from ELF symbol in payload Instead of relying on a dodgy dd hack to copy the image code size from the uncompressed image's PE header to the end of the compressed image, let's grab the code size from the symbol that is injected into the ELF object by the Kbuild rules that generate the compressed payload. Signed-off-by: Ard Biesheuvel Acked-by: Mark Rutland commit 67471b89989d960a2f2283e281287481e791fb6d Merge: 5fce154a4d9fc d750d14803627 Author: Jiri Kosina Date: Wed Apr 26 23:05:55 2023 +0200 Merge branch 'for-6.4/nintendo' into for-linus - drastically reducing Bluetooth disconnects on hid-nintendo driven devices (Daniel J. Ogorchock) - proper rumble queue overrun handling (Daniel J. Ogorchock) commit 5fce154a4d9fcbf897fcaa0ebf084618dd6d751f Merge: 0549fbac401ce ca6961d8a851f Author: Jiri Kosina Date: Wed Apr 26 23:03:00 2023 +0200 Merge branch 'for-6.4/mcp2221' into for-linus - generic code improvements for mcp2221 driver (Louis Morhet) commit 0549fbac401ced4adea4fca44baf8bab7ebcfc74 Merge: d411b5aa1f49c 539adfedbd2d5 Author: Jiri Kosina Date: Wed Apr 26 22:57:40 2023 +0200 Merge branch 'for-6.4/logitech-hidpp' into for-linus - support for ADC measurement (Bastien Nocera) - support for Logitech G935 (Bastien Nocera) commit d411b5aa1f49c065dfe23b7a7e72ee56f2677331 Merge: b680751bd9c55 a2654c1f640c4 Author: Jiri Kosina Date: Wed Apr 26 22:57:15 2023 +0200 Merge branch 'for-6.4/led-includes' into for-linus - explicit include fixes (Thomas Weißschuh) commit b680751bd9c55b8dd85d1f1067f4a0474449c819 Merge: ba984d2798fed 0f6fac2cfbefa Author: Jiri Kosina Date: Wed Apr 26 22:56:33 2023 +0200 Merge branch 'for-6.4/kye' into for-linus - generic support for all Kye tablets (David Yang) commit ba984d2798fedd73ec85b7ef44ff75b7216903fb Merge: 63f7cf6659290 2be404486c059 Author: Jiri Kosina Date: Wed Apr 26 22:55:51 2023 +0200 Merge branch 'for-6.4/i2c-hid' into for-linus - reset GPIO support (Hans de Goede) commit 63f7cf66592907e17073c14f6a24c366b1f68db5 Merge: 5f86a084a4127 35903009dbde8 Author: Jiri Kosina Date: Wed Apr 26 22:54:24 2023 +0200 Merge branch 'for-6.4/core' into for-linus - improve handling of generic "Digitizer" usage (Jason Gerecke) - support for KEY_CAMERA_FOCUS (Feng Qi) commit 5f86a084a4127458563a845459d08770f3a59465 Merge: cdc780f044a80 29e1ecc197d41 Author: Jiri Kosina Date: Wed Apr 26 22:53:41 2023 +0200 Merge branch 'for-6.4/apple' into for-linus - quirks for Apple Geyser 3 and Apple Geyser 4 (Alex Henrie) commit cdc780f044a803aff8845b949f800f0f3d095d5f Merge: 38518593ec55e 37386669887d3 Author: Jiri Kosina Date: Wed Apr 26 22:52:34 2023 +0200 Merge branch 'for-6.4/amd-sfh' into for-linus - assorted functional fixes for amd-sfh driver (Basavaraj Natikar) commit 36006b1d5c04692924f011aa949e8788f1c604de Merge: 48dc810012a6b 140b26035b2d3 Author: Linus Torvalds Date: Wed Apr 26 13:09:45 2023 -0700 Merge tag 'ata-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata updates from Damien Le Moal: - Many cleanups of the pata_parport driver and of its protocol modules (Ondrej) - Remove unused code (ata_id_xxx() functions) (Sergey) - Add Add UniPhier SATA controller DT bindings (Kunihiko) - Fix dependencies for the Freescale QorIQ AHCI SATA controller driver (Geert) - DT property handling improvements (Rob) * tag 'ata-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: (57 commits) ata: pata_parport-bpck6: Declare mode_map as static ata: pata_parport-bpck6: Remove dependency on 64BIT ata: pata_parport-bpck6: reduce indents in bpck6_open ata: pata_parport-bpck6: delete ppc6lnx.c ata: pata_parport-bpck6: move defines and mode_map to bpck6.c ata: pata_parport-bpck6: move ppc6_wr_data_byte to bpck6.c and rename ata: pata_parport-bpck6: move ppc6_rd_data_byte to bpck6.c and rename ata: pata_parport-bpck6: move ppc6_send_cmd to bpck6.c and rename ata: pata_parport-bpck6: move ppc6_deselect to bpck6.c and rename ata: pata_parport-bpck6: merge ppc6_select into bpck6_open ata: pata_parport-bpck6: move ppc6_open to bpck6.c and rename ata: pata_parport-bpck6: move ppc6_wr_extout to bpck6.c and rename ata: pata_parport-bpck6: move ppc6_wait_for_fifo to bpck6.c and rename ata: pata_parport-bpck6: merge ppc6_wr_data_blk into bpck6_write_block ata: pata_parport-bpck6: merge ppc6_rd_data_blk into bpck6_read_block ata: pata_parport-bpck6: merge ppc6_wr_port16_blk into bpck6_write_block ata: pata_parport-bpck6: merge ppc6_rd_port16_blk into bpck6_read_block ata: pata_parport-bpck6: merge ppc6_wr_port into bpck6_write_regr ata: pata_parport-bpck6: merge ppc6_rd_port into bpck6_read_regr ata: pata_parport-bpck6: remove ppc6_close ... commit 48dc810012a6b4f4ba94073d6b7edb4f76edeb72 Merge: 9dd6956b38923 38d11da522aac Author: Linus Torvalds Date: Wed Apr 26 13:05:21 2023 -0700 Merge tag 'for-6.4/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Split dm-bufio's rw_semaphore and rbtree. Offers improvements to dm-bufio's locking to allow increased concurrent IO -- particularly for read access for buffers already in dm-bufio's cache. - Also split dm-bio-prison-v1's spinlock and rbtree with comparable aim at improving concurrent IO (for the DM thinp target). - Both the dm-bufio and dm-bio-prison-v1 scaling of the number of locks and rbtrees used are managed by dm_num_hash_locks(). And the hash function used by both is dm_hash_locks_index(). - Allow DM targets to require DISCARD, WRITE_ZEROES and SECURE_ERASE to be split at the target specified boundary (in terms of max_discard_sectors, max_write_zeroes_sectors and max_secure_erase_sectors respectively). - DM verity error handling fix for check_at_most_once on FEC. - Update DM verity target to emit audit events on verification failure and more. - DM core ->io_hints improvements needed in support of new discard support that is added to the DM "zero" and "error" targets. - Fix missing kmem_cache_destroy() call in initialization error path of both the DM integrity and DM clone targets. - A couple fixes for DM flakey, also add "error_reads" feature. - Fix DM core's resume to not lock FS when the DM map is NULL; otherwise initial table load can race with FS mount that takes superblock's ->s_umount rw_semaphore. - Various small improvements to both DM core and DM targets. * tag 'for-6.4/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (40 commits) dm: don't lock fs when the map is NULL in process of resume dm flakey: add an "error_reads" option dm flakey: remove trailing space in the table line dm flakey: fix a crash with invalid table line dm ioctl: fix nested locking in table_clear() to remove deadlock concern dm: unexport dm_get_queue_limits() dm: allow targets to require splitting WRITE_ZEROES and SECURE_ERASE dm: add helper macro for simple DM target module init and exit dm raid: remove unused d variable dm: remove unnecessary (void*) conversions dm mirror: add DMERR message if alloc_workqueue fails dm: push error reporting down to dm_register_target() dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path dm clone: call kmem_cache_destroy() in dm_clone_init() error path dm error: add discard support dm zero: add discard support dm table: allow targets without devices to set ->io_hints dm verity: emit audit events on verification failure and more dm verity: fix error handling for check_at_most_once on FEC dm: improve hash_locks sizing and hash function ... commit b3c98052d46948a8d65d2778c7f306ff38366aac Merge: 4a5fd419952e4 4984563823f00 Author: Paolo Bonzini Date: Wed Apr 26 15:56:51 2023 -0400 Merge tag 'kvm-x86-vmx-6.4' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.4: - Fix a bug in emulation of ENCLS in compatibility mode - Allow emulation of NOP and PAUSE for L2 - Misc cleanups commit 4a5fd419952e49ef870e9259d815718062871cc1 Merge: c21775ae021f8 c0d0ce9b5a851 Author: Paolo Bonzini Date: Wed Apr 26 15:56:27 2023 -0400 Merge tag 'kvm-x86-svm-6.4' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.4: - Add support for virtual NMIs - Fixes for edge cases related to virtual interrupts commit c21775ae021f8d28bb1b8ab857b7342e0f8b180d Merge: 48b1893ae38bd 20aef201dafba Author: Paolo Bonzini Date: Wed Apr 26 15:54:40 2023 -0400 Merge tag 'kvm-x86-selftests-6.4' of https://github.com/kvm-x86/linux into HEAD KVM selftests, and an AMX/XCR0 bugfix, for 6.4: - Don't advertise XTILE_CFG in KVM_GET_SUPPORTED_CPUID if XTILE_DATA is not being reported due to userspace not opting in via prctl() - Overhaul the AMX selftests to improve coverage and cleanup the test - Misc cleanups commit 48b1893ae38bd6d46a9dcfc7b85c70a143fb8cab Merge: 807b758496e42 457bd7af1a171 Author: Paolo Bonzini Date: Wed Apr 26 15:53:36 2023 -0400 Merge tag 'kvm-x86-pmu-6.4' of https://github.com/kvm-x86/linux into HEAD KVM x86 PMU changes for 6.4: - Disallow virtualizing legacy LBRs if architectural LBRs are available, the two are mutually exclusive in hardware - Disallow writes to immutable feature MSRs (notably PERF_CAPABILITIES) after KVM_RUN, and overhaul the vmx_pmu_caps selftest to better validate PERF_CAPABILITIES - Apply PMU filters to emulated events and add test coverage to the pmu_event_filter selftest - Misc cleanups and fixes commit 9dd6956b38923dc1b7b349ca1eee3c0bb1f0163a Merge: 5b9a7bb72fddb 55793ea54d777 Author: Linus Torvalds Date: Wed Apr 26 12:52:58 2023 -0700 Merge tag 'for-6.4/block-2023-04-21' of git://git.kernel.dk/linux Pull block updates from Jens Axboe: - drbd patches, bringing us closer to unifying the out-of-tree version and the in tree one (Andreas, Christoph) - support for auto-quiesce for the s390 dasd driver (Stefan) - MD pull request via Song: - md/bitmap: Optimal last page size (Jon Derrick) - Various raid10 fixes (Yu Kuai, Li Nan) - md: add error_handlers for raid0 and linear (Mariusz Tkaczyk) - NVMe pull request via Christoph: - Drop redundant pci_enable_pcie_error_reporting (Bjorn Helgaas) - Validate nvmet module parameters (Chaitanya Kulkarni) - Fence TCP socket on receive error (Chris Leech) - Fix async event trace event (Keith Busch) - Minor cleanups (Chaitanya Kulkarni, zhenwei pi) - Fix and cleanup nvmet Identify handling (Damien Le Moal, Christoph Hellwig) - Fix double blk_mq_complete_request race in the timeout handler (Lei Yin) - Fix irq locking in nvme-fcloop (Ming Lei) - Remove queue mapping helper for rdma devices (Sagi Grimberg) - use structured request attribute checks for nbd (Jakub) - fix blk-crypto race conditions between keyslot management (Eric) - add sed-opal support for reading read locking range attributes (Ondrej) - make fault injection configurable for null_blk (Akinobu) - clean up the request insertion API (Christoph) - clean up the queue running API (Christoph) - blkg config helper cleanups (Tejun) - lazy init support for blk-iolatency (Tejun) - various fixes and tweaks to ublk (Ming) - remove hybrid polling. It hasn't really been useful since we got async polled IO support, and these days we don't support sync polled IO at all (Keith) - misc fixes, cleanups, improvements (Zhong, Ondrej, Colin, Chengming, Chaitanya, me) * tag 'for-6.4/block-2023-04-21' of git://git.kernel.dk/linux: (118 commits) nbd: fix incomplete validation of ioctl arg ublk: don't return 0 in case of any failure sed-opal: geometry feature reporting command null_blk: Always check queue mode setting from configfs block: ublk: switch to ioctl command encoding blk-mq: fix the blk_mq_add_to_requeue_list call in blk_kick_flush block, bfq: Fix division by zero error on zero wsum fault-inject: fix build error when FAULT_INJECTION_CONFIGFS=y and CONFIGFS_FS=m block: store bdev->bd_disk->fops->submit_bio state in bdev block: re-arrange the struct block_device fields for better layout md/raid5: remove unused working_disks variable md/raid10: don't call bio_start_io_acct twice for bio which experienced read error md/raid10: fix memleak of md thread md/raid10: fix memleak for 'conf->bio_split' md/raid10: fix leak of 'r10bio->remaining' for recovery md/raid10: don't BUG_ON() in raise_barrier() md: fix soft lockup in status_resync md: add error_handlers for raid0 and linear md: Use optimal I/O size for last bitmap page md: Fix types in sb writer ... commit 807b758496e42ada4ba3f3defcfbac88afcd64f8 Merge: a1c288f87de7a 9ed3bf411226f Author: Paolo Bonzini Date: Wed Apr 26 15:50:01 2023 -0400 Merge tag 'kvm-x86-mmu-6.4' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.4: - Tweak FNAME(sync_spte) to avoid unnecessary writes+flushes when the guest is only adding new PTEs - Overhaul .sync_page() and .invlpg() to share the .sync_page() implementation, i.e. utilize .sync_page()'s optimizations when emulating invalidations - Clean up the range-based flushing APIs - Revamp the TDP MMU's reaping of Accessed/Dirty bits to clear a single A/D bit using a LOCK AND instead of XCHG, and skip all of the "handle changed SPTE" overhead associated with writing the entire entry - Track the number of "tail" entries in a pte_list_desc to avoid having to walk (potentially) all descriptors during insertion and deletion, which gets quite expensive if the guest is spamming fork() - Misc cleanups commit a1c288f87de7aff94e87724127eabb6cdb38b120 Merge: e1a6d5cf10dd9 cf9f4c0eb1699 Author: Paolo Bonzini Date: Wed Apr 26 15:49:23 2023 -0400 Merge tag 'kvm-x86-misc-6.4' of https://github.com/kvm-x86/linux into HEAD KVM x86 changes for 6.4: - Optimize CR0.WP toggling by avoiding an MMU reload when TDP is enabled, and by giving the guest control of CR0.WP when EPT is enabled on VMX (VMX-only because SVM doesn't support per-bit controls) - Add CR0/CR4 helpers to query single bits, and clean up related code where KVM was interpreting kvm_read_cr4_bits()'s "unsigned long" return as a bool - Move AMD_PSFD to cpufeatures.h and purge KVM's definition - Misc cleanups commit e1a6d5cf10dd93fc27d8c85cd7b3e41f08a816e6 Merge: 4f382a79a66b1 b0d237087c674 Author: Paolo Bonzini Date: Wed Apr 26 15:48:44 2023 -0400 Merge tag 'kvm-x86-generic-6.4' of https://github.com/kvm-x86/linux into HEAD Common KVM changes for 6.4: - Drop unnecessary casts from "void *" throughout kvm_main.c - Tweak the layout of "struct kvm_mmu_memory_cache" to shrink the struct size by 8 bytes on 64-bit kernels by utilizing a padding hole - Fix a documentation format goof that was introduced when the KVM docs were converted to ReST - Constify MIPS's internal callbacks (a leftover from the hardware enabling rework that landed in 6.3) commit 4f382a79a66b1a926e30f6d89295fc8fe2c4a86e Merge: b3c129e33e91f 36fe1b29b3cae Author: Paolo Bonzini Date: Wed Apr 26 15:46:52 2023 -0400 Merge tag 'kvmarm-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.4 - Numerous fixes for the pathological lock inversion issue that plagued KVM/arm64 since... forever. - New framework allowing SMCCC-compliant hypercalls to be forwarded to userspace, hopefully paving the way for some more features being moved to VMMs rather than be implemented in the kernel. - Large rework of the timer code to allow a VM-wide offset to be applied to both virtual and physical counters as well as a per-timer, per-vcpu offset that complements the global one. This last part allows the NV timer code to be implemented on top. - A small set of fixes to make sure that we don't change anything affecting the EL1&0 translation regime just after having having taken an exception to EL2 until we have executed a DSB. This ensures that speculative walks started in EL1&0 have completed. - The usual selftest fixes and improvements. commit b3c129e33e91fa3dc3171f45b90edb35e60dbc33 Merge: 400d2132288ed 8a46df7cd135f Author: Paolo Bonzini Date: Wed Apr 26 15:43:15 2023 -0400 Merge tag 'kvm-s390-next-6.4-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD Minor cleanup: - phys_to_virt conversion - Improvement of VSIE AP management commit 5b9a7bb72fddbc5247f56ede55d485fab7abdf92 Merge: 5c7ecada25d20 3c85cc43c8e78 Author: Linus Torvalds Date: Wed Apr 26 12:40:31 2023 -0700 Merge tag 'for-6.4/io_uring-2023-04-21' of git://git.kernel.dk/linux Pull io_uring updates from Jens Axboe: - Cleanup of the io-wq per-node mapping, notably getting rid of it so we just have a single io_wq entry per ring (Breno) - Followup to the above, move accounting to io_wq as well and completely drop struct io_wqe (Gabriel) - Enable KASAN for the internal io_uring caches (Breno) - Add support for multishot timeouts. Some applications use timeouts to wake someone waiting on completion entries, and this makes it a bit easier to just have a recurring timer rather than needing to rearm it every time (David) - Support archs that have shared cache coloring between userspace and the kernel, and hence have strict address requirements for mmap'ing the ring into userspace. This should only be parisc/hppa. (Helge, me) - XFS has supported O_DIRECT writes without needing to lock the inode exclusively for a long time, and ext4 now supports it as well. This is true for the common cases of not extending the file size. Flag the fs as having that feature, and utilize that to avoid serializing those writes in io_uring (me) - Enable completion batching for uring commands (me) - Revert patch adding io_uring restriction to what can be GUP mapped or not. This does not belong in io_uring, as io_uring isn't really special in this regard. Since this is also getting in the way of cleanups and improvements to the GUP code, get rid of if (me) - A few series greatly reducing the complexity of registered resources, like buffers or files. Not only does this clean up the code a lot, the simplified code is also a LOT more efficient (Pavel) - Series optimizing how we wait for events and run task_work related to it (Pavel) - Fixes for file/buffer unregistration with DEFER_TASKRUN (Pavel) - Misc cleanups and improvements (Pavel, me) * tag 'for-6.4/io_uring-2023-04-21' of git://git.kernel.dk/linux: (71 commits) Revert "io_uring/rsrc: disallow multi-source reg buffers" io_uring: add support for multishot timeouts io_uring/rsrc: disassociate nodes and rsrc_data io_uring/rsrc: devirtualise rsrc put callbacks io_uring/rsrc: pass node to io_rsrc_put_work() io_uring/rsrc: inline io_rsrc_put_work() io_uring/rsrc: add empty flag in rsrc_node io_uring/rsrc: merge nodes and io_rsrc_put io_uring/rsrc: infer node from ctx on io_queue_rsrc_removal io_uring/rsrc: remove unused io_rsrc_node::llist io_uring/rsrc: refactor io_queue_rsrc_removal io_uring/rsrc: simplify single file node switching io_uring/rsrc: clean up __io_sqe_buffers_update() io_uring/rsrc: inline switch_start fast path io_uring/rsrc: remove rsrc_data refs io_uring/rsrc: fix DEFER_TASKRUN rsrc quiesce io_uring/rsrc: use wq for quiescing io_uring/rsrc: refactor io_rsrc_ref_quiesce io_uring/rsrc: remove io_rsrc_node::done io_uring/rsrc: use nospec'ed indexes ... commit 0b656310bfc33c5e044df9cf6013df8280ec69cc Author: Donald Hunter Date: Mon Apr 24 09:03:05 2023 +0100 docs/admin-guide/mm/ksm.rst fix intraface -> interface typo Fix typo from 'intraface' to 'interface' in admin guide for KSM. Signed-off-by: Donald Hunter Link: https://lore.kernel.org/r/20230424080305.2985-1-donald.hunter@gmail.com Signed-off-by: Jonathan Corbet commit 3ee23096add52c84aae23b8569a4d6fc8d47f2ac Author: Fabio Fantoni Date: Tue Apr 25 13:01:58 2023 +0200 doc:it_IT: fix some typos Fix of some typos spotted reading documentation in italian and latest changes for 6.4 Signed-off-by: Fabio Fantoni Reviewed-by: Federico Vaga Link: https://lore.kernel.org/r/20230425110158.9755-1-fantonifabio@tiscali.it Signed-off-by: Jonathan Corbet commit 5c7ecada25d2086aee607ff7deb69e77faa4aa92 Merge: fbfaf03ebac99 8375be2b64145 Author: Linus Torvalds Date: Wed Apr 26 09:42:10 2023 -0700 Merge tag 'f2fs-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs update from Jaegeuk Kim: "In this round, we've mainly modified to support non-power-of-two zone size, which is not required for f2fs by design. In order to avoid arch dependency, we refactored the messy rb_entry structure shared across different extent_cache. In addition to the improvement, we've also fixed several subtle bugs and error cases. Enhancements: - support non-power-of-two zone size for zoned device - remove sharing the rb_entry structure in extent cache - refactor f2fs_gc to call checkpoint in urgent condition - support iopoll Bug fixes: - fix potential corruption when moving a directory - fix to avoid use-after-free for cached IPU bio - fix the folio private usage - avoid kernel warnings or panics in the cp_error case - fix to recover quota data correctly - fix some bugs in atomic operations - fix system crash due to lack of free space in LFS - fix null pointer panic in tracepoint in __replace_atomic_write_block - fix iostat lock protection - fix scheduling while atomic in decompression path - preserve direct write semantics when buffering is forced - fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()" * tag 'f2fs-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (52 commits) f2fs: remove unnessary comment in __may_age_extent_tree f2fs: allocate node blocks for atomic write block replacement f2fs: use cow inode data when updating atomic write f2fs: remove power-of-two limitation of zoned device f2fs: allocate trace path buffer from names_cache f2fs: add has_enough_free_secs() f2fs: relax sanity check if checkpoint is corrupted f2fs: refactor f2fs_gc to call checkpoint in urgent condition f2fs: remove folio_detach_private() in .invalidate_folio and .release_folio f2fs: remove bulk remove_proc_entry() and unnecessary kobject_del() f2fs: support iopoll method f2fs: remove batched_trim_sections node description f2fs: fix to check return value of inc_valid_block_count() f2fs: fix to check return value of f2fs_do_truncate_blocks() f2fs: fix passing relative address when discard zones f2fs: fix potential corruption when moving a directory f2fs: add radix_tree_preload_end in error case f2fs: fix to recover quota data correctly f2fs: fix to check readonly condition correctly docs: f2fs: Correct instruction to disable checkpoint ... commit fbfaf03ebac999b4f44f36d851bd729c24c5a658 Merge: e0fcc9c68d114 7a40f1f18a88c Author: Linus Torvalds Date: Wed Apr 26 09:36:55 2023 -0700 Merge tag 'dlm-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: - Remove some unused features (related to lock timeouts) that have been previously scheduled for removal - Fix a bug where the pending callback flag would be incorrectly cleared, which could potentially result in missing a completion callback - Use an unbound workqueue for dlm socket handling so that socket operations can be processed with less delay - Fix possible lockspace join connection errors with large clusters (e.g. over 16 nodes) caused by a small socket backlog setting - Use atomic bit ops for internal flags to help avoid mistakes copying flag values from messages - Fix recently introduced bug where memory for lvb data could be unnecessarily allocated for a lock * tag 'dlm-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: fs: dlm: stop unnecessarily filling zero ms_extra bytes fs: dlm: switch lkb_sbflags to atomic ops fs: dlm: rsb hash table flag value to atomic ops fs: dlm: move internal flags to atomic ops fs: dlm: change dflags to use atomic bits fs: dlm: store lkb distributed flags into own value fs: dlm: remove DLM_IFL_LOCAL_MS flag fs: dlm: rename stub to local message flag fs: dlm: remove deprecated code parts DLM: increase socket backlog to avoid hangs with 16 nodes fs: dlm: add unbound flag to dlm_io workqueue fs: dlm: fix DLM_IFL_CB_PENDING gets overwritten commit e0fcc9c68d1147ca33159d57332b02ca8bac6ab9 Merge: 85d7ab2463822 644f6bf762fa9 Author: Linus Torvalds Date: Wed Apr 26 09:28:15 2023 -0700 Merge tag 'gfs2-v6.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Fix revoke processing at unmount and on read-only remount - Refuse reading in inodes with an impossible indirect block height - Various minor cleanups * tag 'gfs2-v6.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: gfs2_ail_empty_gl no log flush on error gfs2: Issue message when revokes cannot be written gfs2: Perform second log flush in gfs2_make_fs_ro gfs2: return errors from gfs2_ail_empty_gl gfs2: Move variable assignment behind a null pointer check in inode_go_dump gfs2: Use gfs2_holder_initialized for jindex gfs2: Eliminate gfs2_trim_blocks gfs2: Fix inode height consistency check gfs2: Remove ghs[] from gfs2_unlink gfs2: Remove ghs[] from gfs2_link gfs2: Remove duplicate i_nlink check from gfs2_link() commit 85d7ab2463822a4ab096c0b7b59feec962552572 Merge: 94fc0792661a9 f372463124df5 Author: Linus Torvalds Date: Wed Apr 26 09:13:44 2023 -0700 Merge tag 'for-6.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "Mostly core changes and cleanups, some notable fixes and two performance improvements in directory logging. The IO path cleanups are removing or refactoring old code, scrub main loop has been completely rewritten also refactoring old code. There are some changes to non-btrfs code, mostly trivial, the cgroup punt bio logic is only moved from generic code. Performance improvements: - improve logging changes in a directory during one transaction, avoid iterating over items and reduce lock contention (fsync time 4x lower) - when logging directory entries during one transaction, reduce locking of subvolume trees by checking tree-log instead (improvement in throughput and latency for concurrent access to a subvolume) Notable fixes: - dev-replace: - properly honor read mode when requested to avoid reading from source device - target device won't be used for eventual read repair, this is unreliable for NODATASUM files - when there are unpaired (and unrepairable) metadata during replace, exit early with error and don't try to finish whole operation - scrub ioctl properly rejects unknown flags - fix global block reserve calculations - fix partial direct io write when there's a page fault in the middle, iomap will try to continue with partial request but the btrfs part did not match that, this can lead to zeros written instead of data Core changes: - io path: - continued cleanups and refactoring around bio handling - extent io submit path simplifications and cleanups - flush write path simplifications and cleanups - rework logic of passing sync mode of bio, with further cleanups - rewrite scrub code flow, restructure how the stripes are enumerated and verified in a more unified way - allow to set lower threshold for block group reclaim in debug mode to aid zoned mode testing - remove obsolete time-based delayed ref throttling logic when truncating items - DREW locks are not using percpu variables anymore - more warning fixes (-Wmaybe-uninitialized) - u64 division simplifications - error handling improvements Non-btrfs code changes: - push cgroup punt bio logic to btrfs code (there was no other user of that), the functionality can be now selected separately by BLK_CGROUP_PUNT_BIO - crc32c_impl removed after removing last uses in btrfs code - add btrfs_assertfail() to objtool table" * tag 'for-6.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (147 commits) btrfs: mark btrfs_assertfail() __noreturn btrfs: fix uninitialized variable warnings btrfs: use log root when iterating over index keys when logging directory btrfs: avoid iterating over all indexes when logging directory btrfs: dev-replace: error out if we have unrepaired metadata error during btrfs: remove pointless loop at btrfs_get_next_valid_item() btrfs: scrub: reject unsupported scrub flags btrfs: reinterpret async discard iops_limit=0 as no delay btrfs: set default discard iops_limit to 1000 btrfs: remove unused raid56 functions which were dedicated for scrub btrfs: scrub: remove scrub_bio structure btrfs: scrub: remove scrub_block and scrub_sector structures btrfs: scrub: remove the old scrub recheck code btrfs: scrub: remove the old writeback infrastructure btrfs: scrub: remove scrub_parity structure btrfs: scrub: use scrub_stripe to implement RAID56 P/Q scrub btrfs: scrub: switch scrub_simple_mirror() to scrub_stripe infrastructure btrfs: scrub: introduce helper to queue a stripe for scrub btrfs: scrub: introduce error reporting functionality for scrub_stripe btrfs: scrub: introduce a writeback helper for scrub_stripe ... commit 94fc0792661a96d64a4bb79cf10d0793ecadf76e Merge: 0cfcde1fafc23 36d532d713db5 Author: Linus Torvalds Date: Wed Apr 26 09:07:46 2023 -0700 Merge tag 'fs_for_v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, reiserfs, udf, and quota updates from Jan Kara: "A couple of small fixes and cleanups for ext2, udf, reiserfs, and quota. The biggest change is making CONFIG_PRINT_QUOTA_WARNING depend on BROKEN with an outlook for removing it completely in an year or so" * tag 'fs_for_v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: quota: mark PRINT_QUOTA_WARNING as BROKEN quota: update Kconfig comment reiserfs: remove unused iter variable quota: Use register_sysctl_init() for registering fs_dqstats_table reiserfs: remove unused sched_count variable ext2: remove redundant assignment to pointer end quota: make dquot_set_dqinfo return errors from ->write_info quota: fixup *_write_file_info() to return proper error code quota: simplify two-level sysctl registration for fs_dqstats_table udf: use wrapper i_blocksize() in udf_discard_prealloc() udf: Use folios in udf_adinicb_writepage() ext2: Check block size validity during mount ext2: Correct maximum ext2 filesystem block size commit 45dd403da851124412d32e3193c21de4a51d29da Author: Ard Biesheuvel Date: Tue Apr 18 15:49:49 2023 +0200 efi/zboot: arm64: Inject kernel code size symbol into the zboot payload The EFI zboot code is not built as part of the kernel proper, like the ordinary EFI stub, but still needs access to symbols that are defined only internally in the kernel, and are left unexposed deliberately to avoid creating ABI inadvertently that we're stuck with later. So capture the kernel code size of the kernel image, and inject it as an ELF symbol into the object that contains the compressed payload, where it will be accessible to zboot code that needs it. Signed-off-by: Ard Biesheuvel Acked-by: Mark Rutland commit b09313dd2e726fe5e1fa574cd73f5e326c6030a4 Author: Andrew Jones Date: Wed Apr 26 16:13:33 2023 +0200 RISC-V: hwprobe: Explicity check for -1 in vdso init id_bitsmash is unsigned. We need to explicitly check for -1, rather than use > 0. Fixes: aa5af0aa90ba ("RISC-V: Add hwprobe vDSO function and data") Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Reviewed-by: Evan Green Link: https://lore.kernel.org/r/20230426141333.10063-3-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 08dc107594681040587c23a097cfa678e51f5af2 Author: Andrew Jones Date: Wed Apr 26 16:13:32 2023 +0200 RISC-V: hwprobe: There can only be one first Only capture the first cpu_id in order for the comparison below to be of any use. Fixes: ea3de9ce8aa2 ("RISC-V: Add a syscall for HW probing") Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Reviewed-by: Evan Green Link: https://lore.kernel.org/r/20230426141333.10063-2-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 0cfcde1fafc23068f57afa50faa3e69487b7cd30 Merge: c3558a6b2a75d 519fe1bae7e20 Author: Linus Torvalds Date: Wed Apr 26 08:57:41 2023 -0700 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "There are a number of major cleanups in ext4 this cycle: - The data=journal writepath has been significantly cleaned up and simplified, and reduces a large number of data=journal special cases by Jan Kara. - Ojaswin Muhoo has replaced linked list used to track extents that have been used for inode preallocation with a red-black tree in the multi-block allocator. This improves performance for workloads which do a large number of random allocating writes. - Thanks to Kemeng Shi for a lot of cleanup and bug fixes in the multi-block allocator. - Matthew wilcox has converted the code paths for reading and writing ext4 pages to use folios. - Jason Yan has continued to factor out ext4_fill_super() into smaller functions for improve ease of maintenance and comprehension. - Josh Triplett has created an uapi header for ext4 userspace API's" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (105 commits) ext4: Add a uapi header for ext4 userspace APIs ext4: remove useless conditional branch code ext4: remove unneeded check of nr_to_submit ext4: move dax and encrypt checking into ext4_check_feature_compatibility() ext4: factor out ext4_block_group_meta_init() ext4: move s_reserved_gdt_blocks and addressable checking into ext4_check_geometry() ext4: rename two functions with 'check' ext4: factor out ext4_flex_groups_free() ext4: use ext4_group_desc_free() in ext4_put_super() to save some duplicated code ext4: factor out ext4_percpu_param_init() and ext4_percpu_param_destroy() ext4: factor out ext4_hash_info_init() Revert "ext4: Fix warnings when freezing filesystem with journaled data" ext4: Update comment in mpage_prepare_extent_to_map() ext4: Simplify handling of journalled data in ext4_bmap() ext4: Drop special handling of journalled data from ext4_quota_on() ext4: Drop special handling of journalled data from ext4_evict_inode() ext4: Fix special handling of journalled data from extent zeroing ext4: Drop special handling of journalled data from extent shifting operations ext4: Drop special handling of journalled data from ext4_sync_file() ext4: Commit transaction before writing back pages in data=journal mode ... commit c3558a6b2a75d9adacf15dd7fae79dbfffa7ebe4 Merge: dbe0e78d0e3a8 04839139213cf Author: Linus Torvalds Date: Wed Apr 26 08:51:51 2023 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity updates from Eric Biggers: "Several cleanups and fixes for fs/verity/, including a couple minor fixes to the changes in 6.3 that added support for Merkle tree block sizes less than the page size" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds fsverity: explicitly check for buffer overflow in build_merkle_tree() fsverity: use WARN_ON_ONCE instead of WARN_ON fs-verity: simplify sysctls with register_sysctl() fs/buffer.c: use b_folio for fsverity work commit dbe0e78d0e3a83dd924ea01bebf6c45313c81607 Merge: 733f7e9c18c5e 83e57e47906ce Author: Linus Torvalds Date: Wed Apr 26 08:37:51 2023 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt updates from Eric Biggers: "A few cleanups for fs/crypto/, and another patch to prepare for the upcoming CephFS encryption support" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: optimize fscrypt_initialize() fscrypt: use WARN_ON_ONCE instead of WARN_ON fscrypt: new helper function - fscrypt_prepare_lookup_partial() fs/buffer.c: use b_folio for fscrypt work commit 733f7e9c18c5e377025c1bfdce6bc9a7d55649be Merge: 98f99e67a1dc4 482c84e906e53 Author: Linus Torvalds Date: Wed Apr 26 08:32:52 2023 -0700 Merge tag 'v6.4-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Total usage stats now include all that returned errors (instead of just some) - Remove maximum hash statesize limit - Add cloning support for hmac and unkeyed hashes - Demote BUG_ON in crypto_unregister_alg to a WARN_ON Algorithms: - Use RIP-relative addressing on x86 to prepare for PIE build - Add accelerated AES/GCM stitched implementation on powerpc P10 - Add some test vectors for cmac(camellia) - Remove failure case where jent is unavailable outside of FIPS mode in drbg - Add permanent and intermittent health error checks in jitter RNG Drivers: - Add support for 402xx devices in qat - Add support for HiSTB TRNG - Fix hash concurrency issues in stm32 - Add OP-TEE firmware support in caam" * tag 'v6.4-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (139 commits) i2c: designware: Add doorbell support for Mendocino i2c: designware: Use PCI PSP driver for communication powerpc: Move Power10 feature PPC_MODULE_FEATURE_P10 crypto: p10-aes-gcm - Remove POWER10_CPU dependency crypto: testmgr - Add some test vectors for cmac(camellia) crypto: cryptd - Add support for cloning hashes crypto: cryptd - Convert hash to use modern init_tfm/exit_tfm crypto: hmac - Add support for cloning crypto: hash - Add crypto_clone_ahash/shash crypto: api - Add crypto_clone_tfm crypto: api - Add crypto_tfm_get crypto: x86/sha - Use local .L symbols for code crypto: x86/crc32 - Use local .L symbols for code crypto: x86/aesni - Use local .L symbols for code crypto: x86/sha256 - Use RIP-relative addressing crypto: x86/ghash - Use RIP-relative addressing crypto: x86/des3 - Use RIP-relative addressing crypto: x86/crc32c - Use RIP-relative addressing crypto: x86/cast6 - Use RIP-relative addressing crypto: x86/cast5 - Use RIP-relative addressing ... commit 98f99e67a1dc456e9a542584819b2aa265ffc737 Merge: 0cfd8703e7da6 00168b415a60c Author: Linus Torvalds Date: Wed Apr 26 08:25:57 2023 -0700 Merge tag 'flex-array-transformations-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull flexible-array updates from Gustavo Silva: "Transform more zero-length and one-element arrays into C99 flexible-array members" * tag 'flex-array-transformations-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: uapi: net: ipv6: Replace fake flex-array with flex-array member drm/vmwgfx: Replace one-element array with flexible-array member ASoC: uapi: Replace zero-length arrays with __DECLARE_FLEX_ARRAY() helper commit 26e7aacb83dfd04330673c5c9ac336560da52bb3 Author: Alexandre Ghiti Date: Mon Apr 24 11:23:13 2023 +0200 riscv: Allow to downgrade paging mode from the command line Add 2 early command line parameters that allow to downgrade satp mode (using the same naming as x86): - "no5lvl": use a 4-level page table (down from sv57 to sv48) - "no4lvl": use a 3-level page table (down from sv57/sv48 to sv39) Note that going through the device tree to get the kernel command line works with ACPI too since the efi stub creates a device tree anyway with the command line. In KASAN kernels, we can't use the libfdt that early in the boot process since we are not ready to execute instrumented functions. So instead of using the "generic" libfdt, we compile our own versions of those functions that are not instrumented and that are prefixed so that they do not conflict with the generic ones. We also need the non-instrumented versions of the string functions and the prefixed versions of memcpy/memmove. This is largely inspired by commit aacd149b6238 ("arm64: head: avoid relocating the kernel twice for KASLR") from which I removed compilation flags that were not relevant to RISC-V at the moment (LTO, SCS). Also note that we have to link with -z norelro to avoid ld.lld to throw a warning with the new .got sections, like in commit 311bea3cb9ee ("arm64: link with -z norelro for LLD or aarch64-elf"). Signed-off-by: Alexandre Ghiti Tested-by: Björn Töpel Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230424092313.178699-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit d4dda690b44a5e36b4bf108c48177cef40c80d24 Author: Conor Dooley Date: Mon Apr 24 18:05:43 2023 +0100 dt-bindings: riscv: add sv57 mmu-type Dumping the dtb from new versions of QEMU warns that sv57 is an undocumented mmu-type. The kernel has supported sv57 for about a year, so bring it into the fold. Signed-off-by: Conor Dooley Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230424-rival-habitual-478567c516f0@spud Signed-off-by: Palmer Dabbelt commit 9e9ff39243ea8795a4833708613f884b39dc91f9 Author: Nishanth Menon Date: Mon Apr 17 20:00:19 2023 -0500 dt-bindings: mfd: ti,j721e-system-controller: Add SoC chip ID The system-controller node also contains the chip-id node that is used to identify the SoC specific properties. Add a pattern property to match to the same, and add to the example. Signed-off-by: Nishanth Menon Acked-by: Krzysztof Kozlowski Reviewed-by: Roger Quadros Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230418010019.1222431-1-nm@ti.com commit 3808b8424b476ceb8ac7610ff3bb377ad1893847 Author: Andreas Kemnade Date: Wed Apr 19 13:18:06 2023 +0200 leds: bd2606mvv: Driver for the Rohm 6 Channel i2c LED driver The device provides 6 channels which can be individually turned off and on but groups of two channels share a common brightness register. Limitation: The GPIO to enable the device is not used yet. Signed-off-by: Andreas Kemnade Reviewed-by: Matti Vaittinen Acked-by: Pavel Machek Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230419111806.1100437-3-andreas@kemnade.info commit 9f0184ac1dcb48efe724ec6482f88d85579b52df Author: Krzysztof Kozlowski Date: Sun Apr 16 14:32:03 2023 +0200 dt-bindings: mfd: qcom,spmi-pmic: Document flash LED controller The Qualcomm SPMI PMIC come also with a LED controller for flash LEDs, already used in DTS: sm8250-hdk.dtb: pmic@5: 'led-controller@d300' does not match any of the regexes: ... From schema: Documentation/devicetree/bindings/mfd/qcom,spmi-pmic.yaml Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230416123203.299740-1-krzysztof.kozlowski@linaro.org commit 34480c6e1746138880778af9b86e86a95e0264fb Author: Shengyu Qu Date: Fri Apr 21 23:08:14 2023 +0800 dt-bindings: mfd: x-powers,axp152: Document the AXP15060 variant The X-Powers AXP15060 is a PMIC seen on Starfive Visionfive 2 board. Add relative compatible item and CPUSLDO support and disables DC-DC frequency setting for it. Signed-off-by: Shengyu Qu Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/TY3P286MB261177CF7AA2959BD9517DA998609@TY3P286MB2611.JPNP286.PROD.OUTLOOK.COM commit e0f8ad2a705367518b5c56bf9d6da89681467c02 Author: Shengyu Qu Date: Fri Apr 21 23:08:15 2023 +0800 mfd: axp20x: Add support for AXP15060 PMIC The AXP15060 is a PMIC chip produced by X-Powers, and could be connected via an I2C bus. Describe the regmap and the MFD bits, along with the registers exposed via I2C. Eventually advertise the device using a new compatible string and add support for power off the system. The driver would disable PEK function if IRQ is not configured in device tree, since some boards (For example, Starfive Visionfive 2) didn't connect IRQ line of PMIC to SOC. GPIO function isn't enabled in this commit, since its configuration operation is different from any existing AXP PMICs and needs logic modification on existing driver. GPIO support might come in later patches. Signed-off-by: Shengyu Qu Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/TY3P286MB261162D57695AC8164ED50E298609@TY3P286MB2611.JPNP286.PROD.OUTLOOK.COM commit c91b4a07655d5ba67962a08dfac8bd7f45ad049c Author: Stafford Horne Date: Fri Apr 14 08:31:08 2023 +0100 openrisc: Add floating point regset Define REGSET_FPU to allow reading and writing the FPCSR fpu state register. This will be used primarily by debuggers like GDB. Signed-off-by: Stafford Horne commit 27267655c5313ba0f5a3caa9ad35d887d9a12574 Author: Stafford Horne Date: Fri Apr 14 08:27:51 2023 +0100 openrisc: Support floating point user api Add support for handling floating point exceptions and forwarding the SIGFPE signal to processes. Also, add fpu state to sigcontext. Signed-off-by: Stafford Horne commit 63d7f9f11e5e81de2ce8f1c7a8aaed5b0288eddf Author: Stafford Horne Date: Fri Apr 14 08:25:58 2023 +0100 openrisc: Support storing and restoring fpu state OpenRISC floating point state is not so expensive to save as OpenRISC uses general purpose registers for floating point instructions. We need to save only the floating point status and control register, FPCSR. Add support to maintain the FPCSR unconditionally upon exceptions and switches. On machines that do not support FPU this will always just store 0x0 and restore is a no-op. On FPU systems this adds an additional special purpose register read/write and read/write to memory (already cached). Signed-off-by: Stafford Horne commit 812489ac4dd91144a74ce65ecf232252a2e406fb Author: Stafford Horne Date: Sat Feb 11 19:14:06 2023 +0900 openrisc: Properly store r31 to pt_regs on unhandled exceptions In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception") the unhandled exception path was changed to do an early store of r30 instead of r31. The entry code was not updated and r31 is not getting stored to pt_regs. This patch updates the entry handler to store r31 instead of r30. We also remove some misleading commented out store r30 and r31 instructrions. I noticed this while working on adding floating point exception handling, This issue probably would never impact anything since we kill the process or Oops right away on unhandled exceptions. Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception") Signed-off-by: Stafford Horne commit adace4408252cc1c9913958d71e81a688af90a30 Author: Ken Lin Date: Wed Apr 26 03:22:57 2023 +0000 tracing: Add missing spaces in trace_print_hex_seq() If the buffer length is larger than 16 and concatenate is set to false, there would be missing spaces every 16 bytes. Example: Before: c5 11 10 50 05 4d 31 40 00 40 00 40 00 4d 31 4000 40 00 After: c5 11 10 50 05 4d 31 40 00 40 00 40 00 4d 31 40 00 40 00 Link: https://lore.kernel.org/linux-trace-kernel/20230426032257.3157247-1-lyenting@google.com Signed-off-by: Ken Lin Signed-off-by: Steven Rostedt (Google) commit 7c339fb4d8577792378136c15fde773cfb863cb8 Author: Tze-nan Wu Date: Wed Apr 26 14:20:23 2023 +0800 ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus In ring_buffer_reset_online_cpus, the buffer_size_kb write operation may permanently fail if the cpu_online_mask changes between two for_each_online_buffer_cpu loops. The number of increases and decreases on both cpu_buffer->resize_disabled and cpu_buffer->record_disabled may be inconsistent, causing some CPUs to have non-zero values for these atomic variables after the function returns. This issue can be reproduced by "echo 0 > trace" while hotplugging cpu. After reproducing success, we can find out buffer_size_kb will not be functional anymore. To prevent leaving 'resize_disabled' and 'record_disabled' non-zero after ring_buffer_reset_online_cpus returns, we ensure that each atomic variable has been set up before atomic_sub() to it. Link: https://lore.kernel.org/linux-trace-kernel/20230426062027.17451-1-Tze-nan.Wu@mediatek.com Cc: stable@vger.kernel.org Cc: Cc: npiggin@gmail.com Fixes: b23d7a5f4a07 ("ring-buffer: speed up buffer resets by avoiding synchronize_rcu for each CPU") Reviewed-by: Cheng-Jui Wang Signed-off-by: Tze-nan Wu Signed-off-by: Steven Rostedt (Google) commit 647a2a6428f2cd01e53079ac16e17fdeff229e68 Author: Chuck Lever Date: Fri Apr 14 20:18:02 2023 -0400 SUNRPC: Convert svc_xprt_release() to the release_pages() API Instead of invoking put_page() one-at-a-time, pass the "response" portion of rq_pages directly to release_pages() to reduce the number of times each nfsd thread invokes a page allocator API. Since svc_xprt_release() is not invoked while a client is waiting for an RPC Reply, this is not expected to directly impact mean request latencies on a lightly or moderately loaded server. However as workload intensity increases, I expect somewhat better scalability: the same number of server threads should be able to handle more work. Reviewed-by: Calum Mackay Signed-off-by: Chuck Lever commit b20cb39def085723868972182fb58fa906839a4f Author: Chuck Lever Date: Fri Apr 14 20:17:56 2023 -0400 SUNRPC: Relocate svc_free_res_pages() Clean-up: There doesn't seem to be a reason why this function is stuck in a header. One thing it prevents is the convenient addition of tracing. Moving it to a source file also makes the rq_respages clean-up logic easier to find. Reviewed-by: Calum Mackay Signed-off-by: Chuck Lever commit 92e4a6733f922f0fef1d0995f7b2d0eaff86c7ea Author: Jeff Layton Date: Fri Apr 14 17:31:44 2023 -0400 nfsd: simplify the delayed disposal list code When queueing a dispose list to the appropriate "freeme" lists, it pointlessly queues the objects one at a time to an intermediate list. Remove a few helpers and just open code a list_move to make it more clear and efficient. Better document the resulting functions with kerneldoc comments. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 55fcc7d9159de886296626e47db2c81f8578c7e1 Author: Chuck Lever Date: Mon Apr 3 13:53:07 2023 -0400 SUNRPC: Ignore return value of ->xpo_sendto Clean up: All callers of svc_process() ignore its return value, so svc_process() can safely be converted to return void. Ditto for svc_send(). The return value of ->xpo_sendto() is now used only as part of a trace event. Signed-off-by: Chuck Lever commit ae0d77708aae219a9264a74188d5c1b1a5754da6 Author: Chuck Lever Date: Tue Mar 7 09:14:46 2023 -0500 SUNRPC: Ensure server-side sockets have a sock->file The TLS handshake upcall mechanism requires a non-NULL sock->file on the socket it hands to user space. svc_sock_free() already releases sock->file properly if one exists. Signed-off-by: Chuck Lever commit 0f5162480bd25bd97b91c9153db7afbd89698804 Author: Chuck Lever Date: Fri Mar 17 17:09:20 2023 -0400 NFSD: Watch for rq_pages bounds checking errors in nfsd_splice_actor() There have been several bugs over the years where the NFSD splice actor has attempted to write outside the rq_pages array. This is a "should never happen" condition, but if for some reason the pipe splice actor should attempt to walk past the end of rq_pages, it needs to terminate the READ operation to prevent corruption of the pointer addresses in the fields just beyond the array. A server crash is thus prevented. Since the code is not behaving, the READ operation returns -EIO to the client. None of the READ payload data can be trusted if the splice actor isn't operating as expected. Suggested-by: Jeff Layton Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit 376bcd9b37632cf191711a68aa25ab42f0048c2e Author: Luis Chamberlain Date: Sat Mar 11 15:39:40 2023 -0800 sunrpc: simplify two-level sysctl registration for svcrdma_parm_table There is no need to declare two tables to just create directories, this can be easily be done with a prefix path with register_sysctl(). Simplify this registration. Signed-off-by: Luis Chamberlain Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit cf64b9bce95095b80f4589e4f54572cc5d8c1538 Author: NeilBrown Date: Wed Mar 8 17:51:00 2023 +1100 SUNRPC: return proper error from get_expiry() The get_expiry() function currently returns a timestamp, and uses the special return value of 0 to indicate an error. Unfortunately this causes a problem when 0 is the correct return value. On a system with no RTC it is possible that the boot time will be seen to be "3". When exportfs probes to see if a particular filesystem supports NFS export it tries to cache information with an expiry time of "3". The intention is for this to be "long in the past". Even with no RTC it will not be far in the future (at most a second or two) so this is harmless. But if the boot time happens to have been calculated to be "3", then get_expiry will fail incorrectly as it converts the number to "seconds since bootime" - 0. To avoid this problem we change get_expiry() to report the error quite separately from the expiry time. The error is now the return value. The expiry time is reported through a by-reference parameter. Reported-by: Jerry Zhang Tested-by: Jerry Zhang Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 2f90e18ffec47c265c14e313047189b79784bc0e Author: Jeff Layton Date: Fri Mar 3 07:16:03 2023 -0500 lockd: add some client-side tracepoints Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit e59fb6749ed833deee5b3cfd7e89925296d41f49 Author: Jeff Layton Date: Fri Mar 3 07:16:02 2023 -0500 nfs: move nfs_fhandle_hash to common include file lockd needs to be able to hash filehandles for tracepoints. Move the nfs_fhandle_hash() helper to a common nfs include file. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 244cc19196d2f6691d34e8cd9bc34a55e4f778e5 Author: Jeff Layton Date: Fri Mar 3 07:16:01 2023 -0500 lockd: server should unlock lock if client rejects the grant Currently lockd just dequeues the block and ignores it if the client sends a GRANT_RES with a status of nlm_lck_denied. That status is an indicator that the client has rejected the lock, so the right thing to do is to unlock the lock we were trying to grant. Reported-by: Yongcheng Yang Link: https://bugzilla.redhat.com/show_bug.cgi?id=2063818 Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 2005f5b9c35bd736c81e9f24f5c5051967c022ee Author: Jeff Layton Date: Fri Mar 3 07:16:00 2023 -0500 lockd: fix races in client GRANTED_MSG wait logic After the wait for a grant is done (for whatever reason), nlmclnt_block updates the status of the nlm_rqst with the status of the block. At the point it does this, however, the block is still queued its status could change at any time. This is particularly a problem when the waiting task is signaled during the wait. We can end up giving up on the lock just before the GRANTED_MSG callback comes in, and accept it even though the lock request gets back an error, leaving a dangling lock on the server. Since the nlm_wait never lives beyond the end of nlmclnt_lock, put it on the stack and add functions to allow us to enqueue and dequeue the block. Enqueue it just before the lock/wait loop, and dequeue it just after we exit the loop instead of waiting until the end of the function. Also, scrape the status at the time that we dequeue it to ensure that it's final. Reported-by: Yongcheng Yang Link: https://bugzilla.redhat.com/show_bug.cgi?id=2063818 Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit f0aa4852e63f9c1cfd4322c770e69d7e6817e906 Author: Jeff Layton Date: Fri Mar 3 07:15:59 2023 -0500 lockd: move struct nlm_wait to lockd.h The next patch needs struct nlm_wait in fs/lockd/clntproc.c, so move the definition to a shared header file. As an added clean-up, drop the unused b_reclaim field. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit c88c680c6de5077292667fae4a147fd5a6523479 Author: Jeff Layton Date: Fri Mar 3 07:15:58 2023 -0500 lockd: remove 2 unused helper functions Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit bfca7a6f0c75f5d97f5efc2c80cca55bdbf5f79a Author: Jeff Layton Date: Fri Mar 3 07:15:57 2023 -0500 lockd: purge resources held on behalf of nlm clients when shutting down It's easily possible for the server to have an outstanding lock when we go to shut down. When that happens, we often get a warning like this in the kernel log: lockd: couldn't shutdown host module for net f0000000! This is because the shutdown procedures skip removing any hosts that still have outstanding resources (locks). Eventually, things seem to get cleaned up anyway, but the log message is unsettling, and server shutdown doesn't seem to be working the way it was intended. Ensure that we tear down any resources held on behalf of a client when tearing one down for server shutdown. Reported-by: Yongcheng Yang Link: https://bugzilla.redhat.com/show_bug.cgi?id=2063818 Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit c4c649ab413ba6a785b25f0edbb12f617c87db2a Author: Chuck Lever Date: Thu Nov 24 15:09:04 2022 -0500 NFSD: Convert filecache to rhltable While we were converting the nfs4_file hashtable to use the kernel's resizable hashtable data structure, Neil Brown observed that the list variant (rhltable) would be better for managing nfsd_file items as well. The nfsd_file hash table will contain multiple entries for the same inode -- these should be kept together on a list. And, it could be possible for exotic or malicious client behavior to cause the hash table to resize itself on every insertion. A nice simplification is that rhltable_lookup() can return a list that contains only nfsd_file items that match a given inode, which enables us to eliminate specialized hash table helper functions and use the default functions provided by the rhashtable implementation). Since we are now storing nfsd_file items for the same inode on a single list, that effectively reduces the number of hash entries that have to be tracked in the hash table. The mininum bucket count is therefore lowered. Light testing with fstests generic/531 show no regressions. Suggested-by: Neil Brown Signed-off-by: Chuck Lever commit dcb779fcd4ed5984ad15991d574943d12a8693d1 Author: Jeff Layton Date: Wed Feb 15 06:53:54 2023 -0500 nfsd: allow reaping files still under writeback On most filesystems, there is no reason to delay reaping an nfsd_file just because its underlying inode is still under writeback. nfsd just relies on client activity or the local flusher threads to do writeback. The main exception is NFS, which flushes all of its dirty data on last close. Add a new EXPORT_OP_FLUSH_ON_CLOSE flag to allow filesystems to signal that they do this, and only skip closing files under writeback on such filesystems. Also, remove a redundant NULL file pointer check in nfsd_file_check_writeback, and clean up nfs's export op flag definitions. Signed-off-by: Jeff Layton Acked-by: Anna Schumaker Signed-off-by: Chuck Lever commit 972cc0e0924598cb293b919d39c848dc038b2c28 Author: Jeff Layton Date: Thu Jan 26 12:21:16 2023 -0500 nfsd: update comment over __nfsd_file_cache_purge Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit b2ff1bd71db2a1b193a6dde0845adcd69cbcf75e Author: Jeff Layton Date: Wed Jan 18 12:31:37 2023 -0500 nfsd: don't take/put an extra reference when putting a file The last thing that filp_close does is an fput, so don't bother taking and putting the extra reference. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit b680cb9b737331aad271feebbedafb865504e234 Author: Jeff Layton Date: Thu Jan 5 07:15:12 2023 -0500 nfsd: add some comments to nfsd_file_do_acquire David Howells mentioned that he found this bit of code confusing, so sprinkle in some comments to clarify. Reported-by: David Howells Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit c6593366c0bf222be9c7561354dfb921c611745e Author: Jeff Layton Date: Thu Jan 5 07:15:11 2023 -0500 nfsd: don't kill nfsd_files because of lease break error An error from break_lease is non-fatal, so we needn't destroy the nfsd_file in that case. Just put the reference like we normally would and return the error. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit d69b8dbfd0866abc5ec84652cc1c10fc3d4d91ef Author: Jeff Layton Date: Fri Jan 6 10:39:01 2023 -0500 nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator test_bit returns bool, so we can just compare the result of that to the key->gc value without the "!!". Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 6c31e4c98853a4ba47355ea151b36a77c42b7734 Author: Jeff Layton Date: Fri Jan 6 10:39:00 2023 -0500 nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries Since v4 files are expected to be long-lived, there's little value in closing them out of the cache when there is conflicting access. Change the comparator to also match the gc value in the key. Change both of the current users of that key to set the gc value in the key to "true". Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit b8bea9f6cdd7236c7c2238d022145e9b2f8aac22 Author: Jeff Layton Date: Thu Jan 5 07:15:09 2023 -0500 nfsd: don't open-code clear_and_wake_up_bit Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 9892bd72efdc9daa7c07ca9f427ac7e5928c7704 Author: Masahiro Yamada Date: Tue Apr 25 20:08:59 2023 +0900 kbuild: deb-pkg: specify targets in debian/rules as .PHONY If a file with the same name exists, the target is not run. For example, the following command fails. $ make O=build-arch bindeb-pkg [ snip ] sed: can't read modules.order: No such file or directory make[6]: *** [../Makefile:1577: __modinst_pre] Error 2 make[5]: *** [../scripts/Makefile.package:150: intdeb-pkg] Error 2 make[4]: *** [../Makefile:1657: intdeb-pkg] Error 2 make[3]: *** [debian/rules:14: binary-arch] Error 2 dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2 make[2]: *** [../scripts/Makefile.package:139: bindeb-pkg] Error 2 Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit dbb5f7c3fae38de3e69d48b984e6f539993a02d3 Author: Randy Dunlap Date: Thu Apr 13 13:38:57 2023 -0700 sparc: unify sparc32/sparc64 archhelp Currently, entering $ make ARCH=sparc32 help prints the archhelp text for sparc64. ["sparc32" is documented (Documentation/kbuild/kbuild.rst) to be a recognized alias for 32-bit sparc.] Instead of handling ARCH=sparc or ARCH=sparc32 or ARCH=sparc64, just unify all SPARC archhelp text in one place. Fixes: 5e53879008b9 ("sparc,sparc64: unify Makefile") Signed-off-by: Randy Dunlap Suggested-by: Masahiro Yamada Signed-off-by: Masahiro Yamada commit c51e431052e2eacfb23fbf6b39bc6c8770d9827a Author: jasontao Date: Wed Apr 26 09:30:59 2023 +0800 ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs. Add a set of HD Audio PCI IDS, and the HDMI codec vendor IDs for Glenfly Gpus. - In default_bdl_pos_adj, set bdl to 128 as Glenfly Gpus have hardware limitation, need to increase hdac interrupt interval. - In azx_first_init, enable polling mode for Glenfly Gpu. When the codec complete the command, it sends interrupt and writes response entries to memory, howerver, the write requests sometimes are not actually synchronized to memory when driver handle hdac interrupt on Glenfly Gpus. If the RIRB status is not updated in the interrupt handler, azx_rirb_get_response keeps trying to recevie a response from rirb until 1s timeout. Enabling polling mode for Glenfly Gpu can fix the issue. - In patch_gf_hdmi, set Glenlfy Gpu Codec's no_sticky_stream as it need driver to do actual clean-ups for the linked codec when switch from one codec to another. Signed-off-by: jasontao Signed-off-by: Reaper Li Link: https://lore.kernel.org/r/20230426013059.4329-1-reaperlioc@glenfly.com Signed-off-by: Takashi Iwai commit a33c6a22f6d616caab6f5a5bfaa7ee01ea567d82 Author: Martin Botka Date: Sat Apr 1 01:18:48 2023 +0100 dt-bindings: mfd: x-powers,axp152: Document the AXP313a variant The X-Powers AXP313a is a PMIC used on some devices with the Allwinner H616 or H313 SoC. According to the datasheet, the DC/DC converter PWM frequency is fixed (to 3 MHz), so disallow the property that lets us set this frequency for the other PMICs. Signed-off-by: Martin Botka Signed-off-by: Andre Przywara Reviewed-by: Krzysztof Kozlowski Acked-by: Chen-Yu Tsai Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230401001850.4988-2-andre.przywara@arm.com (cherry picked from commit 2a9e8a1a7c4caadf690e5a77fe4162c5edab4a9c) Signed-off-by: Lee Jones commit 1e28dfdf40d7293882ba7eb70a3bc0e9ab625377 Author: Dan Carpenter Date: Thu Apr 20 18:02:11 2023 +0300 counter: rz-mtu3-cnt: Unlock on error in rz_mtu3_count_ceiling_write() These error paths need to call mutex_unlock(&priv->lock) before returning. The lock is taken in rz_mtu3_lock_if_counter_is_valid(). Fixes: 25d21447d896 ("counter: Add Renesas RZ/G2L MTU3a counter driver") Signed-off-by: Dan Carpenter Acked-by: William Breathitt Gray Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/7b535d6b-6031-493a-84f6-82842089e637@kili.mountain commit 1706636eafcab76e08784f66f80f00d9aa59bed1 Author: Benjamin Bara Date: Wed Apr 5 19:14:36 2023 +0200 dt-bindings: mfd: dlg,da9063: Document voltage monitoring Document that the da9063 only provides under- *and* over-voltage monitoring in one, and therefore requires both to be configured with the same severity and value. Add an example for clarification. Signed-off-by: Benjamin Bara Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230403-da9063-disable-unused-v3-3-cc4dc698864c@skidata.com commit 378b0e9f247450c9c4e49f02d9d79799a0c7c349 Author: Patrick Delaunay Date: Mon Apr 17 18:14:06 2023 +0200 dt-bindings: mfd: stm32: Remove unnecessary blank lines Remove double blank line. Signed-off-by: Patrick Delaunay Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230417181342.v2.1.I483a676579cc7e3ac07e1db649091553743fecc8@changeid commit b24e335b7d73b5d65d09144319c62aa967b6abc8 Author: Marijn Suijten Date: Mon Apr 10 22:29:16 2023 +0200 dt-bindings: mfd: qcom,spmi-pmic: Use generic ADC node name in examples Update the examples to reflect a future requirement for the generic `channel` node name on ADC channel nodes, while conveying the board name of the channel in a label instead. Signed-off-by: Marijn Suijten Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230410202917.247666-5-marijn.suijten@somainline.org commit dbc5e57200e9ed14f08c5493c8633200cf07d700 Author: Jacky Huang Date: Tue Mar 28 02:19:05 2023 +0000 dt-bindings: mfd: syscon: Add nuvoton,ma35d1-sys compatible Add Nuvoton ma35d1 system registers compatible. Signed-off-by: Jacky Huang Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230328021912.177301-6-ychuang570808@gmail.com commit 5dee9439cc2d60ff35cad04b618ee53f48a7cfc2 Author: Biju Das Date: Thu Mar 30 12:16:31 2023 +0100 MAINTAINERS: Add entries for Renesas RZ/G2L MTU3a counter driver Add the MAINTAINERS entries for the Renesas RZ/G2L MTU3a counter driver. Signed-off-by: Biju Das Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230330111632.169434-6-biju.das.jz@bp.renesas.com commit 0be8907359df4c62319f5cb2c6981ff0d9ebf35a Author: Biju Das Date: Thu Mar 30 12:16:30 2023 +0100 counter: Add Renesas RZ/G2L MTU3a counter driver Add RZ/G2L MTU3a counter driver. This IP supports the following phase counting modes on MTU1 and MTU2 channels 1) 16-bit phase counting modes on MTU1 and MTU2 channels. 2) 32-bit phase counting mode by cascading MTU1 and MTU2 channels. This patch adds 3 counter value channels. count0: 16-bit phase counter value channel on MTU1 count1: 16-bit phase counter value channel on MTU2 count2: 32-bit phase counter value channel by cascading MTU1 and MTU2 channels. The external input phase clock pin for the counter value channels are as follows: count0: "MTCLKA-MTCLKB" count1: "MTCLKA-MTCLKB" or "MTCLKC-MTCLKD" count2: "MTCLKA-MTCLKB" or "MTCLKC-MTCLKD" Use the sysfs variable "external_input_phase_clock_select" to select the external input phase clock pin and "cascade_counts_enable" to enable/ disable cascading of channels. Signed-off-by: Biju Das Reviewed-by: William Breathitt Gray Acked-by: William Breathitt Gray Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230330111632.169434-5-biju.das.jz@bp.renesas.com commit 7bb985ac03c4a91d185c006f68c4fadfb71e1cca Author: Biju Das Date: Thu Mar 30 12:16:29 2023 +0100 Documentation: ABI: sysfs-bus-counter: add cascade_counts_enable and external_input_phase_clock_select This commit adds cascade_counts_enable and external_input_phase_ clock_select items to counter ABI file. (e.g. for Renesas MTU3 hardware used for phase counting). Signed-off-by: Biju Das Reviewed-by: William Breathitt Gray Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230330111632.169434-4-biju.das.jz@bp.renesas.com commit 654c293e1687b31819f9bf1ac71b5a85a8053210 Author: Biju Das Date: Thu Mar 30 12:16:28 2023 +0100 mfd: Add Renesas RZ/G2L MTU3a core driver The RZ/G2L multi-function timer pulse unit 3 (MTU3a) is embedded in the Renesas RZ/G2L family SoCs. It consists of eight 16-bit timer channels and one 32-bit timer channel. It supports the following functions - Counter - Timer - PWM The 8/16/32 bit registers are mixed in each channel. Add MTU3a core driver for RZ/G2L SoC. The core driver shares the clk and channel register access for the other child devices like Counter, PWM and Clock event. Signed-off-by: Biju Das Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230330111632.169434-3-biju.das.jz@bp.renesas.com commit 0a9d6b54297e216199cbfd08c5e6a35cce152477 Author: Biju Das Date: Thu Mar 30 12:16:27 2023 +0100 dt-bindings: timer: Document RZ/G2L MTU3a bindings The RZ/G2L multi-function timer pulse unit 3 (MTU3a) is embedded in the Renesas RZ/G2L family SoC's. It consists of eight 16-bit timer channels and one 32-bit timer channel. It supports the following functions - Counter - Timer - PWM Signed-off-by: Biju Das Reviewed-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230330111632.169434-2-biju.das.jz@bp.renesas.com commit a29f5a3eeb81717245d28f9fc212229f5407c8d5 Author: Uwe Kleine-König Date: Fri Mar 31 09:03:44 2023 +0200 mfd: rsmu_i2c: Convert to i2c's .probe_new() again This commit reapplies commit 601e6d48ee35 ("mfd: rsmu_i2c: Convert to i2c's .probe_new()") which was accidently reverted by commit 1b3b1d6c27cc ("mfd: rsmu: Support 32-bit address space"). Without this change the driver fails to build in combination with commit 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") which is contained in v6.3-rc2. Fixes: 1b3b1d6c27cc ("mfd: rsmu: Support 32-bit address space") Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230331070344.czphnnmvu2ojzo5l@pengutronix.de commit 72d4a1683741ee578da0e265886e6a7f3d42266c Author: Jarkko Nikula Date: Thu Mar 30 16:26:18 2023 +0300 mfd: intel-lpss: Add Intel Meteor Lake PCH-S LPSS PCI IDs Add Intel Meteor Lake PCH-S also called as Meteor Point-S LPSS PCI IDs. Signed-off-by: Jarkko Nikula Acked-by: Andy Shevchenko Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230330132618.4108665-1-jarkko.nikula@linux.intel.com commit 96da8f148396329ba769246cb8ceaa35f1ddfc48 Author: Qiang Ning Date: Thu Mar 30 10:43:53 2023 +0800 mfd: dln2: Fix memory leak in dln2_probe() When dln2_setup_rx_urbs() in dln2_probe() fails, error out_free forgets to call usb_put_dev() to decrease the refcount of dln2->usb_dev. Fix this by adding usb_put_dev() in the error handling code of dln2_probe(). Signed-off-by: Qiang Ning Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230330024353.4503-1-qning0106@126.com commit 2405fbfb384ef39e9560d76d3f6e4c90519f90aa Author: Hans de Goede Date: Wed Mar 29 22:55:44 2023 +0200 mfd: axp20x: Fix axp288 writable-ranges Register AXP288_POWER_REASON is writable and needs to be written to reset the reset- / power-on-reason bits. Add it to the axp288 writable-ranges so that the extcon-axp288 driver can properly clear the reset- / power-on-reason bits. Signed-off-by: Hans de Goede Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230329205544.1051393-1-hdegoede@redhat.com commit 66c8d55966fd169a36fa2ca6e80517080492e87f Author: Krzysztof Kozlowski Date: Sat Mar 25 12:43:53 2023 +0100 dt-bindings: mfd: x-powers,axp152: Simplify disallowing properties The syntax to disallow x-powers,drive-vbus-en, x-powers,self-working-mode and x-powers,master-mode for certain variants can be made simpler. Also this produces much nicer warning message when the condition hits wrong DTS. Signed-off-by: Krzysztof Kozlowski Acked-by: Chen-Yu Tsai Reviewed-by: Andre Przywara Tested-by: Andre Przywara Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230325114353.50293-1-krzysztof.kozlowski@linaro.org commit 67d6c76fc815cddc77de9529221f9ff8dd1fb10e Author: Min Li Date: Mon Mar 27 14:39:53 2023 -0400 mfd: rsmu: Support 32-bit address space We used to assume 0x2010xxxx address. Now that we need to access 0x2011xxxx address, we need to support read/write the whole 32-bit address space. Also defined RSMU_MAX_WRITE_COUNT and RSMU_MAX_READ_COUNT for readability Signed-off-by: Min Li Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/MW5PR03MB693295AF31ABCAF6AE52EE74A08B9@MW5PR03MB6932.namprd03.prod.outlook.com commit fb9d4960a876e9344ab2c8a22c5c0fcd8c64210d Author: Johan Hovold Date: Mon Mar 20 14:57:10 2023 +0100 dt-bindings: mfd: qcom,spmi-pmic: Add nvram function Add an 'nvram' pattern property and a reference to the corresponding SDAM DT schema. Signed-off-by: Johan Hovold Acked-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230320135710.1989-4-johan+linaro@kernel.org commit 972c91fd7beddc3f19c8c855f6e60e7dbd435cbd Author: Charles Keepax Date: Thu Mar 23 13:41:38 2023 +0000 mfd: arizona-spi: Add missing MODULE_DEVICE_TABLE This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this driver when it is built as a module. Fixes: 3f65555c417c ("mfd: arizona: Split of_match table into I2C and SPI versions") Signed-off-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230323134138.834369-1-ckeepax@opensource.cirrus.com commit 9896a19caf79f83692f13ab688d34c85ecfa92b2 Author: Rob Herring Date: Wed Mar 22 12:35:18 2023 -0500 dt-bindings: mfd: Drop unneeded quotes in 'ref', 'id' and 'schema' entries Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Rob Herring Reviewed-by: Damien Le Moal Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230322173519.3971434-1-robh@kernel.org commit f0484d2f80a72022b7fac72bcb406392900ef1eb Author: Colin Foster Date: Wed Mar 22 07:11:30 2023 -0700 mfd: ocelot-spi: Fix unsupported bulk read Ocelot chips (VSC7511, VSC7512, VSC7513, VSC7514) don't support bulk read operations over SPI. Many SPI buses have hardware that can optimize consecutive reads. Essentially an address is written to the chip, and if the SPI controller continues to toggle the clock, subsequent register values are reported. This can lead to significant optimizations, because the time between "address is written to the chip" and "chip starts to report data" can often take a fixed amount of time. When support for Ocelot chips were added in commit f3e893626abe ("mfd: ocelot: Add support for the vsc7512 chip via spi") it was believed that this optimization was supported. However it is not. Most register transactions with the Ocelot chips are not done in bulk, so this bug could go unnoticed. The one scenario where bulk register operations _are_ performed is when polling port statistics counters, which was added in commit d87b1c08f38a ("net: mscc: ocelot: use bulk reads for stats"). Things get slightly more complicated here... A bug was introduced in commit d4c367650704 ("net: mscc: ocelot: keep ocelot_stat_layout by reg address, not offset") that broke the optimization of bulk reads. This means that when Ethernet support for the VSC7512 chip was added in commit 3d7316ac81ac ("net: dsa: ocelot: add external ocelot switch control") things were actually working "as expected". The bulk read opmtimization was discovered, and fixed in commit 6acc72a43eac ("net: mscc: ocelot: fix stats region batching") and the timing optimizations for SPI were noticed. A bulk read went from ~14ms to ~2ms. But this timing improvement came at the cost of every register reading zero due the fact that bulk reads don't work. The read timings increase back to 13-14ms, but that's a price worth paying in order to receive valid data. This is verified in a DSA setup (cpsw-new switch tied to port 0 on the VSC7512, after having been running overnight) Rx Octets: 16222055 # Counters from CPSW switch Tx Octets: 12034702 Net Octets: 28256757 p00_rx_octets: 12034702 # Counters from Ocelot switch p00_rx_frames_below_65_octets: 0 p00_rx_frames_65_to_127_octets: 88188 p00_rx_frames_128_to_255_octets: 13 p00_rx_frames_256_to_511_octets: 0 p00_rx_frames_512_to_1023_octets: 0 p00_rx_frames_over_1526_octets: 3306 p00_tx_octets: 16222055 Fixes: f3e893626abe ("mfd: ocelot: Add support for the vsc7512 chip via spi") Signed-off-by: Colin Foster Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230322141130.2531256-1-colin.foster@in-advantage.com commit 4363f2113d04db9bafcc79487050ee0c10875c5a Author: Tom Rix Date: Wed Mar 22 08:58:03 2023 -0400 mfd: omap-usb-tll: Remove unused usbtll_readb() function Clang with W=1 reports: drivers/mfd/omap-usb-tll.c:128:18: error: unused function 'usbtll_readb' [-Werror,-Wunused-function] static inline u8 usbtll_readb(void __iomem *base, u32 reg) ^ This function is not used so remove it. Signed-off-by: Tom Rix Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230322125803.2570968-1-trix@redhat.com commit 75c0a1b3fc1c09ed67d22235900cb7e762af1dfd Author: Tom Rix Date: Wed Mar 22 07:58:38 2023 -0400 mfd: twl-core: Remove unused add_child() and add_numbered_child() functions Clang with W=1 reports: drivers/mfd/twl-core.c:654:30: error: unused function 'add_child' [-Werror,-Wunused-function] static inline struct device *add_child(unsigned mod_no, const char *name, ^ add_numbered_child() and its only caller add_child() are not used, so remove them. Signed-off-by: Tom Rix Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230322115838.2569414-1-trix@redhat.com commit 3e0475ec8d9114b600586b0bfb4056565a679a3d Author: Bartosz Golaszewski Date: Tue Mar 14 19:30:33 2023 +0100 dt-bindings: mfd: qcom,spmi-pmic: Add compatible for pmm8654au PMM8654au is the SPMI PMIC variant used on sa8775p-ride. Add a compatible for it. Signed-off-by: Bartosz Golaszewski Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230314183043.619997-5-brgl@bgdev.pl commit 881656790e9bd246b7cf6eb537feb04f09140a40 Author: André Apitzsch Date: Sun Mar 19 13:41:53 2023 +0100 mfd: arizona-i2c: Add the missing device table IDs for OF This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this driver when it is built as a module. Signed-off-by: André Apitzsch Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230319124153.35294-1-git@apitzsch.eu commit 44604617ce7aa0c24fd198b5a8760e018549922f Author: Konrad Dybcio Date: Wed Mar 15 19:38:19 2023 +0100 dt-bindings: mfd: qcom,spmi-pmic: Add PM2250 Add a compatible for PM2250, commonly found with QCM2290. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230315183819.3563704-1-konrad.dybcio@linaro.org commit e90978ecdf9d016e31f6aff36da77255b42fb4fd Author: Geert Uytterhoeven Date: Mon Mar 13 11:58:33 2023 +0100 mfd: rsmu_spi: Remove unneeded casts of void * There is no need to cast a "void *" to a different type of pointer. Signed-off-by: Geert Uytterhoeven Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/ae84c1751e79cb49ab584557f4ecd835a8493d7c.1678704562.git.geert+renesas@glider.be commit 9bb8ccead3b0162cf98091c4ff25e772fd97d953 Author: Krzysztof Kozlowski Date: Sat Mar 11 12:16:29 2023 +0100 mfd: atc260x-i2c: Drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). drivers/mfd/atc260x-i2c.c:44:34: error: ‘atc260x_i2c_of_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230311111629.251830-2-krzysztof.kozlowski@linaro.org commit f130faebcdb6c7fd04c1db9e589d593361b81c13 Author: Krzysztof Kozlowski Date: Sat Mar 11 12:16:28 2023 +0100 mfd: atmel-smc: Mark OF related data as maybe unused The driver can be compile tested with !CONFIG_OF making certain data unused: drivers/mfd/atmel-smc.c:326:34: error: ‘atmel_smc_ids’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230311111629.251830-1-krzysztof.kozlowski@linaro.org commit 01330edcc5ecc92eb9152b27f326618735900502 Author: Rob Herring Date: Fri Mar 10 08:47:12 2023 -0600 mfd: various: Use of_property_read_bool() for boolean properties It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. Convert reading boolean properties to to of_property_read_bool(). Signed-off-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230310144712.1543449-1-robh@kernel.org commit 1ba58fbbe619125af113d0583c4b6bade94168d1 Author: Rob Herring Date: Fri Mar 10 08:47:12 2023 -0600 mfd: various: Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Signed-off-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230310144712.1543379-1-robh@kernel.org commit 2ddbddaf19dcdc60e05c720611faca7ba5176ed9 Author: Nick Alcock Date: Wed Mar 8 19:42:50 2023 +0000 mfd: da903x: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230308194307.374789-1-nick.alcock@oracle.com commit ca9642a623dfc43a8ec8b0ba4694605ea74cef20 Author: Nick Alcock Date: Wed Mar 8 19:42:51 2023 +0000 mfd: da9052: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit adefecd9b506a6f9981cdcda97ae6803bdea0180 Author: Nick Alcock Date: Wed Mar 8 19:42:52 2023 +0000 mfd: da9052-i2c: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit fca17373d26c5e4e98134f97601aff688d164813 Author: Nick Alcock Date: Wed Mar 8 19:42:53 2023 +0000 mfd: da9052-spi: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit 1247f3c3e1f29fc78027dfe4043f6c0413612126 Author: Nick Alcock Date: Wed Mar 8 19:42:54 2023 +0000 mfd: da9055: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit e7bf264def565d77474dd074109cc84948a5058e Author: Nick Alcock Date: Wed Mar 8 19:42:55 2023 +0000 mfd: da9055-i2c: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit 9e646615df195f1864e2384133a42a832a809059 Author: Nick Alcock Date: Wed Mar 8 19:42:56 2023 +0000 mfd: stmpe-i2c: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit 9ca834bd404c2b1e1e7010e7c22c5a1810fd7cd5 Author: Nick Alcock Date: Wed Mar 8 19:42:57 2023 +0000 mfd: stmpe-spi: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit ce1b2783136a1b44b619336fbe76776ae2c8f3ab Author: Nick Alcock Date: Wed Mar 8 19:42:58 2023 +0000 mfd: 88pm860x: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit 65edd14d790cfe076be0da58c457f75b35395c27 Author: Nick Alcock Date: Wed Mar 8 19:43:00 2023 +0000 mfd: tc3589x: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit 0607ad38c2fb0182eba20d4f476558b0547d58a5 Author: Nick Alcock Date: Wed Mar 8 19:43:02 2023 +0000 mfd: ezx-pcap: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit e3dfb3dbd67805914ebda52430257b370554e479 Author: Nick Alcock Date: Wed Mar 8 19:43:04 2023 +0000 mfd: omap-usb-host: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit 85aebcd54e2d22c00e0964442dc5330128e43f9b Author: Nick Alcock Date: Wed Mar 8 19:43:05 2023 +0000 mfd: omap-usb-tll: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit fb2455985b5981e4f8a72667bb3d4bd5b7ca2b12 Author: Nick Alcock Date: Wed Mar 8 19:43:01 2023 +0000 mfd: tps6586x: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit f580386425518643c4027286b48cfa545390be07 Author: Nick Alcock Date: Wed Mar 8 19:43:03 2023 +0000 mfd: lp8788: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit b22f3152494e3b1e2fce4d61ad828420d16e9e5d Author: Nick Alcock Date: Wed Mar 8 19:43:06 2023 +0000 mfd: twl4030-audio: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit 3a101f09b1066991569ce9f4fd1e90a07e97fb3a Author: Nick Alcock Date: Wed Mar 8 19:43:07 2023 +0000 mfd: twl6040: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Lee Jones commit 75a6ff48fe16e4221be68eb354747bb207d61535 Author: Nick Alcock Date: Wed Mar 8 19:42:59 2023 +0000 mfd: da9055: Do not cite as modular This driver cannot be built as a module, so don't suggest otherwise in Kconfig help. Suggested-by: Lee Jones Signed-off-by: Nick Alcock Reviewed-by: Vincenzo Palazzo Signed-off-by: Lee Jones commit c923d5001ba054df10ed3441d24f8f2c01db7e00 Author: Christoph Niedermaier Date: Thu Mar 9 10:22:53 2023 +0100 mfd: da9062: Remove IRQ requirement This patch removes the requirement for an IRQ, because for the core functionality IRQ isn't needed. So this makes the DA9061/62 chip usable for designs which haven't connected the IRQ pin. Signed-off-by: Christoph Niedermaier Acked-by: Adam Ward Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230309092254.56279-2-cniedermaier@dh-electronics.com commit 7d61f6313e90cdbe592eba5e0ae6d1c367b03548 Author: Christoph Niedermaier Date: Thu Mar 9 10:22:52 2023 +0100 mfd: da9062: Use MFD_CELL_OF macro Use MFD_CELL_OF macro helper instead of plain struct properties, which makes the code a bit shorter and to have commonly defined MFD cell attributes. Signed-off-by: Christoph Niedermaier Acked-by: Adam Ward Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230309092254.56279-1-cniedermaier@dh-electronics.com commit 6e264e72299c1aff75b9cf45c4cbebaea2cb5fd6 Author: Andrew Davis Date: Wed Mar 8 10:55:48 2023 -0600 dt-bindings: mfd: Add TI-Nspire misc registers The TI Nspire devices contain a set of registers with a seemingly miscellaneous set of functionality. This area is known simply as the "misc" region. Signed-off-by: Andrew Davis Reviewed-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230308165557.2242-2-afd@ti.com commit a0b9becad8a7d62a81530035a69f744c0e389737 Author: Uwe Kleine-König Date: Wed Mar 8 10:12:57 2023 +0100 mfd: core: Remove .enable() and .disable() callbacks With commit dd77f5fa97d3 ("mfd: Remove toshiba tmio drivers") the last mfd driver that implements these callbacks is gone and since commit 652719b1003a ("w1: remove ds1wm driver") the last user is gone. The corresponding functions mfd_cell_enable() and mfd_cell_disable() are also unused (since commit 0ca222c81977 ("leds: Remove asic3 driver")). Signed-off-by: Uwe Kleine-König Acked-by: Arnd Bergmann Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230308091257.2404932-1-u.kleine-koenig@pengutronix.de commit e8e9837dde98b18b694f79f6268afff7a610bf30 Author: Krzysztof Kozlowski Date: Mon Mar 6 08:26:17 2023 +0100 dt-bindings: mfd: qcom,tcsr: Document SDX55 TCSR Add compatible for SDX55 TCSR block. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230306072618.10770-1-krzysztof.kozlowski@linaro.org commit 0742c2a6335281608ac9e9aee67493e9e30f6195 Author: Patrick Rudolph Date: Tue Mar 7 13:12:45 2023 +0100 mfd: max597x: Add support for MAX5970 and MAX5978 Implement a regulator driver with IRQ support for fault management. Written against documentation [1] and [2] and tested on real hardware. Every channel has it's own regulator supply nammed 'vss1-supply' and 'vss2-supply'. The regulator supply is used to determine the output voltage, as the smart switch provides no output regulation. The driver requires the 'shunt-resistor-micro-ohms' to be present in the devicetree to properly calculate current related values. You must specify compatible devictree layout: regulator@3a { reg = <0x3a>; vss1-supply = <&p3v3>; compatible = "maxim,max5978"; ... regulators { sw0_ref: SW0 { regulator-compatible = "SW0"; shunt-resistor-micro-ohms = <12000>; ... } } } 1: https://datasheets.maximintegrated.com/en/ds/MAX5970.pdf 2: https://datasheets.maximintegrated.com/en/ds/MAX5978.pdf ... Changes in V12: - Use simple_mfd_i2c driver and remove previous implementation. - Remove newline - Use _MFD_MAX597X_H in header file - Successfull build need following patch from regulator: https://lore.kernel.org/r/20230216075302.68935-1-Naresh.Solanki@9elements.com https://lore.kernel.org/r/20230210163225.1208035-1-Naresh.Solanki@9elements.com Signed-off-by: Patrick Rudolph Signed-off-by: Marcello Sylvester Bauer Signed-off-by: Naresh Solanki Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230307121246.127425-2-Naresh.Solanki@9elements.com commit ba2b13df8ab005cee919d2ca31829a3c639fded2 Author: Marcello Sylvester Bauer Date: Tue Mar 7 13:12:44 2023 +0100 dt-bindings: mfd: Add MAX5970 and MAX5978 The MAX597x is a hot swap controller with configurable fault protection. It also has 10bit ADC for current & voltage measurements. ... Changes in V12: - Update title Signed-off-by: Marcello Sylvester Bauer Co-developed-by: Patrick Rudolph Signed-off-by: Patrick Rudolph Co-developed-by: Naresh Solanki Signed-off-by: Naresh Solanki Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230307121246.127425-1-Naresh.Solanki@9elements.com commit 2c6a1bde024ccb0e64ea4bc112d15438abc08949 Author: Rohit Agarwal Date: Wed Mar 8 17:49:48 2023 +0530 dt-bindings: mfd: qcom,tcsr: Add compatible for sdx65 Add the qcom,sdx65-tcsr compatible. Signed-off-by: Rohit Agarwal Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/1678277993-18836-2-git-send-email-quic_rohiagar@quicinc.com commit c5a4b6fd31e8cbc749f7ac9ff6c3a6118f3e5011 Author: Ye Xiang Date: Sat Feb 25 22:01:15 2023 +0800 gpio: Add support for Intel LJCA USB GPIO driver This patch implements the GPIO function of Intel USB-I2C/GPIO/SPI adapter device named "La Jolla Cove Adapter" (LJCA). It communicate with LJCA GPIO module with specific protocol through interfaces exported by LJCA USB driver. Signed-off-by: Ye Xiang Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230225140118.2037220-3-xiang.ye@intel.com commit b8fd17d9505e18001d10ceaa350c118a82b467bb Author: Jakob Hauser Date: Tue Feb 28 23:32:20 2023 +0100 mfd: rt5033: Fix comments and style in includes Fix comments and remove some empty lines in rt5033-private.h. Align struct rt5033_charger in rt5033.h. Signed-off-by: Jakob Hauser Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/606950da6f4b36f5a124ff13756c78644fc89804.1677620677.git.jahau@rocketmail.com commit 21a8d573d967214e66abe2a1d69152d59e2a3521 Author: Mukesh Ojha Date: Thu Feb 2 16:41:24 2023 +0530 dt-bindings: mfd: qcom,tcsr: Add compatible for sm8450 Document the qcom,sm8450-tcsr compatible. Signed-off-by: Mukesh Ojha Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/1675336284-548-1-git-send-email-quic_mojha@quicinc.com commit f376c479668557bcc2fd9e9fbc0f53e7819a11cd Author: Matthias Schiffer Date: Mon Feb 20 12:25:46 2023 +0100 mfd: tqmx86: Correct board names for TQMxE39x It seems that this driver was developed based on preliminary documentation. Report the correct names for all TQMxE39x variants, as they are used by the released hardware revisions: - Fix names for TQMxE39C1/C2 board IDs - Distinguish TQMxE39M and TQMxE39S, which use the same board ID The TQMxE39M/S are distinguished using the SAUC (Sanctioned Alternate Uses Configuration) register of the GPIO controller. This also prepares for the correct handling of the differences between the GPIO controllers of our COMe and SMARC modules. Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") Signed-off-by: Matthias Schiffer Reviewed-by: Andrew Lunn Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/aca9a7cb42a85181bcb456c437554d2728e708ec.1676892223.git.matthias.schiffer@ew.tq-group.com commit 051c69ff4f607aa114c7bbdd7c41ed881367aeee Author: Matthias Schiffer Date: Mon Feb 20 12:25:45 2023 +0100 mfd: tqmx86: Specify IO port register range more precisely Registers 0x160..0x17f are unassigned. Use 0x180 as base register and update offets accordingly. Also change the size of the range to include 0x19f. While 0x19f is currently reserved for future extensions, so are several of the previous registers up to 0x19e, and it is weird to leave out just the last one. Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") Signed-off-by: Matthias Schiffer Reviewed-by: Andrew Lunn Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/db4677ac318b1283c8956f637f409995a30a31c3.1676892223.git.matthias.schiffer@ew.tq-group.com commit 1be1b23696b3d4b0231c694f5e0767b4471d33a9 Author: Matthias Schiffer Date: Mon Feb 20 12:25:44 2023 +0100 mfd: tqmx86: Do not access I2C_DETECT register through io_base The I2C_DETECT register is at IO port 0x1a7, which is outside the range passed to devm_ioport_map() for io_base, and was only working because there aren't actually any bounds checks for IO port accesses. Extending the range does not seem like a good solution here, as it would then conflict with the IO resource assigned to the I2C controller. As this is just a one-off access during probe, use a simple inb() instead. While we're at it, drop the unused define TQMX86_REG_I2C_INT_EN. Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") Signed-off-by: Matthias Schiffer Reviewed-by: Andrew Lunn Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/e8300a30f0791afb67d79db8089fb6004855f378.1676892223.git.matthias.schiffer@ew.tq-group.com commit 4d820dda94162968ea743675d9338ff5df6f62d0 Author: Emil Renner Berthing Date: Sat Feb 11 05:18:15 2023 +0200 dt-bindings: mfd: syscon: Add StarFive JH7100 sysmain compatible Document StarFive JH7100 SoC compatible for sysmain registers. Signed-off-by: Emil Renner Berthing Signed-off-by: Cristian Ciocaltea Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230211031821.976408-7-cristian.ciocaltea@collabora.com commit cf973869b9c46a9c817831bc31d89a2c38b65ba0 Author: Nick Alcock Date: Fri Feb 24 15:07:48 2023 +0000 mfd: intel_soc_pmic_crc: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Suggested-by: Luis Chamberlain Signed-off-by: Nick Alcock Reviewed-by: Andy Shevchenko Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230224150811.80316-5-nick.alcock@oracle.com commit 679532c2f6df69ad65b8717c71b06e957d2f60e6 Author: Nick Alcock Date: Fri Feb 24 15:08:05 2023 +0000 mfd: bcm2835-pm: Remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Suggested-by: Luis Chamberlain Signed-off-by: Nick Alcock Reviewed-by: Florian Fainelli Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230224150811.80316-22-nick.alcock@oracle.com commit c8bce48225eff37d87d1eab12c907c813befa8e9 Author: Aidan MacDonald Date: Thu Feb 16 22:22:14 2023 +0000 mfd: qcom-pm8008: Remove workaround for a regmap-irq quirk Remove pm8008_init(), which according to the comments exists only as a workaround for regmap-irq's odd treatment of type registers. This workaround shouldn't be needed anymore because this driver uses config registers, which are always programmed by regmap-irq no matter what the initial register state is. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230216222214.138671-5-aidanmacdonald.0x0@gmail.com commit ba97b5a505627fc2fb9c85f06afaef918e19032e Author: Aidan MacDonald Date: Thu Feb 16 22:22:13 2023 +0000 mfd: qcom-pm8008: Use .get_irq_reg() for irq chip Replace the deprecated not_fixed_stride flag and the associated hierarchy of offsets with a .get_irq_reg() callback. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230216222214.138671-4-aidanmacdonald.0x0@gmail.com commit fd0a2afa5ab2fb3ba5646e3bf907f2c4a8b4a291 Author: Aidan MacDonald Date: Thu Feb 16 22:22:12 2023 +0000 mfd: qcom-pm8008: Convert irq chip to config regs Replace type and virtual registers, which are both deprecated, with config registers. This also simplifies the driver because IRQ types are set in one place, the set_type_config() callback. Signed-off-by: Aidan MacDonald [Lee: Squashed in fix-up patch from Stephen Rothwell adapting to new .set_type_config() API] Signed-off-by: Stephen Rothwell Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230216222214.138671-3-aidanmacdonald.0x0@gmail.com commit 172a293707a55ba62e55a386eb601c8ef4824c85 Author: Aidan MacDonald Date: Thu Feb 16 22:22:11 2023 +0000 mfd: qcom-pm8008: Fix swapped mask/unmask in irq chip The usual behavior of mask registers is writing a '1' bit to disable (mask) an interrupt; similarly, writing a '1' bit to an unmask register enables (unmasks) an interrupt. Due to a longstanding issue in regmap-irq, mask and unmask registers were inverted when both kinds of registers were present on the same chip, ie. regmap-irq actually wrote '1's to the mask register to enable an IRQ and '1's to the unmask register to disable an IRQ. This was fixed by commit e8ffb12e7f06 ("regmap-irq: Fix inverted handling of unmask registers") but the fix is opt-in via mask_unmask_non_inverted = true because it requires manual changes for each affected driver. The new behavior will become the default once all drivers have been updated. The PM8008 appears to rely on the inverted behavior. It has separate set & clear registers for a register called INT_EN, which presumably enables interrupts by writing '1's. Opt in to the new non-inverted behavior & swap mask_base/unmask_base. Signed-off-by: Aidan MacDonald Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230216222214.138671-2-aidanmacdonald.0x0@gmail.com commit c301311a523bcc48d6d626cbd4654463a105e089 Author: Poovendhan Selvaraj Date: Wed Feb 8 11:03:32 2023 +0530 dt-bindings: mfd: Add the tcsr compatible for IPQ9574 Add the tcsr compatible string for IPQ9574 SoC Signed-off-by: Poovendhan Selvaraj Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230208053332.16537-6-quic_poovendh@quicinc.com commit 86c6bb0edffa9fc02b4e3801b48c8e82114f1352 Author: Christophe JAILLET Date: Tue Feb 14 09:58:59 2023 +0100 mfd: core: Reorder fields in 'struct mfd_cell' to save some memory Group some variables based on their sizes to reduce hole and avoid padding. On x86_64, this shrinks the size from 144 to 128 bytes. As an example: $ size drivers/mfd/as3722.o (Before) text data bss dec hex filename 9441 680 16 10137 2799 drivers/mfd/as3722.o $ size drivers/mfd/as3722.o (After) text data bss dec hex filename 9345 680 16 10041 2739 drivers/mfd/as3722.o Signed-off-by: Christophe JAILLET Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/bb631974888dfe1af593b6280cf30fb913d2d1a4.1676365116.git.christophe.jaillet@wanadoo.fr commit b09ed62f2d985c8eb2d5d5b560bebac653fdba20 Author: Konrad Dybcio Date: Mon Feb 13 21:13:37 2023 +0100 dt-bindings: mfd: qcom,spmi-pmic: Allow RRADC as adc@ subnode This was omitted when adding the RRADC bindings. Fixes: 7ea58c951ab3 ("dt-bindings: iio: adc: document qcom-spmi-rradc") Signed-off-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230213201337.2089970-1-konrad.dybcio@linaro.org commit 2e9de58c65f76ac9617b0028254edaca01529208 Author: Ye Xingchen Date: Wed Feb 8 17:34:51 2023 +0800 mfd: qcom_rpm: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Reviewed-by: Konrad Dybcio Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202302081734511884545@zte.com.cn commit ccb92c4d1608eb07c0d6b677c3bc7745db7fa33d Author: Ye Xingchen Date: Wed Feb 8 17:31:59 2023 +0800 mfd: atmel-flexcom: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Reviewed-by: Claudiu Beznea Tested-by: Claudiu Beznea Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202302081731593374472@zte.com.cn commit 4723d2ef5329f28f569bf9e855bd5bd4b691aa37 Author: Ye Xingchen Date: Wed Feb 8 17:36:50 2023 +0800 mfd: sun4i-gpadc: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202302081736500534579@zte.com.cn commit 0479ed2cf70c69fa703a1e6cbb4d5c2e7e4442a2 Author: Ye Xingchen Date: Wed Feb 8 17:35:44 2023 +0800 mfd: ssbi: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202302081735440864562@zte.com.cn commit 4239bff3455dd28733d719b79400df1b65b4d9fa Author: Ye Xingchen Date: Wed Feb 8 17:33:54 2023 +0800 mfd: ipaq-micro: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202302081733542304522@zte.com.cn commit 74d3de876a3aa9c91ccf8e5559f41b30ed8a9cd1 Author: Ye Xingchen Date: Wed Feb 8 17:33:01 2023 +0800 mfd: hi6421-pmic: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202302081733017704501@zte.com.cn commit d16fc6858777f861717f7b2c0ef3676e419f52a0 Author: Jackie Liu Date: Mon Feb 6 11:22:31 2023 +0800 mfd: si476x-cmd: Fix several issues reported by codespell Fix some typo, find by 'codespell drivers/mfd/si476x-cmd.c' succsess -> success interace -> interface comand -> command failre -> failure Reported-by: k2ci Signed-off-by: Jackie Liu Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230206032231.3208296-1-liu.yun@linux.dev commit ded99b89d25fd73a1d7bd910378e0339fd9d4c4a Author: Hans de Goede Date: Wed Mar 1 10:54:02 2023 +0100 mfd: intel_soc_pmic_chtwc: Add Lenovo Yoga Book X90F to intel_cht_wc_models The Android Lenovo Yoga Book X90F / X90L uses the same charger / fuelgauge setup as the already supported Windows Lenovo Yoga Book X91F/L, add a DMI match for this to intel_cht_wc_models with driver_data set to INTEL_CHT_WC_LENOVO_YOGABOOK1. When the quirk for the X91F/L was initially added it was written to also apply to the X90F/L but this does not work because the Android version of the Yoga Book uses completely different DMI strings. Also adjust the X91F/L quirk to reflect that it only applies to the X91F/L models. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230301095402.28582-1-hdegoede@redhat.com commit a3165abaa9bda3e729b434a3e684fcfa205f252a Author: David Virag Date: Tue Jan 31 19:30:07 2023 +0100 rtc: s5m: Drop S5M8763 support The S5M8763 MFD has no device tree compatible, and since board file support for it was removed, there's no way to use this MFD. After removing the remaining code for it from the MFD driver, also remove support for it in the s5m RTC driver, and all remaining references to it. Signed-off-by: David Virag Acked-by: Alexandre Belloni Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230131183008.4451-3-virag.david003@gmail.com commit f736d2c0caa8348b0bcd897972e470f7a596caad Author: David Virag Date: Tue Jan 31 19:30:06 2023 +0100 mfd: sec: Remove PMICs without compatibles The S5M8751 and S5M8763 PMIC chips have no corresponding compatible values, so since board file support was removed for this driver, there is no way to specify these PMICs as present in boards anymore. Remove leftovers of these chips since it's dead code. Signed-off-by: David Virag Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230131183008.4451-2-virag.david003@gmail.com commit 9b78d919632b7149d311aaad5a977e4b48b10321 Author: Paolo Abeni Date: Wed Apr 26 10:15:31 2023 +0200 net: phy: hide the PHYLIB_LEDS knob commit 4bb7aac70b5d ("net: phy: fix circular LEDS_CLASS dependencies") solved a build failure, but introduces a new config knob with a default 'y' value: PHYLIB_LEDS. The latter is against the current new config policy. The exception was raised to allow the user to catch bad configurations without led support. Anyway the current definition of PHYLIB_LEDS does not fit the above goal: if LEDS_CLASS is disabled, the new config will be available only with PHYLIB disabled, too. Hide the mentioned config, to preserve the randconfig testing done so far, while respecting the mentioned policy. Suggested-by: Andrew Lunn Suggested-by: Arnd Bergmann Signed-off-by: Paolo Abeni Link: https://lore.kernel.org/r/d82489be8ed911c383c3447e9abf469995ccf39a.1682496488.git.pabeni@redhat.com Signed-off-by: Paolo Abeni commit 7e0664b660bc8f977d2948d8c8fbfc4809b3e6b4 Merge: f7abf14f0001a e2a1406c84c43 Author: Thomas Gleixner Date: Wed Apr 26 11:03:57 2023 +0200 Merge tag 'timers-v6.4-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clocksource and clockevent updates from Daniel Lezcano: - Fix error returned for shared timers on Exynos MCT timers (Krzysztof Kozlowski) - Code reorg by splitting the CPUXGPT timer code (AngeloGioacchino Del Regno) - Remove the unused mxc_timer_init() function on i.MX (Fabio Estevam) - Replace of_get_address() and of_translate_address() calls with single call to of_address_to_resource() on TI timer (Rob Herring) - Mark driver as non-removable and remove useless remove() callback on SH MTU2 and STM32 LP timers. Improve the error message in the remove callback of the TI DM timer (Uwe Kleine-König) - Convert to platform remove callback returning void on Tegra186, TI DM timers (Uwe Kleine-König) - Drop pointless of_match_ptr for ID table in the STM32 LP timer (Krzysztof Kozlowski) - Fix memory leak in davinci_timer_register when init fails on DaVinci (Qinrun Dai) - Fix finding alwon timer regression on Timer TI DM (Tony Lindgren) - Use of_property_read_bool() for boolean properties on TI timer (Rob Herring) - Drop superfluous rk3288 compatible and add rk3588 compatible DT bindings (Cristian Ciocaltea) Link: htttps://lore.kernel.org/lkml/d30fd923-e6e5-a1a6-ca76-1b39f8fad6c9@linaro.org commit 2afa82d1fc648c8d4c2ef9e876626abb1089f9ab Author: Krzysztof Kozlowski Date: Thu Apr 20 09:24:29 2023 +0200 dt-bindings: thermal: qcom-tsens: Correct unit address Match unit-address to first reg entry. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Acked-by: Amit Kucheria Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230420072429.36255-1-krzysztof.kozlowski@linaro.org commit f0fb67c27160eb1aed1524cf5bf7dbbc3174f1b9 Author: Rob Herring Date: Sun Mar 19 11:32:31 2023 -0500 thermal/drivers/mediatek: Use of_address_to_resource() Replace of_get_address() and of_translate_address() calls with single call to of_address_to_resource(). Signed-off-by: Rob Herring Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230319163231.226738-1-robh@kernel.org commit a3e9a9a5971164933e0d247125897c2e54587c6b Author: Kang Chen Date: Wed Apr 19 10:07:49 2023 +0800 thermal/drivers/mediatek: Change clk_prepare_enable to devm_clk_get_enabled in mtk_thermal_probe Use devm_clk_get_enabled to do automatic resource management. Meanwhile, remove error handling labels in the probe function and the whole remove function. Signed-off-by: Kang Chen Reviewed-by: Dongliang Mu Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230419020749.621257-2-void0red@hust.edu.cn commit f05c7b7d9ea9477fcc388476c6f4ade8c66d2d26 Author: Kang Chen Date: Wed Apr 19 10:07:48 2023 +0800 thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe Smatch reports: 1. mtk_thermal_probe() warn: 'apmixed_base' from of_iomap() not released. 2. mtk_thermal_probe() warn: 'auxadc_base' from of_iomap() not released. The original code forgets to release iomap resource when handling errors, fix it by switch to devm_of_iomap. Fixes: 89945047b166 ("thermal: mediatek: Add tsensor support for V2 thermal system") Signed-off-by: Kang Chen Reviewed-by: Dongliang Mu Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230419020749.621257-1-void0red@hust.edu.cn commit 47cbb0467b8b3c76faba3c2dd34b20070e6103ca Author: AngeloGioacchino Del Regno Date: Wed Apr 19 08:11:46 2023 +0200 thermal/drivers/mediatek: Add temperature constraints to validate read The AUXADC thermal v1 allows reading temperature range between -20°C to 150°C and any value out of this range is invalid. Add new definitions for MT8173_TEMP_{MIN_MAX} and a new small helper mtk_thermal_temp_is_valid() to check if new readings are in range: if not, we tell to the API that the reading is invalid by returning THERMAL_TEMP_INVALID. It was chosen to introduce the helper function because, even though this temperature range is realistically ok for all, it comes from a downstream kernel driver for version 1, but here we also support v2 and v3 which may may have wider constraints. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230419061146.22246-3-angelogioacchino.delregno@collabora.com commit 0a677eea71fd58aa3bc805edfdbe8b0f11815c7d Author: AngeloGioacchino Del Regno Date: Wed Apr 19 08:11:45 2023 +0200 Revert "thermal/drivers/mediatek: Add delay after thermal banks initialization" Some more testing revealed that this commit introduces a regression on some MT8173 Chromebooks and at least on one MT6795 Sony Xperia M5 smartphone due to the delay being apparently variable and machine specific. Another solution would be to delay for a bit more (~70ms) but this is not feasible for two reasons: first of all, we're adding an even bigger delay in a probe function; second, some machines need less, some may need even more, making the msleep at probe solution highly suboptimal. This reverts commit 10debf8c2da8011c8009dd4b3f6d0ab85891c81b. Fixes: 10debf8c2da8 ("thermal/drivers/mediatek: Add delay after thermal banks initialization") Reported-by: "kernelci.org bot" Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230419061146.22246-2-angelogioacchino.delregno@collabora.com commit 2912d341800bb9781c0a0ed2bedc10b2c1fd5909 Author: Chenggang Wang Date: Tue Apr 18 11:38:28 2023 +0800 thermal/drivers/cpuidle_cooling: Delete unmatched comments The function no longer returns a value, synchronize the comments. Signed-off-by: wangchenggang@vivo.com Acked-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1681789108-28130-1-git-send-email-wangchenggang@vivo.com commit d9f7eeaf24aedfdf47bddf0cf88e1021b7f652f5 Author: Marijn Suijten Date: Mon Apr 10 22:29:15 2023 +0200 dt-bindings: thermal: Use generic ADC node name in examples Update the examples to reflect a future requirement for the generic `channel` node name on ADC channel nodes, while conveying the board name of the channel in a label instead. Signed-off-by: Marijn Suijten Acked-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230410202917.247666-4-marijn.suijten@somainline.org commit a8a2330753bc280c87aa72d690b41b8515fda214 Author: Stefan Wahren Date: Mon Apr 10 22:58:00 2023 +0200 dt-bindings: imx-thermal: Add imx6sll and imx6ul compatible Currently the dtbs_check for imx6 generates warnings like this: ['fsl,imx6sll-tempmon', 'fsl,imx6sx-tempmon'] is too long So add them to the devicetree binding. Signed-off-by: Stefan Wahren Reviewed-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230410205803.45853-4-stefan.wahren@i2se.com commit c248b27cfc0a8a5fee93e000d47e659bca335d0f Merge: 28b17f6270f18 50749f2dd6854 Author: Paolo Abeni Date: Wed Apr 26 10:17:46 2023 +0200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net No conflicts. Signed-off-by: Paolo Abeni commit 4e8f6e44bce8da3b0e2df37b12839f4bc9c9cabe Author: Neeraj Upadhyay Date: Tue Apr 25 15:27:00 2023 +0530 arm64: Fix label placement in record_mmu_state() Fix label so that pre_disable_mmu_workaround() is called before clearing sctlr_el1.M. Fixes: 2ced0f30a426 ("arm64: head: Switch endianness before populating the ID map") Signed-off-by: Neeraj Upadhyay Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20230425095700.22005-1-quic_neeraju@quicinc.com Signed-off-by: Will Deacon commit 169f8997968ab620d750d9a45e15c5288d498356 Author: Nicholas Piggin Date: Wed Apr 26 15:58:39 2023 +1000 powerpc/64s: Disable pcrel code model on Clang Clang has a bug that casues the pcrel code model not to be used when any of -msoft-float, -mno-altivec, or -mno-vsx are set. Leaving these off causes FP/vector instructions to be generated, causing crashes. So disable pcrel for clang for now. Fixes: 7e3a68be42e10 ("powerpc/64: vmlinux support building with PCREL addresing") Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230426055848.402993-3-npiggin@gmail.com commit 0c993300d52bf5ce9b951c3b6b25d0d14acc49a9 Author: Nicholas Piggin Date: Wed Apr 26 15:58:38 2023 +1000 powerpc: Fix merge conflict between pcrel and copy_thread changes Fix a conflict between commit 4e991e3c16a35 ("powerpc: add CFUNC assembly label annotation") and commit b504b6aade040 ("powerpc: differentiate kthread from user kernel thread start"). Fixes: 4e991e3c16a35 ("powerpc: add CFUNC assembly label annotation") Fixes: b504b6aade040 ("powerpc: differentiate kthread from user kernel thread start") Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230426055848.402993-2-npiggin@gmail.com commit bb3f89487fd936df7cc5165bae37ca2669056c5c Author: Evan Green Date: Thu Apr 20 12:49:34 2023 -0700 RISC-V: hwprobe: Remove __init on probe_vendor_features() probe_vendor_features() is now called from smp_callin(), which is not __init code and runs during cpu hotplug events. Remove the __init_or_module decoration from it and the functions it calls to avoid walking into outer space. Fixes: 62a31d6e38bd ("RISC-V: hwprobe: Support probing of misaligned access performance") Signed-off-by: Evan Green Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230420194934.1871356-1-evan@rivosinc.com Signed-off-by: Palmer Dabbelt commit 3b5a5672b34bdac2aa63985cd1226c569e36e7a7 Merge: 457391b038033 48ce2d722f7f1 Author: Huacai Chen Date: Wed Apr 26 11:56:37 2023 +0800 Merge 'irq/loongarch-fixes-6.4' into loongarch-next LoongArch architecture changes for 6.4 depend on the irq changes to work on "dual-bridge" systems, so merge them to create a base. commit 0cfd8703e7da687924371e9bc77a025bdeba9637 Merge: 793582ff47f8b d3f2c402e4488 Author: Linus Torvalds Date: Tue Apr 25 18:44:10 2023 -0700 Merge tag 'pm-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These update several cpufreq drivers and the cpufreq core, add sysfs interface for exposing the time really spent in the platform low-power state during suspend-to-idle, update devfreq (core and drivers) and the pm-graph suite of tools and clean up code. Specifics: - Fix the frequency unit in cpufreq_verify_current_freq checks() Sanjay Chandrashekara) - Make mode_state_machine in amd-pstate static (Tom Rix) - Make the cpufreq core require drivers with target_index() to set freq_table (Viresh Kumar) - Fix typo in the ARM_BRCMSTB_AVS_CPUFREQ Kconfig entry (Jingyu Wang) - Use of_property_read_bool() for boolean properties in the pmac32 cpufreq driver (Rob Herring) - Make the cpufreq sysfs interface return proper error codes on obviously invalid input (qinyu) - Add guided autonomous mode support to the AMD P-state driver (Wyes Karny) - Make the Intel P-state driver enable HWP IO boost on all server platforms (Srinivas Pandruvada) - Add opp and bandwidth support to tegra194 cpufreq driver (Sumit Gupta) - Use of_property_present() for testing DT property presence (Rob Herring) - Remove MODULE_LICENSE in non-modules (Nick Alcock) - Add SM7225 to cpufreq-dt-platdev blocklist (Luca Weiss) - Optimizations and fixes for qcom-cpufreq-hw driver (Krzysztof Kozlowski, Konrad Dybcio, and Bjorn Andersson) - DT binding updates for qcom-cpufreq-hw driver (Konrad Dybcio and Bartosz Golaszewski) - Updates and fixes for mediatek driver (Jia-Wei Chang and AngeloGioacchino Del Regno) - Use of_property_present() for testing DT property presence in the cpuidle code (Rob Herring) - Drop unnecessary (void *) conversions from the PM core (Li zeming) - Add sysfs files to represent time spent in a platform sleep state during suspend-to-idle and make AMD and Intel PMC drivers use them Mario Limonciello) - Use of_property_present() for testing DT property presence (Rob Herring) - Add set_required_opps() callback to the 'struct opp_table', to make the code paths cleaner (Viresh Kumar) - Update the pm-graph siute of utilities to v5.11 with the following changes: * New script which allows users to install the latest pm-graph from the upstream github repo. * Update all the dmesg suspend/resume PM print formats to be able to process recent timelines using dmesg only. * Add ethtool output to the log for the system's ethernet device if ethtool exists. * Make the tool more robustly handle events where mangled dmesg or ftrace outputs do not include all the requisite data. - Make the sleepgraph utility recognize "CPU killed" messages (Xueqin Luo) - Remove unneeded SRCU selection in Kconfig because it's always set from devfreq core (Paul E. McKenney) - Drop of_match_ptr() macro from exynos-bus.c because this driver is always using the DT table for driver probe (Krzysztof Kozlowski) - Use the preferred of_property_present() instead of the low-level of_get_property() on exynos-bus.c (Rob Herring) - Use devm_platform_get_and_ioream_resource() in exyno-ppmu.c (Yang Li)" * tag 'pm-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (44 commits) platform/x86/intel/pmc: core: Report duration of time in HW sleep state platform/x86/intel/pmc: core: Always capture counters on suspend platform/x86/amd: pmc: Report duration of time in hw sleep state PM: Add sysfs files to represent time spent in hardware sleep state cpufreq: use correct unit when verify cur freq cpufreq: tegra194: add OPP support and set bandwidth cpufreq: amd-pstate: Make varaiable mode_state_machine static PM: core: Remove unnecessary (void *) conversions cpufreq: drivers with target_index() must set freq_table PM / devfreq: exynos-ppmu: Use devm_platform_get_and_ioremap_resource() OPP: Move required opps configuration to specialized callback OPP: Handle all genpd cases together in _set_required_opps() cpufreq: qcom-cpufreq-hw: Revert adding cpufreq qos dt-bindings: cpufreq: cpufreq-qcom-hw: Add QCM2290 dt-bindings: cpufreq: cpufreq-qcom-hw: Sanitize data per compatible dt-bindings: cpufreq: cpufreq-qcom-hw: Allow just 1 frequency domain cpufreq: Add SM7225 to cpufreq-dt-platdev blocklist cpufreq: qcom-cpufreq-hw: fix double IO unmap and resource release on exit cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623 cpufreq: mediatek: raise proc/sram max voltage for MT8516 ... commit 793582ff47f8b73be8d3d925d750bf3ef79f33c7 Merge: 5e0ca0bfc33b7 4f810294e00bd Author: Linus Torvalds Date: Tue Apr 25 18:37:41 2023 -0700 Merge tag 'acpi-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These update the ACPICA code in the kernel to upstream revision 20230331, fix the ACPI SBS driver and the evaluation of the _PDC method on Xen dom0 in the ACPI processor driver, update the ACPI driver for Intel SoCs and clean up code in multiple places. Specifics: - Update the ACPICA code in the kernel to upstream revision 20230331 including the following changes: * Delete bogus node_array array of pointers from AEST table (Jessica Clarke) * Add support for trace buffer extension in GICC to the ACPI MADT parser (Xiongfeng Wang) * Add missing macro ACPI_FUNCTION_TRACE() for acpi_ns_repair_HID() (Xiongfeng Wang) * Add missing tables to astable (Pedro Falcato) * Add support for 64 bit loong_arch compilation to ACPICA (Huacai Chen) * Add support for ASPT table in disassembler to ACPICA (Jeremi Piotrowski) * Add support for Arm's MPAM ACPI table version 2 (Hesham Almatary) * Update all copyrights/signons in ACPICA to 2023 (Bob Moore) * Add support for ClockInput resource (v6.5) (Niyas Sait) * Add RISC-V INTC interrupt controller definition to the list of supported interrupt controllers for MADT (Sunil V L) * Add structure definitions for the RISC-V RHCT ACPI table (Sunil V L) * Address several cases in which the ACPICA code might lead to undefined behavior (Tamir Duberstein) * Make ACPICA code support flexible arrays properly (Kees Cook) * Check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects() (void0red) * Add os specific support for Zephyr RTOS to ACPICA (Najumon) * Update version to 20230331 (Bob Moore) - Fix evaluating the _PDC ACPI control method when running as Xen dom0 (Roger Pau Monne) - Use platform devices to load ACPI PPC and PCC drivers (Petr Pavlu) - Check for null return of devm_kzalloc() in fch_misc_setup() (Kang Chen) - Log a message if enable_irq_wake() fails for the ACPI SCI (Simon Gaiser) - Initialize the correct IOMMU fwspec while parsing ACPI VIOT (Jean-Philippe Brucker) - Amend indentation and prefix error messages with FW_BUG in the ACPI SPCR parsing code (Andy Shevchenko) - Enable ACPI sysfs support for CCEL records (Kuppuswamy Sathyanarayanan) - Make the APEI error injection code warn on invalid arguments when explicitly indicated by platform (Shuai Xue) - Add CXL error types to the error injection code in APEI (Tony Luck) - Refactor acpi_data_prop_read_single() (Andy Shevchenko) - Fix two issues in the ACPI SBS driver (Armin Wolf) - Replace ternary operator with min_t() in the generic ACPI thermal zone driver (Jiangshan Yi) - Ensure that ACPI notify handlers are not running after removal and clean up code in acpi_sb_notify() (Rafael Wysocki) - Remove register_backlight_delay module option and code and remove quirks for false-positive backlight control support advertised on desktop boards (Hans de Goede) - Replace irqdomain.h include with struct declarations in ACPI headers and update several pieces of code previously including of.h implicitly through those headers (Rob Herring) - Fix acpi_evaluate_dsm_typed() redefinition error (Kiran K) - Update the pm_profile sysfs attribute documentation (Rafael Wysocki) - Add 80862289 ACPI _HID for second PWM controller on Cherry Trail to the ACPI driver for Intel SoCs (Hans de Goede)" * tag 'acpi-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (64 commits) ACPI: LPSS: Add 80862289 ACPI _HID for second PWM controller on Cherry Trail ACPI: bus: Ensure that notify handlers are not running after removal ACPI: bus: Add missing braces to acpi_sb_notify() ACPI: video: Remove desktops without backlight DMI quirks ACPI: video: Remove register_backlight_delay module option and code ACPI: Replace irqdomain.h include with struct declarations fpga: lattice-sysconfig-spi: Add explicit include for of.h tpm: atmel: Add explicit include for of.h virtio-mmio: Add explicit include for of.h pata: ixp4xx: Add explicit include for of.h ata: pata_macio: Add explicit include of irqdomain.h serial: 8250_tegra: Add explicit include for of.h net: rfkill-gpio: Add explicit include for of.h staging: iio: resolver: ad2s1210: Add explicit include for of.h iio: adc: ad7292: Add explicit include for of.h ACPICA: Update version to 20230331 ACPICA: add os specific support for Zephyr RTOS ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects ACPICA: acpi_resource_irq: Replace 1-element arrays with flexible array ACPICA: acpi_madt_oem_data: Fix flexible array member definition ... commit 5e0ca0bfc33b7196ae3a5cbe26289a4025618f5a Merge: 4173cf6fb6b7d 5bc6b1df65c87 Author: Linus Torvalds Date: Tue Apr 25 18:32:43 2023 -0700 Merge tag 'thermal-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These mostly continue to prepare the thermal control subsystem for using unified representation of trip points, which includes cleanups, code refactoring and similar and update several drivers (for other reasons), which includes new hardware support. Specifics: - Add a thermal zone 'devdata' accessor and modify several drivers to use it (Daniel Lezcano) - Prevent drivers from using the 'device' internal thermal zone structure field directly (Daniel Lezcano) - Clean up the hwmon thermal driver (Daniel Lezcano) - Add thermal zone id accessor and thermal zone type accessor and prevent drivers from using thermal zone fields directly (Daniel Lezcano) - Clean up the acerhdf and tegra thermal drivers (Daniel Lezcano) - Add lower bound check for sysfs input to the x86_pkg_temp_thermal Intel thermal driver (Zhang Rui) - Add more thermal zone device encapsulation: prevent setting structure field directly, access the sensor device instead the thermal zone's device for trace, relocate the traces in drivers/thermal (Daniel Lezcano) - Use the generic trip point for the i.MX and remove the get_trip_temp ops (Daniel Lezcano) - Use the devm_platform_ioremap_resource() in the Hisilicon driver (Yang Li) - Remove R-Car H3 ES1.* handling as public has only access to the ES2 version and the upstream support for the ES1 has been shutdown (Wolfram Sang) - Add a delay after initializing the bank in order to let the time to the hardware to initialze itself before reading the temperature (Amjad Ouled-Ameur) - Add MT8365 support (Amjad Ouled-Ameur) - Preparational cleanup and DT bindings for RK3588 support (Sebastian Reichel) - Add driver support for RK3588 (Finley Xiao) - Use devm_reset_control_array_get_exclusive() for the Rockchip driver (Ye Xingchen) - Detect power gated thermal zones and return -EAGAIN when reading the temperature (Mikko Perttunen) - Remove thermal_bind_params structure as it is unused (Zhang Rui) - Drop unneeded quotes in DT bindings allowing to run yamllint (Rob Herring) - Update the power allocator documentation according to the thermal trace relocation (Lukas Bulwahn) - Fix sensor 1 interrupt status bitmask for the Mediatek LVTS sensor (Chen-Yu Tsai) - Use the dev_err_probe() helper in the Amlogic driver (Ye Xingchen) - Add AP domain support to LVTS thermal controllers for mt8195 (Balsam CHIHI) - Remove buggy call to thermal_of_zone_unregister() (Daniel Lezcano) - Make thermal_of_zone_[un]register() private to the thermal OF code (Daniel Lezcano) - Create a private copy of the thermal zone device parameters structure when registering a thermal zone (Daniel Lezcano) - Fix a kernel NULL pointer dereference in thermal_hwmon (Zhang Rui) - Revert recent message adjustment in thermal_hwmon (Rafael Wysocki) - Use of_property_present() for testing DT property presence in thermal control code (Rob Herring) - Clean up thermal_list_lock locking in the thermal core (Rafael Wysocki) - Add DLVR support for RFIM control in the int340x Intel thermal driver (Srinivas Pandruvada)" * tag 'thermal-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (55 commits) thermal: intel: int340x: Add DLVR support for RFIM control thermal/core: Alloc-copy-free the thermal zone parameters structure thermal/of: Unexport unused OF functions thermal/drivers/bcm2835: Remove buggy call to thermal_of_zone_unregister thermal/drivers/mediatek/lvts_thermal: Add AP domain for mt8195 dt-bindings: thermal: mediatek: Add AP domain to LVTS thermal controllers for mt8195 thermal: amlogic: Use dev_err_probe() thermal/drivers/mediatek/lvts_thermal: Fix sensor 1 interrupt status bitmask MAINTAINERS: adjust entry in THERMAL/POWER_ALLOCATOR after header movement dt-bindings: thermal: Drop unneeded quotes thermal/core: Remove thermal_bind_params structure thermal/drivers/tegra-bpmp: Handle offline zones thermal/drivers/rockchip: use devm_reset_control_array_get_exclusive() dt-bindings: rockchip-thermal: Support the RK3588 SoC compatible thermal/drivers/rockchip: Support RK3588 SoC in the thermal driver thermal/drivers/rockchip: Support dynamic sized sensor array thermal/drivers/rockchip: Simplify channel id logic thermal/drivers/rockchip: Use dev_err_probe thermal/drivers/rockchip: Simplify clock logic thermal/drivers/rockchip: Simplify getting match data ... commit fa359d068574d29e7d2f0fdd0ebe4c6a12b5cfb9 Author: Hao Zeng Date: Wed Apr 26 09:05:27 2023 +0800 recordmcount: Fix memory leaks in the uwrite function Common realloc mistake: 'file_append' nulled but not freed upon failure Link: https://lkml.kernel.org/r/20230426010527.703093-1-zenghao@kylinos.cn Signed-off-by: Hao Zeng Suggested-by: Steven Rostedt Signed-off-by: Steven Rostedt (Google) commit 41d8fba193b36ac1208d8f8489390b93675fab7b Author: Beau Belgrave Date: Tue Apr 25 15:51:07 2023 -0700 tracing/user_events: Limit max fault-in attempts When event enablement changes, user_events attempts to update a bit in the user process. If a fault is hit, an attempt to fault-in the page and the write is retried if the page made it in. While this normally requires a couple attempts, it is possible a bad user process could attempt to cause infinite loops. Ensure fault-in attempts either sync or async are limited to a max of 10 attempts for each update. When the max is hit, return -EFAULT so another attempt is not made in all cases. Link: https://lkml.kernel.org/r/20230425225107.8525-5-beaub@linux.microsoft.com Suggested-by: Steven Rostedt (Google) Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 97bbce89bfdec9219dfcb60cd62b815a97cb29cb Author: Beau Belgrave Date: Tue Apr 25 15:51:06 2023 -0700 tracing/user_events: Prevent same address and bit per process User processes register an address and bit pair for events. If the same address and bit pair are registered multiple times in the same process, it can cause undefined behavior when events are enabled/disabled. When more than one are used, the bit could be turned off by another event being disabled, while the original event is still enabled. Prevent undefined behavior by checking the current mm to see if any event has already been registered for the address and bit pair. Return EADDRINUSE back to the user process if it's already being used. Update ftrace self-test to ensure this occurs properly. Link: https://lkml.kernel.org/r/20230425225107.8525-4-beaub@linux.microsoft.com Suggested-by: Doug Cook Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 17b439db21d5dbe70c419e982262621e5e6aba7f Author: Beau Belgrave Date: Tue Apr 25 15:51:05 2023 -0700 tracing/user_events: Ensure bit is cleared on unregister If an event is enabled and a user process unregisters user_events, the bit is left set. Fix this by always clearing the bit in the user process if unregister is successful. Update abi self-test to ensure this occurs properly. Link: https://lkml.kernel.org/r/20230425225107.8525-3-beaub@linux.microsoft.com Suggested-by: Doug Cook Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit cd98c93286a30cc4588dfd02453bec63c2f4acf4 Author: Beau Belgrave Date: Tue Apr 25 15:51:04 2023 -0700 tracing/user_events: Ensure write index cannot be negative The write index indicates which event the data is for and accesses a per-file array. The index is passed by user processes during write() calls as the first 4 bytes. Ensure that it cannot be negative by returning -EINVAL to prevent out of bounds accesses. Update ftrace self-test to ensure this occurs properly. Link: https://lkml.kernel.org/r/20230425225107.8525-2-beaub@linux.microsoft.com Fixes: 7f5a08c79df3 ("user_events: Add minimal support for trace_event into ftrace") Reported-by: Doug Cook Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 96928d9032a7c34f12a88df879665562bcebf59a Author: Sergey Senozhatsky Date: Sat Apr 15 19:01:10 2023 +0900 seq_buf: Add seq_buf_do_printk() helper Sometimes we use seq_buf to format a string buffer, which we then pass to printk(). However, in certain situations the seq_buf string buffer can get too big, exceeding the PRINTKRB_RECORD_MAX bytes limit, and causing printk() to truncate the string. Add a new seq_buf helper. This helper prints the seq_buf string buffer line by line, using \n as a delimiter, rather than passing the whole string buffer to printk() at once. Link: https://lkml.kernel.org/r/20230415100110.1419872-1-senozhatsky@chromium.org Cc: Andrew Morton Signed-off-by: Sergey Senozhatsky Reviewed-by: Petr Mladek Tested-by: Yosry Ahmed Signed-off-by: Steven Rostedt (Google) commit 4173cf6fb6b7d1b4569cca08af318c4561356fb5 Merge: 3361e9a4ea957 1c19ac768b8ee Author: Linus Torvalds Date: Tue Apr 25 17:43:44 2023 -0700 Merge tag 'hwmon-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers - Driver for Acbel FSB032 power supply - Driver for StarFive JH71x0 temperature sensor Added support to existing drivers: - aquacomputer_d5next: Support for Aquacomputer Aquastream XT - nct6775: Added various ASUS boards to list of boards supporting WMI - asus-ec-sensors: ROG STRIX Z390-F GAMING, ProArt B550-Creator, Notable improvements: - Regulator event and sysfs notification support for PMBus drivers Notable cleanup: - Constified pointers to hwmon_channel_info .. and various other minor bug fixes and improvements" * tag 'hwmon-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (131 commits) hwmon: lochnagar: Remove the unneeded include hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E hwmon: (adt7475) Use device_property APIs when configuring polarity hwmon: (aquacomputer_d5next) Add support for Aquacomputer Aquastream XT hwmon: (it87) Disable/enable SMBus access for IT8622E chipset hwmon: (it87) Add calls to smbus_enable/smbus_disable as required hwmon: (it87) Test for error in it87_update_device hwmon: (it87) Disable SMBus access for environmental controller registers. docs: hwmon: Add documentaion for acbel-fsg032 PSU hwmon: (pmbus/acbel-fsg032) Add Acbel power supply dt-bindings: trivial-devices: Add acbel,fsg032 dt-bindings: vendor-prefixes: Add prefix for acbel hwmon: (sfctemp) Simplify error message hwmon: (pmbus/ibm-cffps) Use default debugfs attributes and lock function hwmon: (pmbus/core) Add lock and unlock functions hwmon: (pmbus/core) Request threaded interrupt with IRQF_ONESHOT hwmon: (nct6775) update ASUS WMI monitoring list A620/B760/W790 hwmon: ina2xx: add optional regulator support dt-bindings: hwmon: ina2xx: add supply property dt-bindings: hwmon: pwm-fan: Convert to DT schema ... commit 3361e9a4ea957b09c5d6242613360c415194dbb5 Merge: fe89e9b1af147 1f6fa392a9942 Author: Linus Torvalds Date: Tue Apr 25 17:38:25 2023 -0700 Merge tag 'rproc-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Unnecessary type casts from the 'void *' rproc->priv pointer are dropped throughout the subsystem. - A kernel-doc error is corrected in the Mediatek SCPI IPI implementation - The firmware loading onto the IMX DSP remote processors is reworked to avoid non-32bit memory operations. A module parameter is introduced to assist development of firmware without communication abilities in place. Error paths in imx_dsp_rproc_mbox_alloc() is cleaned up - The cluster configuration handling in the TI K3 R5 driver is corrected and support for the single-R5 core found in the TI AM62x SoC family is introduced - The TI PRU driver device- to virtual-address translation is updated to avoid compiler warning about the unsigned device-address always being larger than 0 - The ST remoteproc driver is transitioned to use of_property_present() - Issues with kicks arriving after the STM32 remote processor has been shut down are mitigated by checking the processor's state before handling them. - Support for mailbox channels for communication with the remote processors are added to the Xilinx R5 remoteproc driver. The naming of carveouts are corrected and their parsing is reworked. For this a couple of fixes targeting the mailbox subsystem are picked up here as well. - Reference counting of of_nodes are corrected in the ST, STM32, RCAR and IMX remoteproc drivers * tag 'rproc-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (24 commits) remoteproc: st: Use of_property_present() for testing DT property presence dt-bindings: remoteproc: Drop unneeded quotes remoteproc: imx_dsp_rproc: Fix kernel test robot sparse warning remoteproc: imx_dsp_rproc: Improve exception handling in imx_dsp_rproc_mbox_alloc() remoteproc: pru: Remove always true check positive unsigned value dt-bindings: remoteproc: stm32-rproc: Typo fix remoteproc: stm32_rproc: Add mutex protection for workqueue remoteproc: Remove unnecessary (void*) conversions remoteproc: imx_dsp_rproc: Call of_node_put() on iteration error remoteproc: imx_rproc: Call of_node_put() on iteration error remoteproc: rcar_rproc: Call of_node_put() on iteration error remoteproc: st: Call of_node_put() on iteration error remoteproc: stm32: Call of_node_put() on iteration error remoteproc: k3-r5: Use separate compatible string for TI AM62x SoC family dt-bindings: remoteproc: ti: Add new compatible for AM62 SoC family remoteproc: k3-r5: Simplify cluster mode setting usage remoteproc/mtk_scpi_ipi: Fix one kernel-doc comment remoteproc: xilinx: Add mailbox channels for rpmsg drivers: remoteproc: xilinx: Fix carveout names mailbox: zynqmp: Fix typo in IPI documentation ... commit fe89e9b1af14794a4df9d45b958ff1adf0b98dc1 Merge: c5c06e2780198 ba7a4754da109 Author: Linus Torvalds Date: Tue Apr 25 17:33:55 2023 -0700 Merge tag 'rpmsg-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: "The remove functions of the Qualcomm SMD and GLINK RPM platform drivers are transitioned to the new void returning prototype. Likewise is qcom_smd_unregister_edge() transitioned to void, as it unconditionally returned 0. An assumption about the ordering of the intent request acknowledgement and advertisement of a new intent in the GLINK implementation is corrected. Faulty error handling is corrected is improved in the TX path, and duplicated code, in the same path, is cleaned up" * tag 'rpmsg-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: glink: Consolidate TX_DATA and TX_DATA_CONT rpmsg: glink: Propagate TX failures in intentless mode as well rpmsg: glink: Wait for intent, not just request ack rpmsg: glink: Transition intent request signaling to wait queue rpmsg: qcom_smd: Convert to platform remove callback returning void rpmsg: qcom_glink_rpm: Convert to platform remove callback returning void rpmsg: qcom_smd: Make qcom_smd_unregister_edge() return void commit c5c06e278019892391ef4d47933796cacfec29cb Merge: eb8322d714ea9 22a4455e75be4 Author: Linus Torvalds Date: Tue Apr 25 17:29:46 2023 -0700 Merge tag 'mmc-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Allow an invalid regulator in mmc_regulator_set_ocr() - Log about empty non-removable slots - Add helpers to enable/disable the vqmmc regulator MMC host: - mtk-sd: Add support for the mt8365 variant - renesas_sdhi: Remove support for R-Car H3 ES1.* variants - sdhci_am654: Add power management support - sdhci-cadence: Add support for eMMC hardware reset - sdhci-cadence: Add support for AMD Pensando Elba variant - sdhci-msm: Add support for the IPQ5018 variant - sdhci-msm: Add support for the QCM2290 variant - sdhci-of-arasan: Skip setting clock delay for 400KHz - sdhci-of-arasan: Add support for the Xilinx Versal Net variant - sdhci-of-arasan: Remove Intel Thunder Bay SOC support - sdhci-of-arasan: Add support to request the "gate" clock - sdhci-of-dwcmshc: Properly determine max clock on Rockchip - sdhci-of-esdhc: Fix quirk to ignore command inhibit for data - sdhci-pci-o2micro: Fix SDR50 mode timing issue MEMSTICK: - r592: Fix use-after-free bug in r592_remove due to race condition" * tag 'mmc-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (40 commits) dt-bindings: mmc: sdhci-msm: Document the IPQ5018 compatible mmc: vub300: remove unreachable code mmc: sdhci-cadence: Support mmc hardware reset mmc: sdhci-cadence: Add AMD Pensando Elba SoC support mmc: sdhci-cadence: Support device specific init during probe mmc: sdhci-cadence: Enable device specific override of writel() dt-bindings: mmc: cdns: Add AMD Pensando Elba SoC mmc: core: Remove unused macro mmc_req_rel_wr mmc: sdhci-of-arasan: Skip setting clock delay for 400KHz mmc: sdhci-of-arasan: Add support for eMMC5.1 on Xilinx Versal Net platform dt-bindings: mmc: arasan,sdci: Add Xilinx Versal Net compatible mmc: sdhci_am654: Add support for PM suspend/resume mmc: core: remove unnecessary (void*) conversions dt-bindings: mmc: fsl-imx-esdhc: ref sdhci-common.yaml mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data mmc: core: Log about empty non-removable slots dt-bindings: mmc: fujitsu: Add Socionext Synquacer mmc: sdricoh_cs: remove unused sdricoh_readw function dt-bindings: mmc: Remove bindings for Intel Thunder Bay SoC" mmc: sdhci-of-arasan: Remove Intel Thunder Bay SOC support ... commit eb8322d714ea98fdc620d682fb517b50ea282aa5 Merge: 2c96606a0f8b7 7227aacb62aeb Author: Linus Torvalds Date: Tue Apr 25 17:23:42 2023 -0700 Merge tag 'mtd/for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd updates from Miquel Raynal: "Core MTD changes: - dt-bindings: Drop unneeded quotes - mtdblock: Tolerate corrected bit-flips - Use of_property_read_bool() for boolean properties - Avoid magic values - Avoid printing error messages on probe deferrals - Prepare mtd_otp_nvmem_add() to handle -EPROBE_DEFER - Fix error path for nvmem provider - Fix nvmem error reporting - Provide unique name for nvmem device MTD device changes: - lpddr_cmds: Remove unused words variable - bcm63xxpart: Remove MODULE_LICENSE in non-modules SPI NOR core changes: - Introduce Read While Write support for flashes featuring several banks - Set the 4-Byte Address Mode method based on SFDP data - Allow post_sfdp hook to return errors - Parse SCCR MC table and introduce support for multi-chip devices SPI NOR manufacturer drivers changes: - macronix: Add support for mx25uw51245g with RWW - spansion: - Determine current address mode at runtime as it can be changed in a non-volatile way and differ from factory defaults or from what SFDP advertises. - Enable JFFS2 write buffer mode for few ECC'd NOR flashes: S25FS256T, s25hx and s28hx - Add support for s25hl02gt and s25hs02gt Raw NAND core changes: - Convert to platform remove callback returning void - Fix spelling mistake waifunc() -> waitfunc() Raw NAND controller driver changes: - imx: Remove unused is_imx51_nfc and imx53_nfc functions - omap2: Drop obsolete dependency on COMPILE_TEST - orion: Use devm_platform_ioremap_resource() - qcom: - Use of_property_present() for testing DT property presence - Use devm_platform_get_and_ioremap_resource() - stm32_fmc2: Depends on ARCH_STM32 instead of MACH_STM32MP157 - tmio: Remove reference to config MTD_NAND_TMIO in the parsers Raw NAND manufacturer driver changes: - hynix: Fix up bit 0 of sdr_timing_mode SPI-NAND changes: - Add support for ESMT F50x1G41LB" * tag 'mtd/for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (55 commits) mtd: nand: Convert to platform remove callback returning void mtd: onenand: omap2: Drop obsolete dependency on COMPILE_TEST mtd: spi-nor: spansion: Add support for s25hl02gt and s25hs02gt mtd: spi-nor: spansion: Add a new ->ready() hook for multi-chip device mtd: spi-nor: spansion: Rework cypress_nor_quad_enable_volatile() for multi-chip device support mtd: spi-nor: spansion: Rework cypress_nor_get_page_size() for multi-chip device support mtd: spi-nor: sfdp: Add support for SCCR map for multi-chip device mtd: spi-nor: Extract volatile register offset from SCCR map mtd: spi-nor: Allow post_sfdp hook to return errors mtd: spi-nor: spansion: Rename method to cypress_nor_get_page_size mtd: spi-nor: spansion: Enable JFFS2 write buffer for S25FS256T mtd: spi-nor: spansion: Enable JFFS2 write buffer for Infineon s25hx SEMPER flash mtd: spi-nor: spansion: Enable JFFS2 write buffer for Infineon s28hx SEMPER flash mtd: spi-nor: spansion: Determine current address mode mtd: spi-nor: core: Introduce spi_nor_set_4byte_addr_mode() mtd: spi-nor: core: Update flash's current address mode when changing address mode mtd: spi-nor: Stop exporting spi_nor_restore() mtd: spi-nor: Set the 4-Byte Address Mode method based on SFDP data mtd: spi-nor: core: Make spi_nor_set_4byte_addr_mode_brwr public mtd: spi-nor: core: Update name and description of spi_nor_set_4byte_addr_mode ... commit 2c96606a0f8b7900387dbeb6532b59527999834d Merge: d84955790e165 8a4adcf67a39b Author: Linus Torvalds Date: Tue Apr 25 17:18:18 2023 -0700 Merge tag 'gpio-updates-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "We have some new drivers, significant refactoring of existing intel platforms, lots of improvements all around, mass conversion to using immutable irqchips by drivers that had not been converted individually yet and some changes in the core library code. Summary: New drivers: - add a driver for the Loongson GPIO controller - add a driver for the fxl6408 I2C GPIO expander - add a GPIO module containing code common for Intel Elkhart Lake and Merrifield platforms - add a driver for the Intel Elkhart Lake platform reusing the code from the intel tangier library GPIOLIB core: - GPIO ACPI improvements - simplify gpiochip_add_data_with_keys() fwnode handling - cleanup header inclusions (remove unneeded ones, order the rest alphabetically) - remove duplicate code (reuse krealloc() instead of open-coding it, drop a duplicated check in gpiod_find_and_request()) - reshuffle the code to remove unnecessary forward declarations - coding style cleanups and improvements - add a helper for accessing device fwnodes - small updates in docs Driver improvements: - convert all remaining GPIO irqchip drivers to using immutable irqchips - drop unnecessary of_match_ptr() macro expansions - shrink the code in gpio-merrifield significantly by reusing the code from gpio-tangier + minor tweaks to the driver code - remove MODULE_LICENSE() from drivers that can only be built-in - add device-tree support to gpio-loongson1 - use new regmap features in gpio-104-dio-48e and gpio-pcie-idio-24 - minor tweaks and fixes to gpio-xra1403, gpio-sim, gpio-tegra194, gpio-omap, gpio-aspeed, gpio-raspberrypi-exp - shrink code in gpio-ich and gpio-pxa - Kconfig tweak for gpio-pmic-eic-sprd" * tag 'gpio-updates-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (99 commits) gpio: gpiolib: Simplify gpiochip_add_data_with_key() fwnode gpiolib: Add gpiochip_set_data() helper gpiolib: Move gpiochip_get_data() higher in the code gpiolib: Check array_info for NULL only once in gpiod_get_array() gpiolib: Replace open coded krealloc() gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xNU gpiolib: acpi: Move ACPI device NULL check to acpi_get_driver_gpio_data() gpiolib: acpi: use the fwnode in acpi_gpiochip_find() gpio: mm-lantiq: Fix typo in the newly added header filename sh: mach-x3proto: Add missing #include powerpc/40x: Add missing select OF_GPIO_MM_GPIOCHIP gpio: xlp: Convert to immutable irq_chip gpio: xilinx: Convert to immutable irq_chip gpio: xgs-iproc: Convert to immutable irq_chip gpio: visconti: Convert to immutable irq_chip gpio: tqmx86: Convert to immutable irq_chip gpio: thunderx: Convert to immutable irq_chip gpio: stmpe: Convert to immutable irq_chip gpio: siox: Convert to immutable irq_chip gpio: rda: Convert to immutable irq_chip ... commit d84955790e16588774c4365ba0d449e8a2aa46d8 Merge: f5468bec213ec ed479907ff790 Author: Linus Torvalds Date: Tue Apr 25 17:13:47 2023 -0700 Merge tag 'regulator-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "A fairly quiet release, there were some cleanup and a couple of new devices but the biggest change was converting most of the drivers to use asynchronous probe. This allows us to ramp up multiple regulators in parallel during boot which can have a noticable impact on modern systems. Summary: - Update of drivers to PROBE_PREFER_ASYNCHRONOUS to mitigate issues with ramp times slowing down boots. - Convert to void remove callbacks. - Support for voltage monitoring on DA9063 - Support for Qualcomm PMC8180 and PMM8654au, Richtek RT4803 and RT5739, Rockchip RK860x" * tag 'regulator-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (46 commits) regulator: dt-bindings: qcom,rpmh: Combine PM6150L and PM8150L if-then regulator: core: Make regulator_lock_two() logic easier to follow regulator: dt-bindings: qcom,rpmh: Correct PM8550 family supplies regulator: stm32-pwr: fix of_iomap leak dt-bindings: mfd: dlg,da9063: document voltage monitoring regulator: da9063: implement setter for voltage monitoring regulator: da9063: add voltage monitoring registers regulator: fan53555: Add support for RK860X regulator: fan53555: Use dev_err_probe regulator: fan53555: Improve vsel_mask computation regulator: fan53555: Make use of the bit macros regulator: fan53555: Remove unused *_SLEW_SHIFT definitions regulator: dt-bindings: fcs,fan53555: Add support for RK860X regulator: qcom_smd: Add MP5496 S1 regulator regulator: qcom_smd: Add s1 sub-node to mp5496 regulator regulator: qcom,rpmh: add compatible for pmm8654au RPMH regulator: qcom-rpmh: add support for pmm8654au regulators regulator: core: Avoid lockdep reports when resolving supplies regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow() regulator: dt-bindings: qcom,rpmh: Add compatible for PMC8180 ... commit c7bdb07902e0b633795372665d0154e7267ecd0e Author: Beau Belgrave Date: Wed Apr 19 14:41:40 2023 -0700 tracing: Fix print_fields() for __dyn_loc/__rel_loc Both print_fields() and print_array() do not handle if dynamic data ends at the last byte of the payload for both __dyn_loc and __rel_loc field types. For __rel_loc, the offset was off by 4 bytes, leading to incorrect strings and data being printed out. In print_array() the buffer pos was missed from being advanced, which results in the first payload byte being used as the offset base instead of the field offset. Advance __rel_loc offset by 4 to ensure correct offset and advance pos to the field offset to ensure correct data is displayed when printing arrays. Change >= to > when checking if data is in-bounds, since it's valid for dynamic data to include the last byte of the payload. Example outputs for event format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:__rel_loc char text[]; offset:8; size:4; signed:1; Output before: tp_rel_loc: text= Output after: tp_rel_loc: text=Test Link: https://lkml.kernel.org/r/20230419214140.4158-3-beaub@linux.microsoft.com Fixes: 80a76994b2d8 ("tracing: Add "fields" option to show raw trace event fields") Reported-by: Doug Cook Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 9872c07b14e5ad3e3a89a7fd43e9488072007118 Author: Beau Belgrave Date: Wed Apr 19 14:41:39 2023 -0700 tracing/user_events: Set event filter_type from type Users expect that events can be filtered by the kernel. User events currently sets all event fields as FILTER_OTHER which limits to binary filters only. When strings are being used, functionality is reduced. Use filter_assign_type() to find the most appropriate filter type for each field in user events to ensure full kernel capabilities. Link: https://lkml.kernel.org/r/20230419214140.4158-2-beaub@linux.microsoft.com Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 625ed52717603f0de4c8b5cf163a3bba5cd9a362 Author: Zheng Yejian Date: Fri Apr 14 15:17:29 2023 +0800 ring-buffer: Clearly check null ptr returned by rb_set_head_page() In error case, 'buffer_page' returned by rb_set_head_page() is NULL, currently check '&buffer_page->list' is equivalent to check 'buffer_page' due to 'list' is the first member of 'buffer_page', but suppose it is not some time, 'head_page' would be wild memory while check would be bypassed. Link: https://lore.kernel.org/linux-trace-kernel/20230414071729.57312-1-zhengyejian1@huawei.com Cc: Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit f5468bec213ec2ad3f2724e3f1714b3bc7bf1515 Merge: 088e0c188513b 4a670ac3e75e5 Author: Linus Torvalds Date: Tue Apr 25 17:09:34 2023 -0700 Merge tag 'regmap-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This is a much bigger change for regmap than is normal, the main things being the addition of some KUnit coverage and a maple tree based register cache which longer term is likely to replace the rbtree cache except possibly for very small register maps. While it's complete overkill for most applications the code for maple trees is there and there are some larger, sparser devices where the data structure is a better fit. The maple tree support is still a work in progress but already useful, there's some conversions of drivers ready to go after the merge window. Summary: - Support for shifting register addresses up as well as down, there's a use cases with memory mapped MDIO. - Refactoring of the type configuration in regmap-irq to allow access to driver data in the handler, needed by some GPIO devices. - Some initial KUnit coverage, the bulk of the driver facing API is covered but there's holes and things like the data marshalling for bytestream buses are just not covered in the slightest. - Removal of the compressed cache type, it had zero users and was getting in the way of KUnit. - Addition of a maple tree based register cache, there's more work to do but it's already useful for some devices with a flatter data structure than rbtree and getting to use all the optimisation work Liam is doing" * tag 'regmap-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: allow upshifting register addresses before performing operations regmap: Pass irq_drv_data as a parameter for set_type_config() regmap: Use mas_walk() instead of mas_find() regmap: Fix double unlock in the maple cache regmap: Add maple tree based register cache regmap: Factor out single value register syncing regmap: Add some basic kunit tests regmap: Add RAM backed register map regmap: Removed compressed cache support regmap: Support paging for buses with reg_read()/reg_write() regmap: Clarify error for unknown cache types regmap: Handle sparse caches in the default sync regmap: add a helper to translate the register address regmap: cache: Silence checkpatch warning regmap: cache: Return error in cache sync operations for REGCACHE_NONE regmap-irq: Place kernel doc of struct regmap_irq_chip in order regmap-irq: Add no_status support regmap: sdw: Remove 8-bit value size restriction regmap: sdw: Update misleading comment commit 088e0c188513b58a0056a488cf5b7df094a8a48a Merge: 07d971abf436f e578c943e363f Author: Linus Torvalds Date: Tue Apr 25 16:59:48 2023 -0700 Merge tag 'platform-drivers-x86-v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Hans de Goede: - AMD PMC and PMF drivers: - Numerous bugfixes - Intel Speed Select Technology (ISST): - TPMI (Topology Aware Register and PM Capsule Interface) support for ISST support on upcoming processor models - Various other improvements / new hw support - tools/intel-speed-select: TPMI support + other improvements - Intel In Field Scan (IFS): - Add Array Bist test support - New drivers: - intel_bytcrc_pwrsrc Crystal Cove PMIC pwrsrc / reset-reason driver - lenovo-ymc Yoga Mode Control driver for reporting SW_TABLET_MODE - msi-ec Driver for MSI laptop EC features like battery charging limits - apple-gmux: - Support for new MMIO based models (T2 Macs) - Honor acpi_backlight= auto-detect-code + kernel cmdline option to switch between gmux and apple_bl backlight drivers and remove own custom handling for this - x86-android-tablets: Refactor / cleanup + new hw support - Miscellaneous other cleanups / fixes * tag 'platform-drivers-x86-v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (178 commits) platform/x86: x86-android-tablets: Add accelerometer support for Yoga Tablet 2 1050/830 series platform/x86: x86-android-tablets: Add "yogabook-touch-kbd-digitizer-switch" pdev for Lenovo Yoga Book platform/x86: x86-android-tablets: Add Wacom digitizer info for Lenovo Yoga Book platform/x86: x86-android-tablets: Update Yoga Book HiDeep touchscreen comment platform/x86: thinkpad_acpi: Fix Embedded Controller access on X380 Yoga platform/x86/intel/sdsi: Change mailbox timeout platform/x86/intel/pmt: Ignore uninitialized entries platform/x86: amd: pmc: provide user message where s0ix is not supported platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2() mlxbf-bootctl: Add sysfs file for BlueField boot fifo platform/x86: amd: pmc: Remove __maybe_unused from amd_pmc_suspend_handler() platform/x86/intel/pmc/mtl: Put GNA/IPU/VPU devices in D3 platform/x86/amd: pmc: Move out of BIOS SMN pair for STB init platform/x86/amd: pmc: Utilize SMN index 0 for driver probe platform/x86/amd: pmc: Move idlemask check into `amd_pmc_idlemask_read` platform/x86/amd: pmc: Don't dump data after resume from s0i3 on picasso platform/x86/amd: pmc: Hide SMU version and program attributes for Picasso platform/x86/amd: pmc: Don't try to read SMU version on Picasso platform/x86/amd/pmf: Move out of BIOS SMN pair for driver probe platform/x86: intel-uncore-freq: Add client processors ... commit 07d971abf436f78962ad95faafce04582b5b833a Merge: 4ea956963f4fc d184d60aa301e Author: Linus Torvalds Date: Tue Apr 25 16:56:53 2023 -0700 Merge tag 'tag-chrome-platform-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "Improvements: - Replace fake flexible arrays with flexible-array member Misc: - Minor cleanups and fixes" * tag 'tag-chrome-platform-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: wilco_ec: remove return value check of debugfs_create_dir() platform/chrome: cros_ec_debugfs: fix kernel-doc warning platform/chrome: cros_ec: Separate logic for getting panic info platform/chrome: cros_typec_switch: Add missing fwnode_handle_put() platform/chrome: cros_ec: remove unneeded label and if-condition platform/chrome: Replace fake flexible arrays with flexible-array member commit 4ea956963f4fca59050a22fcc65f00a85d586e63 Merge: c8cc58e289ed3 73b41dc51fbef Author: Linus Torvalds Date: Tue Apr 25 16:27:13 2023 -0700 Merge tag 'media/v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Removal of some old unused sensor drivers: ad9389b, m5mols, mt9m032, mt9t001, noon010pc30, s5k6aa, sr030pc30 and vs6624 - New i.MX8 image sensor interface driver - Some new RC keymaps - lots of cleanups at atomisp driver to make it support standard features present on other webcam drivers - the cx18 and saa7146 now uses VB2 - lots of cleanups and driver improvements * tag 'media/v6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (460 commits) media: ov5670: Fix probe on ACPI media: nxp: imx8-isi: Remove 300ms sleep after enabling channel media: nxp: imx8-isi: Replace udelay() with fsleep() media: nxp: imx8-isi: Drop partial support for i.MX8QM and i.MX8QXP media: nxp: Add i.MX8 ISI driver media: dt-bindings: media: Add i.MX8 ISI DT bindings media: atomisp: gmin_platform: Add Lenovo Ideapad Miix 310 gmin_vars media: atomisp: gmin_platform: Make DMI quirks take precedence over the _DSM table media: atomisp: Remove struct atomisp_sub_device index field media: atomisp: Drop support for streaming from 2 sensors at once media: atomisp: Remove atomisp_try_fmt() call from atomisp_set_fmt() media: atomisp: Remove unused ATOM_ISP_MAX_WIDTH_TMP and ATOM_ISP_MAX_HEIGHT_TMP media: atomisp: Remove snr_mbus_fmt local var from atomisp_try_fmt() media: atomisp: Remove custom V4L2_CID_FMT_AUTO control media: atomisp: Remove continuous mode related code from atomisp_set_fmt() media: atomisp: Remove duplicate atomisp_[start|stop]_streaming() prototypes media: atomisp: gc0310: Switch over to ACPI powermanagement media: atomisp: gc0310: Use devm_kzalloc() for data struct media: atomisp: gc0310: Add runtime-pm support media: atomisp: gc0310: Delay power-on till streaming is started ... commit 82253a271aae9271fcf0aaa5e0ecc6dd38fb872b Author: Daniel Bristot de Oliveira Date: Fri Mar 24 20:26:42 2023 +0100 rtla/timerlat: Fix "Previous IRQ" auto analysis' line The "Previous IRQ interference" line is misaligned and without a \n, breaking the tool's output: ## CPU 12 hit stop tracing, analyzing it ## Previous IRQ interference: up to 2.22 us IRQ handler delay: 18.06 us (0.00 %) IRQ latency: 18.52 us Timerlat IRQ duration: 4.41 us (0.00 %) Blocking thread: 216.93 us (0.03 %) Fix the output: ## CPU 7 hit stop tracing, analyzing it ## Previous IRQ interference: up to 8.93 us IRQ handler delay: 0.98 us (0.00 %) IRQ latency: 2.95 us Timerlat IRQ duration: 11.26 us (0.03 %) Link: https://lore.kernel.org/linux-trace-devel/8b5819077f15ccf24745c9bf3205451e16ee32d9.1679685525.git.bristot@kernel.org Fixes: 27e348b221f6 ("rtla/timerlat: Add auto-analysis core") Cc: Masami Hiramatsu Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 9fa48a2477de747b644c778a1e35d679cabcd917 Author: Daniel Bristot de Oliveira Date: Wed Mar 29 18:23:32 2023 +0200 rtla/timerlat: Add auto-analysis only option Parsing and formating timerlat data might consume a reasonable amount of CPU time on very large systems, or when timerlat has a too short period. Add an option to run timerlat with auto-analysis enabled while skipping the statistics parsing. In this mode, rtla timerlat periodically checks if the tracing is on, going to sleep waiting for the stop tracing condition to stop tracing, or for the tracing session to finish. If the stop tracing condition is hit, the tool prints the auto analysis. Otherwise, the tool prints the max observed latency and exit. The max observed latency is captured via tracing_max_latency. Link: https://lore.kernel.org/linux-trace-devel/4dc514d1d5dc353c537a466a9b5af44c266b6da2.1680106912.git.bristot@kernel.org Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 73e053cbd00ed890abfc812d6c602cbfa8d234dc Author: Colin Ian King Date: Tue Apr 18 16:00:18 2023 +0100 rv: Remove redundant assignment to variable retval Variable retval is being assigned a value that is never read, it is being re-assigned a new value in both paths of a following if statement. Remove the assignment. Cleans up clang-scan warning: kernel/trace/rv/rv.c:293:2: warning: Value stored to 'retval' is never read [deadcode.DeadStores] retval = count; Link: https://lkml.kernel.org/r/20230418150018.3123753-1-colin.i.king@gmail.com Cc: Masami Hiramatsu Signed-off-by: Colin Ian King Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit c8cc58e289ed3b5bc50258f52776cf3dfa3bad66 Merge: 736b378b29d89 289af45508ca8 Author: Linus Torvalds Date: Tue Apr 25 16:12:15 2023 -0700 Merge tag 'drm-next-2023-04-24' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "There is a new Qualcomm accel driver for their QAIC, dma-fence got a deadline feature added, lots of refactoring around fbdev emulation, and the usual pre-release hw enablements from AMD and Intel and fixes everywhere. New drivers: - add QAIC acceleration driver dma-buf: - constify kobj_type structs - Reject prime DMA-Buf attachment if get_sg_table is missing. fbdev: - cmdline parser fixes - implement fbdev emulation for GEM DMA drivers - always use shadow buffer in fbdev emulation helpers dma-fence: - add deadline hint to fences - signal private stub fence core: - improve DisplayID 2.0 and EDID parsing - add gem eviction function + callback - prep to convert shmem helper to GEM resv lock - move suballocator from radeon/amdgpu to core for Xe - HPD polling fixes - Documentation improvements - Add atomic enable_plane callback - use tgid instead of pid for client tracking - DP: Add SDP Error Detection Configuration Register - Add prime import/export to vram-helper - use pci aperture helpers in more drivers panel: - Radxa 8/10HD support - Samsung AMD495QA01 support - Elida KD50T048A - Sony TD4353 - Novatek NT36523 - STARRY 2081101QFH032011-53G - B133UAN01.0 - AUO NE135FBM-N41 i915: - More MTL enabling - fix s/r problems with MEI/PXP - Implement fb_dirty for PSR,FBC,DRRS fixes - Fix eDP+DSI dual panel systems - Fix issue #6333: "list_add corruption" and full system lockup from performance monitoring - Don't use stolen memory or BAR for ring buffers on LLC platforms - Make sure DSM size has correct 1MiB granularity on Gen12+ - Whitelist COMMON_SLICE_CHICKEN3 for UMD access on Gen12+ - Add engine TLB invalidation for Meteorlake - Fix GSC races on driver load/unload on Meteorlake+ - Make kobj_type structures constant - Move fd_install after last use of fence - wm/vblank refactoring - display code refactoring - Create GSC submission targeting HDCP and PXP usages on MTL+ - Enable HDCP2.x via GSC CS - Fix context runtime accounting on sysfs fdinfo for heavy workloads - Use i915 instead of dev_priv insied the file_priv structure - Replace fake flex-array with flexible-array member amdgpu: - Make kobj structures const - Generalize dmabuf import to work with KFD - Add capped/uncapped workload handling for supported APUs - Expose additional memory stats via fdinfo - Register vga_switcheroo for apple-gmux - Initial NBIO7.9, GC 9.4.3, GFXHUB 1.2, MMHUB 1.8 support - Initial DC FAM infrastructure - Link DC backlight to connector device rather than PCI device - Add sysfs nodes for secondary VCN clocks amdkfd: - Make kobj structures const - Support for exporting buffers via dmabuf - Multi-VMA page migration fixes - initial GC 9.4.3 support radeon: - iMac fix - convert to client based fbdev emulation habanalabs: - Add opcodes to the CS ioctl to allow user to stall/resume specific engines inside Gaudi2. - INFO ioctl the amount of device memory that the driver and f/w reserve for themselves. - INFO ioctl a bit-mask of the available rotator engines - INFO ioctl the register's address of the f/w that should be used to trigger interrupts - INFO ioctl two new opcodes to fetch information on h/w and f/w events - Enable graceful reset mechanism for compute-reset. - Align to the latest firmware specs. - Enforce the release order of the compute device and dma-buf. msm: - UBWC decoder programming rework - SM8550, SM8450 bindings update - uapi C++ fix - a3xx and a4xx devfreq support - GPU and GEM updates to avoid allocations which could trigger reclaim (shrinker) in fence signaling path - dma-fence deadline hint support and wait-boost - a640/650 speed bin support cirrus: - convert to regular atomic helpers - add damage clipping mediatek: - 10-bit overlay support - mt8195 support - Only trigger DRM HPD events if bridge is attached - Change the aux retries times when receiving AUX_DEFER rockchip: - add 4K support vc4: - use drm_gem_objects virtio: - allow KMS support to be disabled - add damage clipping vmwgfx: - buffer object lifetime fixes exynos: - move MIPI DSI driver to drm bridge for iMX sharing - use kernel fbdev emulation panfrost: - add support for mali MT81xx devices - add speed binning support lima: - add usage stats tegra: - fbdev client conversion vkms: - Add primary plane positioning support" * tag 'drm-next-2023-04-24' of git://anongit.freedesktop.org/drm/drm: (1495 commits) drm/i915/dp_mst: Fix active port PLL selection for secondary MST streams drm/exynos: Implement fbdev emulation as in-kernel client drm/exynos: Initialize fbdev DRM client drm/exynos: Remove fb_helper from struct exynos_drm_private drm/exynos: Remove struct exynos_drm_fbdev drm/exynos: Remove exynos_gem from struct exynos_drm_fbdev drm/i915: Fix memory leaks in i915 selftests drm/i915: Make intel_get_crtc_new_encoder() less oopsy drm/i915/gt: Avoid out-of-bounds access when loading HuC drm/amdgpu: add some basic elements for multiple XCD case drm/amdgpu: move vmhub out of amdgpu_ring_funcs (v4) Revert "drm/amdgpu: enable ras for mp0 v13_0_10 on SRIOV" drm/amdgpu: add common ip block for GC 9.4.3 drm/amd/display: Add logging when DP link training Clock recovery is Successful drm/amdgpu: add common early init support for GC 9.4.3 drm/amdgpu: switch to v9_4_3 gfx_funcs callbacks for GC 9.4.3 drm/amd/display: Add logging when setting DP sink power state fails drm/amdkfd: Add gfx_target_version for GC 9.4.3 drm/amdkfd: Enable HW_UPDATE_RPTR on GC 9.4.3 drm/amdgpu: reserve the old gc_11_0_*_mes.bin ... commit 54a0dffa62de0c91b406ff32082a121ccfa0d7f1 Author: Colin Ian King Date: Mon Apr 24 10:47:30 2023 +0100 rv: Fix addition on an uninitialized variable 'run' The variable run is not initialized however it is being accumulated by the return value from the call to ikm_run_monitor. Fix this by initializing run to zero at the start of the function. Link: https://lkml.kernel.org/r/20230424094730.105313-1-colin.i.king@gmail.com Fixes: 4bc4b131d44c ("rv: Add rv tool") Signed-off-by: Colin Ian King Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit a99d0d5f4a53f31e0d9c8f3d03436d9709116b6b Author: Rong Tao Date: Mon Apr 24 18:46:06 2023 +0800 rtla: Add .gitignore file Add .gitignore file to ignore the rtla binary. Link: https://lore.kernel.org/linux-trace-devel/tencent_3C22A3418CD06196C2E5A84AE3EBC2281206@qq.com Signed-off-by: Rong Tao Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit afed6271f5b0d78ca1a3739c1da4aa3629b26bba Author: Jens Axboe Date: Tue Mar 7 17:56:28 2023 -0700 pipe: set FMODE_NOWAIT on pipes Pipes themselves do not hold the the pipe lock across IO, and hence are safe for RWF_NOWAIT/IOCB_NOWAIT usage. The "contract" for NOWAIT is really "should not do IO under this lock", not strictly that we cannot block or that the below code is in any way atomic. Pipes fulfil that criteria. Acked-by: Dave Chinner Reviewed-by: Christian Brauner Signed-off-by: Jens Axboe commit 0f99fc513ddd28de155c58547824a9fd63daacea Author: Jens Axboe Date: Mon Apr 24 16:32:55 2023 -0600 splice: clear FMODE_NOWAIT on file if splice/vmsplice is used In preparation for pipes setting FMODE_NOWAIT on pipes to indicate that RWF_NOWAIT/IOCB_NOWAIT is fully supported, have splice and vmsplice clear that file flag. Splice holds the pipe lock around IO and cannot easily be refactored to avoid that, as splice and pipes are inherently tied together. By clearing FMODE_NOWAIT if splice is being used on a pipe, other users of the pipe will know that the pipe is no longer safe for RWF_NOWAIT and friends. Suggested-by: Linus Torvalds Signed-off-by: Jens Axboe commit 736b378b29d89c8c3567fa4b2e948be5568aebb8 Merge: 11704531dde45 ed4cdfbeb8735 Author: Linus Torvalds Date: Tue Apr 25 13:00:41 2023 -0700 Merge tag 'slab-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: "The main change is naturally the SLOB removal. Since its deprecation in 6.2 I've seen no complaints so hopefully SLUB_(TINY) works well for everyone and we can proceed. Besides the code cleanup, the main immediate benefit will be allowing kfree() family of function to work on kmem_cache_alloc() objects, which was incompatible with SLOB. This includes kfree_rcu() which had no kmem_cache_free_rcu() counterpart yet and now it shouldn't be necessary anymore. Besides that, there are several small code and comment improvements from Thomas, Thorsten and Vernon" * tag 'slab-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: document kfree() as allowed for kmem_cache_alloc() objects mm/slob: remove slob.c mm/slab: remove CONFIG_SLOB code from slab common code mm, pagemap: remove SLOB and SLQB from comments and documentation mm, page_flags: remove PG_slob_free mm/slob: remove CONFIG_SLOB mm/slub: fix help comment of SLUB_DEBUG mm: slub: make kobj_type structure constant slab: Adjust comment after refactoring of gfp.h commit 11704531dde45bc667a411e1c76de81d9f4481b8 Merge: 7ec85f3e089aa c9c8133080c75 Author: Linus Torvalds Date: Tue Apr 25 12:51:51 2023 -0700 Merge tag 'livepatching-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching updates from Petr Mladek: - Code and documentation cleanup * tag 'livepatching-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Make kobj_type structures constant livepatch: fix ELF typos commit 7ec85f3e089aa423a69559bf4555b6218b5a2ef7 Merge: df45da57cbd35 bee43904dc774 Author: Linus Torvalds Date: Tue Apr 25 12:46:48 2023 -0700 Merge tag 'printk-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Code cleanup and dead code removal * tag 'printk-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: Remove obsoleted check for non-existent "user" object lib/vsprintf: Use isodigit() for the octal number check Remove orphaned CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT commit df45da57cbd35715d590a36a12968a94508ccd1f Merge: 53b5e72b9d898 eeb3557cc188e Author: Linus Torvalds Date: Tue Apr 25 12:39:01 2023 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Will Deacon: "ACPI: - Improve error reporting when failing to manage SDEI on AGDI device removal Assembly routines: - Improve register constraints so that the compiler can make use of the zero register instead of moving an immediate #0 into a GPR - Allow the compiler to allocate the registers used for CAS instructions CPU features and system registers: - Cleanups to the way in which CPU features are identified from the ID register fields - Extend system register definition generation to handle Enum types when defining shared register fields - Generate definitions for new _EL2 registers and add new fields for ID_AA64PFR1_EL1 - Allow SVE to be disabled separately from SME on the kernel command-line Tracing: - Support for "direct calls" in ftrace, which enables BPF tracing for arm64 Kdump: - Don't bother unmapping the crashkernel from the linear mapping, which then allows us to use huge (block) mappings and reduce TLB pressure when a crashkernel is loaded. Memory management: - Try again to remove data cache invalidation from the coherent DMA allocation path - Simplify the fixmap code by mapping at page granularity - Allow the kfence pool to be allocated early, preventing the rest of the linear mapping from being forced to page granularity Perf and PMU: - Move CPU PMU code out to drivers/perf/ where it can be reused by the 32-bit ARM architecture when running on ARMv8 CPUs - Fix race between CPU PMU probing and pKVM host de-privilege - Add support for Apple M2 CPU PMU - Adjust the generic PERF_COUNT_HW_BRANCH_INSTRUCTIONS event dynamically, depending on what the CPU actually supports - Minor fixes and cleanups to system PMU drivers Stack tracing: - Use the XPACLRI instruction to strip PAC from pointers, rather than rolling our own function in C - Remove redundant PAC removal for toolchains that handle this in their builtins - Make backtracing more resilient in the face of instrumentation Miscellaneous: - Fix single-step with KGDB - Remove harmless warning when 'nokaslr' is passed on the kernel command-line - Minor fixes and cleanups across the board" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (72 commits) KVM: arm64: Ensure CPU PMU probes before pKVM host de-privilege arm64: kexec: include reboot.h arm64: delete dead code in this_cpu_set_vectors() arm64/cpufeature: Use helper macro to specify ID register for capabilites drivers/perf: hisi: add NULL check for name drivers/perf: hisi: Remove redundant initialized of pmu->name arm64/cpufeature: Consistently use symbolic constants for min_field_value arm64/cpufeature: Pull out helper for CPUID register definitions arm64/sysreg: Convert HFGITR_EL2 to automatic generation ACPI: AGDI: Improve error reporting for problems during .remove() arm64: kernel: Fix kernel warning when nokaslr is passed to commandline perf/arm-cmn: Fix port detection for CMN-700 arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step arm64: move PAC masks to arm64: use XPACLRI to strip PAC arm64: avoid redundant PAC stripping in __builtin_return_address() arm64/sme: Fix some comments of ARM SME arm64/signal: Alloc tpidr2 sigframe after checking system_supports_tpidr2() arm64/signal: Use system_supports_tpidr2() to check TPIDR2 arm64/idreg: Don't disable SME when disabling SVE ... commit 53b5e72b9d89853b7e622239676163ede52acffe Merge: d53c3eaaef6a0 73afb20716e16 Author: Linus Torvalds Date: Tue Apr 25 12:22:11 2023 -0700 Merge tag 'asm-generic-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "These are various cleanups, fixing a number of uapi header files to no longer reference CONFIG_* symbols, and one patch that introduces the new CONFIG_HAS_IOPORT symbol for architectures that provide working inb()/outb() macros, as a preparation for adding driver dependencies on those in the following release" * tag 'asm-generic-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: Kconfig: introduce HAS_IOPORT option and select it as necessary scripts: Update the CONFIG_* ignore list in headers_install.sh pktcdvd: Remove CONFIG_CDROM_PKTCDVD_WCACHE from uapi header Move bp_type_idx to include/linux/hw_breakpoint.h Move ep_take_care_of_epollwakeup() to fs/eventpoll.c Move COMPAT_ATM_ADDPARTY to net/atm/svc.c commit d53c3eaaef6a05fec04e8b5990d97d7216eb5e42 Merge: 672d2dae19012 b8a4346d25024 Author: Linus Torvalds Date: Tue Apr 25 12:11:54 2023 -0700 Merge tag 'soc-dt-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC devicetree updates from Arnd Bergmann: "The devicetree changes overall are again dominated by the Qualcomm Snapdragon platform that weighs in at over 300 changesets, but there are many updates across other platforms as well, notably Mediatek, NXP, Rockchips, Renesas, TI, Samsung and ST Microelectronics. These all add new features for existing machines, as well as new machines and SoCs. The newly added SoCs are: - Allwinner T113-s, an Cortex-A7 based variant of the RISC-V based D1 chip. - StarFive JH7110, a RISC-V SoC based on the Sifive U74 core like its JH7100 predecessor, but with additional CPU cores and a GPU. - Apple M2 as used in current Macbook Air/Pro and Mac Mini gets added, with comparable support as its M1 predecessor. - Unisoc UMS512 (Tiger T610) is a midrange smartphone SoC - Qualcomm IPQ5332 and IPQ9574 are Wi-Fi 7 networking SoCs, based on the Cortex-A53 and Cortex-A73 cores, respectively. - Qualcomm sa8775p is an automotive SoC derived from the Snapdragon family. Including the initial board support for the added SoC platforms, there are 52 new machines. The largest group are 19 boards industrial embedded boards based on the NXP i.MX6 (32-bit) and i.MX8 (64-bit) families. Others include: - Two boards based on the Allwinner f1c200s ultra-low-cost chip - Three 'Banana Pi' variants based on the Amlogic g12b (A311D, S922X) SoC. - The Gl.Inet mv1000 router based on Marvell Armada 3720 - A Wifi/LTE Dongle based on Qualcomm msm8916 - Two robotics boards based on Qualcomm QRB chips - Three Snapdragon based phones made by Xiaomi - Five developments boards based on various Rockchip SoCs, including the rk3588s-khadas-edge2 and a few NanoPi models - The AM625 Beagleplay industrial SBC Another 14 machines get removed: both boards for the obsolete 'oxnas' platform, three boards for the Renesas r8a77950 SoC that were only for pre-production chips, and various chromebook models based on the Qualcomm Sc7180 'trogdor' design that were never part of products" * tag 'soc-dt-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (836 commits) arm64: dts: rockchip: Add support for volume keys to rk3399-pinephone-pro arm64: dts: rockchip: Add vdd_cpu_big regulators to rk3588-rock-5b arm64: dts: rockchip: Use generic name for es8316 on Pinebook Pro and Rock 5B arm64: dts: rockchip: Drop RTC clock-frequency on rk3588-rock-5b arm64: dts: apple: t8112: Add PWM controller arm64: dts: apple: t600x: Add PWM controller arm64: dts: apple: t8103: Add PWM controller arm64: dts: rockchip: Add pinctrl gpio-ranges for rk356x ARM: dts: nomadik: Replace deprecated spi-gpio properties ARM: dts: aspeed-g6: Add UDMA node ARM: dts: aspeed: greatlakes: add mctp device ARM: dts: aspeed: greatlakes: Add gpio names ARM: dts: aspeed: p10bmc: Change power supply info arm64: dts: mediatek: mt6795-xperia-m5: Add Bosch BMM050 Magnetometer arm64: dts: mediatek: mt6795-xperia-m5: Add Bosch BMA255 Accelerometer arm64: dts: mediatek: mt6795: Add tertiary PWM node arm64: dts: rockchip: add panel to Anbernic RG353 series dt-bindings: arm: Add Data Modul i.MX8M Plus eDM SBC dt-bindings: arm: fsl: Add chargebyte Tarragon dt-bindings: vendor-prefixes: add chargebyte ... commit 672d2dae19012cb2c40fdf36711ee3b5f5420724 Merge: a907047732470 2c25b94f881cf Author: Linus Torvalds Date: Tue Apr 25 12:09:54 2023 -0700 Merge tag 'soc-defconfig-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC defconfig updates from Arnd Bergmann: "Most of the changes just enable additional device drivers that were added or that are often used on major platforms. The virtconfig added last time now disables additional drivers to shrink kernels for virtual machines. The obsolete oxnas_v6_defconfig file is removed in turn" * tag 'soc-defconfig-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (33 commits) ARM: config: Update Vexpress defconfig arm64: defconfig: enable building the nvmem-reboot-mode module arm64: defconfig: Enable TI ADC driver arm64: defconfig: Enable TI TSCADC driver arm64: defconfig: Enable security accelerator driver for TI K3 SoCs arm64: defconfig: Enable crypto test module ARM: multi_v7_defconfig: Add OPTEE support ARM: configs: Update U8500 defconfig ARM: imx_v4_v5_defconfig: Build CONFIG_IMX_SDMA as module arm64: defconfig: Enable IPQ9574 SoC base configs ARM: imx_v6_v7_defconfig: Enable Tarragon peripheral drivers arm64: defconfig: Enable ARM CoreSight PMU driver arm64: defconfig: remove duplicate TYPEC_UCSI & QCOM_PMIC_GLINK ARM: configs: remove oxnas_v6_defconfig arm64: defconfig: Enable audio drivers for AM62-SK arm64: defconfig: Enable drivers for BeaglePlay ARM: imx_v6_v7_defconfig: Select CONFIG_DRM_I2C_NXP_TDA998X arm64: defconfig: Enable Virtio RNG driver as built in arm64: defconfig: Enable CAN PHY transceiver driver arm64: defconfig: add PMIC GLINK modules ... commit a907047732470f75f3b7c9a8ee09b16765b8364c Merge: 18032df5ef5c0 4c87f3ff78b20 Author: Linus Torvalds Date: Tue Apr 25 12:02:16 2023 -0700 Merge tag 'soc-drivers-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC driver updates from Arnd Bergmann: "The most notable updates this time are for Qualcomm Snapdragon platforms. The Inline-Crypto-Engine gets a new DT binding and driver, and a number of drivers now support additional Snapdragon variants, in particular the rsc, scm, geni, bwm, glink and socinfo, while the llcc (edac) and rpm drivers get notable functionality updates. Updates on other platforms include: - Various updates to the Mediatek mutex and mmsys drivers, including support for the Helio X10 SoC - Support for unidirectional mailbox channels in Arm SCMI firmware - Support for per cpu asynchronous notification in OP-TEE firmware - Minor updates for memory controller drivers. - Minor updates for Renesas, TI, Amlogic, Apple, Broadcom, Tegra, Allwinner, Versatile Express, Canaan, Microchip, Mediatek and i.MX SoC drivers, mainly updating the use of MODULE_LICENSE() macros and obsolete DT driver interfaces" * tag 'soc-drivers-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (165 commits) soc: ti: smartreflex: Simplify getting the opam_sr pointer bus: vexpress-config: Add explicit of_platform.h include soc: mediatek: Kconfig: Add MTK_CMDQ dependency to MTK_MMSYS memory: mtk-smi: mt8365: Add SMI Support dt-bindings: memory-controllers: mediatek,smi-larb: add mt8365 dt-bindings: memory-controllers: mediatek,smi-common: add mt8365 memory: tegra: read values from correct device dt-bindings: crypto: Add Qualcomm Inline Crypto Engine soc: qcom: Make the Qualcomm UFS/SDCC ICE a dedicated driver dt-bindings: firmware: document Qualcomm QCM2290 SCM soc: qcom: rpmh-rsc: Support RSC v3 minor versions soc: qcom: smd-rpm: Use GFP_ATOMIC in write path soc/tegra: fuse: Remove nvmem root only access soc/tegra: cbb: tegra194: Use of_address_count() helper soc/tegra: cbb: Remove MODULE_LICENSE in non-modules ARM: tegra: Remove MODULE_LICENSE in non-modules soc/tegra: flowctrl: Use devm_platform_get_and_ioremap_resource() soc: tegra: cbb: Drop empty platform remove function firmware: arm_scmi: Add support for unidirectional mailbox channels dt-bindings: firmware: arm,scmi: Support mailboxes unidirectional channels ... commit 18032df5ef5c0eec2adf120142bd95a3a8807866 Merge: de10553fce407 bd2c0c4452eea Author: Linus Torvalds Date: Tue Apr 25 11:53:09 2023 -0700 Merge tag 'soc-arm-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC updates from Arnd Bergmann: "The Oxford Semiconductor OX810/OX820 'Oxnas' platform gets retired after the ARM11MPcore processor keeps causing problems in certain corner cases. OX820 was the only remaining SoC with this core after CNS3xxx got retired, and its driver support was never completely merged upstream. The Arm 'Realview' reference platform still supports ARM11MPCore in principle, but this was never a product, and the CPU support will get cleaned up later on. Another series updates the mv78xx0 platform, which has been similarly neglected for a while, but should work properly again now. The other changes are minor cleanups across platforms, mostly converting code to more modern interfaces for DT nodes and removing some more code as a follow-up to the large-scale platform removal in linux-6.3" * tag 'soc-arm-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (28 commits) ARM: mv78xx0: fix entries for gpios, buttons and usb ports ARM: mv78xx0: add code to enable XOR and CRYPTO engines on mv78xx0 ARM: mv78xx0: set the correct driver for the i2c RTC ARM: mv78xx0: adjust init logic for ts-wxl to reflect single core dev soc: fsl: Use of_property_present() for testing DT property presence ARM: pxa: Use of_property_read_bool() for boolean properties firmware: turris-mox-rwtm: make kobj_type structure constant ARM: oxnas: remove OXNAS support ARM: sh-mobile: Use of_cpu_node_to_id() to read CPU node 'reg' ARM: OMAP2+: hwmod: Use kzalloc for allocating only one element ARM: OMAP2+: Remove the unneeded result variable ARM: OMAP2+: fix repeated words in comments ARM: OMAP2+: remove obsolete config OMAP3_SDRC_AC_TIMING ARM: OMAP2+: Use of_address_to_resource() ARM: OMAP2+: Use of_property_read_bool() for boolean properties ARM: omap1: remove redundant variables err ARM: omap1: Kconfig: Fix indentation ARM: bcm: Use of_address_to_resource() ARM: mstar: remove unused config MACH_MERCURY ARM: spear: remove obsolete config MACH_SPEAR600 ... commit a9863979fbc25838bbe7c5badf538cedfc802f60 Merge: c19c6c7b44c69 80e9552e843b2 Author: Stephen Boyd Date: Tue Apr 25 11:52:39 2023 -0700 Merge branch 'clk-imx' into clk-next * clk-imx: (25 commits) clk: imx: imx8ulp: update clk flag for system critical clock clk: imx: imx8ulp: Add tpm5 clock as critical gate clock clk: imx: imx8ulp: keep MU0_B clock enabled always clk: imx: imx8ulp: Add divider closest support to get more accurate clock rate clk: imx: imx8ulp: Fix XBAR_DIVBUS and AD_SLOW clock parents clk: imx: imx93: Add nic and A55 clk dt-bindings: clock: imx93: add NIC, A55 and ARM PLL CLK clk: imx: imx93: add mcore_booted module paratemter clk: imx: fracn-gppll: Add 300MHz freq support for imx9 clk: imx: fracn-gppll: support integer pll clk: imx: fracn-gppll: disable hardware select control clk: imx: fracn-gppll: fix the rate table clk: imx: imx8mp: change the 'nand_usdhc_bus' clock to non-critical clk: imx: imx8mp: Add LDB root clock dt-bindings: clock: imx8mp: Add LDB clock entry clk: imx: imx8mp: correct DISP2 pixel clock type clk: imx: drop duplicated macro clk: imx: clk-gpr-mux: Provide clock name in error message clk: imx: Let IMX8MN_CLK_DISP_PIXEL set parent rate clk: imx8mm: Let IMX8MM_CLK_LCDIF_PIXEL set parent rate ... commit c19c6c7b44c69faa7a18ef79e758f580b144fd8f Merge: 1a86e99fa00a6 27a6e1b09a782 ef382228d25a9 0818c8d46948d ea90f303e8c19 Author: Stephen Boyd Date: Tue Apr 25 11:52:25 2023 -0700 Merge branches 'clk-of', 'clk-samsung', 'clk-rockchip' and 'clk-qcom' into clk-next * clk-of: clk: add missing of_node_put() in "assigned-clocks" property parsing * clk-samsung: clk: samsung: exynos850: Make PMU_ALIVE_PCLK critical clk: samsung: Convert to platform remove callback returning void clk: samsung: exynos5433: Extract PM support to common ARM64 layer clk: samsung: Extract parent clock enabling to common function clk: samsung: Extract clocks registration to common function clk: samsung: exynos850: Add AUD and HSI main gate clocks clk: samsung: exynos850: Implement CMU_G3D domain clk: samsung: clk-pll: Implement pll0818x PLL type clk: samsung: Set dev in samsung_clk_init() clk: samsung: Don't pass reg_base to samsung_clk_register_pll() clk: samsung: Remove np argument from samsung_clk_init() dt-bindings: clock: exynos850: Add AUD and HSI main gate clocks dt-bindings: clock: exynos850: Add Exynos850 CMU_G3D * clk-rockchip: clk: rockchip: rk3588: make gate linked clocks critical clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent * clk-qcom: (57 commits) clk: qcom: gcc-sc8280xp: Add EMAC GDSCs clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk clk: qcom: add the GPUCC driver for sa8775p dt-bindings: clock: qcom: describe the GPUCC clock for SA8775P clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks in lpass_cc_sc7280_desc clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration dt-bindings: clock: qcom,sc7280-lpasscc: Add qcom,adsp-pil-mode property clk: qcom: rpm: Use managed `of_clk_add_hw_provider()` clk: qcom: Add Global Clock Controller driver for IPQ9574 dt-bindings: clock: Add ipq9574 clock and reset definitions clk: qcom: gpucc-sm6375: Configure CX_GDSC disable wait value clk: qcom: gcc-sm6115: Mark RCGs shared where applicable clk: qcom: dispcc-qcm2290: Add MDSS_CORE reset dt-bindings: clock: dispcc-qcm2290: Add MDSS_CORE reset clk: qcom: apss-ipq-pll: add support for IPQ5332 dt-bindings: clock: qcom,a53pll: add IPQ5332 compatible clk: qcom: apss-ipq-pll: refactor the driver to accommodate different PLL types dt-bindings: mailbox: qcom,apcs-kpss-global: fix SDX55 'if' match dt-bindings: mailbox: qcom,apcs-kpss-global: correct SDX55 clocks ... commit 1a86e99fa00a6284c9419043493246d38ad3357f Merge: caca6ad3670e6 c19d966e11c45 14e985482111a c0e19528439db Author: Stephen Boyd Date: Tue Apr 25 11:50:49 2023 -0700 Merge branches 'clk-starfive', 'clk-fractional' and 'clk-devmof' into clk-next - Shrink size of clk_fractional_divider a little - Convert various clk drivers to devm_of_clk_add_hw_provider() * clk-starfive: clk: starfive: Delete the redundant dev_set_drvdata() in JH7110 clock drivers clk: starfive: Avoid casting iomem pointers MAINTAINERS: generalise StarFive clk/reset entries reset: starfive: Add StarFive JH7110 reset driver clk: starfive: Add StarFive JH7110 always-on clock driver clk: starfive: Add StarFive JH7110 system clock driver reset: starfive: jh71x0: Use 32bit I/O on 32bit registers reset: starfive: Rename "jh7100" to "jh71x0" for the common code reset: starfive: Extract the common JH71X0 reset code reset: starfive: Factor out common JH71X0 reset code reset: Create subdirectory for StarFive drivers reset: starfive: Replace SOC_STARFIVE with ARCH_STARFIVE clk: starfive: Rename "jh7100" to "jh71x0" for the common code clk: starfive: Rename clk-starfive-jh7100.h to clk-starfive-jh71x0.h clk: starfive: Factor out common JH7100 and JH7110 code clk: starfive: Replace SOC_STARFIVE with ARCH_STARFIVE dt-bindings: clock: Add StarFive JH7110 always-on clock and reset generator dt-bindings: clock: Add StarFive JH7110 system clock and reset generator * clk-fractional: clk: Remove mmask and nmask fields in struct clk_fractional_divider clk: rockchip: Remove values for mmask and nmask in struct clk_fractional_divider clk: imx: Remove values for mmask and nmask in struct clk_fractional_divider clk: Compute masks for fractional_divider clk when needed. * clk-devmof: clk: uniphier: Use managed `of_clk_add_hw_provider()` clk: si5351: Use managed `of_clk_add_hw_provider()` clk: si570: Use managed `of_clk_add_hw_provider()` clk: si514: Use managed `of_clk_add_hw_provider()` clk: lmk04832: Use managed `of_clk_add_hw_provider()` clk: hsdk-pll: Use managed `of_clk_add_hw_provider()` clk: cdce706: Use managed `of_clk_add_hw_provider()` clk: axs10x: Use managed `of_clk_add_hw_provider()` clk: axm5516: Use managed `of_clk_add_hw_provider()` clk: axi-clkgen: Use managed `of_clk_add_hw_provider()` commit caca6ad3670e6163c51dd7c53c1c679638de0f4e Merge: 6f7478e3bb289 595c88cda65d3 ba7c8d2700adf ce1c5f840fb7c Author: Stephen Boyd Date: Tue Apr 25 11:50:36 2023 -0700 Merge branches 'clk-xilinx', 'clk-broadcom' and 'clk-platform' into clk-next - BCM63268 timer clock and reset controller - Convert platform clk drivers to remove_new * clk-xilinx: clocking-wizard: Support higher frequency accuracy clk: zynqmp: pll: Remove the limit * clk-broadcom: clk: bcm: Add BCM63268 timer clock and reset driver dt-bindings: clock: Add BCM63268 timer binding dt-bindings: reset: add BCM63268 timer reset definitions dt-bindings: clk: add BCM63268 timer clock definitions * clk-platform: (25 commits) clk: xilinx: Convert to platform remove callback returning void clk: x86: Convert to platform remove callback returning void clk: uniphier: Convert to platform remove callback returning void clk: ti: Convert to platform remove callback returning void clk: tegra: Convert to platform remove callback returning void clk: stm32: Convert to platform remove callback returning void clk: mvebu: Convert to platform remove callback returning void clk: mmp: Convert to platform remove callback returning void clk: keystone: Convert to platform remove callback returning void clk: hisilicon: Convert to platform remove callback returning void clk: stm32mp1: Convert to platform remove callback returning void clk: scpi: Convert to platform remove callback returning void clk: s2mps11: Convert to platform remove callback returning void clk: pwm: Convert to platform remove callback returning void clk: palmas: Convert to platform remove callback returning void clk: hsdk-pll: Convert to platform remove callback returning void clk: fixed-rate: Convert to platform remove callback returning void clk: fixed-mmio: Convert to platform remove callback returning void clk: fixed-factor: Convert to platform remove callback returning void clk: axm5516: Convert to platform remove callback returning void ... commit 6f7478e3bb2894309ebef08fac91ec896ce667d8 Merge: 4ec6a2f957bfc cb9eee590a773 d54c1fd4a51e8 acc0ccffec502 3dc6faa3ab026 Author: Stephen Boyd Date: Tue Apr 25 11:50:08 2023 -0700 Merge branches 'clk-mediatek', 'clk-sunplus', 'clk-loongson' and 'clk-socfpga' into clk-next - Frequency Hopping (FHCTL) on MediaTek MT6795, MT8173, MT8192 and MT8195 SoCs - Converted most Mediatek clock drivers to struct platform_driver - MediaTek clock drivers can be built as modules - Mediatek MT8188 SoC clk drivers - Clock driver for Sunplus SP7021 SoC - Reimplement Loongson-1 clk driver with DT support - Clk driver support for Loongson-2 SoCs - Migrate socfpga clk driver to of_clk_add_hw_provider() * clk-mediatek: (84 commits) clk: mediatek: fhctl: Mark local variables static clk: mediatek: Use right match table, include mod_devicetable clk: mediatek: Add MT8188 adsp clock support clk: mediatek: Add MT8188 imp i2c wrapper clock support clk: mediatek: Add MT8188 wpesys clock support clk: mediatek: Add MT8188 vppsys1 clock support clk: mediatek: Add MT8188 vppsys0 clock support clk: mediatek: Add MT8188 vencsys clock support clk: mediatek: Add MT8188 vdosys1 clock support clk: mediatek: Add MT8188 vdosys0 clock support clk: mediatek: Add MT8188 vdecsys clock support clk: mediatek: Add MT8188 mfgcfg clock support clk: mediatek: Add MT8188 ipesys clock support clk: mediatek: Add MT8188 imgsys clock support clk: mediatek: Add MT8188 ccusys clock support clk: mediatek: Add MT8188 camsys clock support clk: mediatek: Add MT8188 infrastructure clock support clk: mediatek: Add MT8188 peripheral clock support clk: mediatek: Add MT8188 topckgen clock support clk: mediatek: Add MT8188 apmixedsys clock support ... * clk-sunplus: clk: Add Sunplus SP7021 clock driver * clk-loongson: clk: clk-loongson2: add clock controller driver support dt-bindings: clock: add loongson-2 boot clock index MAINTAINERS: remove obsolete file entry in MIPS/LOONGSON1 ARCHITECTURE MIPS: loongson32: Update the clock initialization clk: loongson1: Re-implement the clock driver clk: loongson1: Remove the outdated driver dt-bindings: clock: Add Loongson-1 clock * clk-socfpga: clk: socfpga: arria10: use of_clk_add_hw_provider and improve error handling clk: socfpga: use of_clk_add_hw_provider and improve error handling clk: socfpga: arria10: use of_clk_add_hw_provider and improve error handling clk: socfpga: use of_clk_add_hw_provider and improve error handling clk: socfpga: arria10: use of_clk_add_hw_provider and improve error handling clk: socfpga: use of_clk_add_hw_provider and improve error handling commit 4ec6a2f957bfc14be69da171f749dab8b7b18be5 Merge: eeac8ede17557 7455b7007b9e9 ced8a02b34522 f1d97a37f975a 6aa252ae88883 edc12763a3a29 Author: Stephen Boyd Date: Tue Apr 25 11:49:50 2023 -0700 Merge branches 'clk-cleanup', 'clk-aspeed', 'clk-dt', 'clk-renesas' and 'clk-skyworks' into clk-next - Support for i3c clks on Aspeed ast2600 SoCs - Clock driver for Skyworks Si521xx I2C PCIe clock generators * clk-cleanup: clk: microchip: fix potential UAF in auxdev release callback clk: sifive: make SiFive clk drivers depend on ARCH_ symbols clk: stm32h7: Remove an unused field in struct stm32_fractional_divider clk: tegra20: fix gcc-7 constant overflow warning clock: milbeaut: use devm_platform_get_and_ioremap_resource() clk: Print an info line before disabling unused clocks clk: ti: Use of_address_to_resource() clk: remove unnecessary (void*) conversions clk: at91: clk-sam9x60-pll: fix return value check clk: visconti: remove unused visconti_pll_provider::regmap * clk-aspeed: dt-bindings: clock: ast2600: Expand comment on reset definitions clk: ast2600: Add comment about combined clock + reset handling dt-bindings: clock: ast2600: remove IC36 & I3C7 clock definitions clk: ast2600: Add full configs for I3C clocks dt-bindings: clock: ast2600: Add top-level I3C clock clk: ast2600: allow empty entries in aspeed_g6_gates * clk-dt: clk: mediatek: clk-pllfh: fix missing of_node_put() in fhctl_parse_dt() clk: Use of_property_present() for testing DT property presence * clk-renesas: clk: renesas: r8a77980: Add I2C5 clock clk: rs9: Add support for 9FGV0441 clk: rs9: Support device specific dif bit calculation dt-bindings: clk: rs9: Add 9FGV0441 clk: rs9: Check for vendor/device ID clk: renesas: Convert to platform remove callback returning void clk: renesas: r9a06g032: Improve clock tables clk: renesas: r9a06g032: Document structs clk: renesas: r9a06g032: Drop unused fields clk: renesas: r9a06g032: Improve readability clk: renesas: r8a77980: Add Z2 clock clk: renesas: r8a77970: Add Z2 clock clk: renesas: r8a77995: Fix VIN parent clock clk: renesas: r8a77980: Add VIN clocks clk: renesas: r8a779g0: Add VIN clocks clk: renesas: r8a779g0: Add ISPCS clocks clk: renesas: r8a779g0: Add CSI-2 clocks clk: renesas: r8a779g0: Add thermal clock clk: renesas: r8a779g0: Add Audio clocks clk: renesas: cpg-mssr: Update MSSR register range for R-Car V4H * clk-skyworks: clk: si521xx: Clock driver for Skyworks Si521xx I2C PCIe clock generators dt-bindings: clk: si521xx: Add Skyworks Si521xx I2C PCIe clock generators commit de10553fce40797313f980301af45e7398e422ca Merge: e7989789c686e 5af507bef93c0 Author: Linus Torvalds Date: Tue Apr 25 11:39:45 2023 -0700 Merge tag 'x86-apic-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 APIC updates from Thomas Gleixner: - Fix the incorrect handling of atomic offset updates in reserve_eilvt_offset() The check for the return value of atomic_cmpxchg() is not compared against the old value, it is compared against the new value, which makes it two round on success. Convert it to atomic_try_cmpxchg() which does the right thing. - Handle IO/APIC less systems correctly When IO/APIC is not advertised by ACPI then the computation of the lower bound for dynamically allocated interrupts like MSI goes wrong. This lower bound is used to exclude the IO/APIC legacy GSI space as that must stay reserved for the legacy interrupts. In case that the system, e.g. VM, does not advertise an IO/APIC the lower bound stays at 0. 0 is an invalid interrupt number except for the legacy timer interrupt on x86. The return value is unchecked in the core code, so it ends up to allocate interrupt number 0 which is subsequently considered to be invalid by the caller, e.g. the MSI allocation code. A similar problem was already cured for device tree based systems years ago, but that missed - or did not envision - the zero IO/APIC case. Consolidate the zero check and return the provided "from" argument to the core code call site, which is guaranteed to be greater than 0. - Simplify the X2APIC cluster CPU mask logic for CPU hotplug Per cluster CPU masks are required for X2APIC in cluster mode to determine the correct cluster for a target CPU when calculating the destination for IPIs These masks are established when CPUs are borught up. The first CPU in a cluster must allocate a new cluster CPU mask. As this happens during the early startup of a CPU, where memory allocations cannot be done, the mask has to be allocated by the control CPU. The current implementation allocates a clustermask just in case and if the to be brought up CPU is the first in a cluster the CPU takes over this allocation from a global pointer. This works nicely in the fully serialized CPU bringup scenario which is used today, but would fail completely for parallel bringup of CPUs. The cluster association of a CPU can be computed from the APIC ID which is enumerated by ACPI/MADT. So the cluster CPU masks can be preallocated and associated upfront and the upcoming CPUs just need to set their corresponding bit. Aside of preparing for parallel bringup this is a valuable simplification on its own. - Remove global variables which control the early startup of secondary CPUs on 64-bit The only information which is needed by a starting CPU is the Linux CPU number. The CPU number allows it to retrieve the rest of the required data from already existing per CPU storage. So instead of initial_stack, early_gdt_desciptor and initial_gs provide a new variable smpboot_control which contains the Linux CPU number for now. The starting CPU can retrieve and compute all required information for startup from there. Aside of being a cleanup, this is also preparing for parallel CPU bringup, where starting CPUs will look up their Linux CPU number via the APIC ID, when smpboot_control has the corresponding control bit set. - Make cc_vendor globally accesible Subsequent parallel bringup changes require access to cc_vendor because confidental computing platforms need special treatment in the early startup phase vs. CPUID and APCI ID readouts. The change makes cc_vendor global and provides stub accessors in case that CONFIG_ARCH_HAS_CC_PLATFORM is not set. This was merged from the x86/cc branch in anticipation of further parallel bringup commits which require access to cc_vendor. Due to late discoveries of fundamental issue with those patches these commits never happened. The merge commit is unfortunately in the middle of the APIC commits so unraveling it would have required a rebase or revert. As the parallel bringup seems to be well on its way for 6.5 this would be just pointless churn. As the commit does not contain any functional change it's not a risk to keep it. * tag 'x86-apic-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() x86/apic: Fix atomic update of offset in reserve_eilvt_offset() x86/coco: Export cc_vendor x86/smpboot: Reference count on smpboot_setup_warm_reset_vector() x86/smpboot: Remove initial_gs x86/smpboot: Remove early_gdt_descr on 64-bit x86/smpboot: Remove initial_stack on 64-bit x86/apic/x2apic: Allow CPU cluster_mask to be populated in parallel commit e7989789c686e83f032acf2c4363c2c153876b96 Merge: 3f614ab563c44 f7abf14f0001a Author: Linus Torvalds Date: Tue Apr 25 11:22:46 2023 -0700 Merge tag 'timers-core-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timers and timekeeping updates from Thomas Gleixner: - Improve the VDSO build time checks to cover all dynamic relocations VDSO does not allow dynamic relocations, but the build time check is incomplete and fragile. It's based on architectures specifying the relocation types to search for and does not handle R_*_NONE relocation entries correctly. R_*_NONE relocations are injected by some GNU ld variants if they fail to determine the exact .rel[a]/dyn_size to cover trailing zeros. R_*_NONE relocations must be ignored by dynamic loaders, so they should be ignored in the build time check too. Remove the architecture specific relocation types to check for and validate strictly that no other relocations than R_*_NONE end up in the VSDO .so file. - Prefer signal delivery to the current thread for CLOCK_PROCESS_CPUTIME_ID based posix-timers Such timers prefer to deliver the signal to the main thread of a process even if the context in which the timer expires is the current task. This has the downside that it might wake up an idle thread. As there is no requirement or guarantee that the signal has to be delivered to the main thread, avoid this by preferring the current task if it is part of the thread group which shares sighand. This not only avoids waking idle threads, it also distributes the signal delivery in case of multiple timers firing in the context of different threads close to each other better. - Align the tick period properly (again) For a long time the tick was starting at CLOCK_MONOTONIC zero, which allowed users space applications to either align with the tick or to place a periodic computation so that it does not interfere with the tick. The alignement of the tick period was more by chance than by intention as the tick is set up before a high resolution clocksource is installed, i.e. timekeeping is still tick based and the tick period advances from there. The early enablement of sched_clock() broke this alignement as the time accumulated by sched_clock() is taken into account when timekeeping is initialized. So the base value now(CLOCK_MONOTONIC) is not longer a multiple of tick periods, which breaks applications which relied on that behaviour. Cure this by aligning the tick starting point to the next multiple of tick periods, i.e 1000ms/CONFIG_HZ. - A set of NOHZ fixes and enhancements: * Cure the concurrent writer race for idle and IO sleeptime statistics The statitic values which are exposed via /proc/stat are updated from the CPU local idle exit and remotely by cpufreq, but that happens without any form of serialization. As a consequence sleeptimes can be accounted twice or worse. Prevent this by restricting the accumulation writeback to the CPU local idle exit and let the remote access compute the accumulated value. * Protect idle/iowait sleep time with a sequence count Reading idle/iowait sleep time, e.g. from /proc/stat, can race with idle exit updates. As a consequence the readout may result in random and potentially going backwards values. Protect this by a sequence count, which fixes the idle time statistics issue, but cannot fix the iowait time problem because iowait time accounting races with remote wake ups decrementing the remote runqueues nr_iowait counter. The latter is impossible to fix, so the only way to deal with that is to document it properly and to remove the assertion in the selftest which triggers occasionally due to that. * Restructure struct tick_sched for better cache layout * Some small cleanups and a better cache layout for struct tick_sched - Implement the missing timer_wait_running() callback for POSIX CPU timers For unknown reason the introduction of the timer_wait_running() callback missed to fixup posix CPU timers, which went unnoticed for almost four years. While initially only targeted to prevent livelocks between a timer deletion and the timer expiry function on PREEMPT_RT enabled kernels, it turned out that fixing this for mainline is not as trivial as just implementing a stub similar to the hrtimer/timer callbacks. The reason is that for CONFIG_POSIX_CPU_TIMERS_TASK_WORK enabled systems there is a livelock issue independent of RT. CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y moves the expiry of POSIX CPU timers out from hard interrupt context to task work, which is handled before returning to user space or to a VM. The expiry mechanism moves the expired timers to a stack local list head with sighand lock held. Once sighand is dropped the task can be preempted and a task which wants to delete a timer will spin-wait until the expiry task is scheduled back in. In the worst case this will end up in a livelock when the preempting task and the expiry task are pinned on the same CPU. The timer wheel has a timer_wait_running() mechanism for RT, which uses a per CPU timer-base expiry lock which is held by the expiry code and the task waiting for the timer function to complete blocks on that lock. This does not work in the same way for posix CPU timers as there is no timer base and expiry for process wide timers can run on any task belonging to that process, but the concept of waiting on an expiry lock can be used too in a slightly different way. Add a per task mutex to struct posix_cputimers_work, let the expiry task hold it accross the expiry function and let the deleting task which waits for the expiry to complete block on the mutex. In the non-contended case this results in an extra mutex_lock()/unlock() pair on both sides. This avoids spin-waiting on a task which is scheduled out, prevents the livelock and cures the problem for RT and !RT systems * tag 'timers-core-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-cpu-timers: Implement the missing timer_wait_running callback selftests/proc: Assert clock_gettime(CLOCK_BOOTTIME) VS /proc/uptime monotonicity selftests/proc: Remove idle time monotonicity assertions MAINTAINERS: Remove stale email address timers/nohz: Remove middle-function __tick_nohz_idle_stop_tick() timers/nohz: Add a comment about broken iowait counter update race timers/nohz: Protect idle/iowait sleep time under seqcount timers/nohz: Only ever update sleeptime from idle exit timers/nohz: Restructure and reshuffle struct tick_sched tick/common: Align tick period with the HZ tick. selftests/timers/posix_timers: Test delivery of signals across threads posix-timers: Prefer delivery of signals to the current thread vdso: Improve cmd_vdso_check to check all dynamic relocations commit 3f614ab563c44fa443cbb6a7f355bdd04a5a4450 Merge: 15bbeec0fe9f1 f37202aa6e5d6 Author: Linus Torvalds Date: Tue Apr 25 11:16:08 2023 -0700 Merge tag 'irq-core-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull interrupt updates from Thomas Gleixner: "Core: - Add tracepoints for tasklet callbacks which makes it possible to analyze individual tasklet functions instead of guess working from the overall duration of tasklet processing - Ensure that secondary interrupt threads have their affinity adjusted correctly Drivers: - A large rework of the RISC-V IPI management to prepare for a new RISC-V interrupt architecture - Small fixes and enhancements all over the place - Removal of support for various obsolete hardware platforms and the related code" * tag 'irq-core-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits) irqchip/st: Remove stih415/stih416 and stid127 platforms support irqchip/gic-v3: Add Rockchip 3588001 erratum workaround genirq: Update affinity of secondary threads softirq: Add trace points for tasklet entry/exit irqchip/loongson-pch-pic: Fix pch_pic_acpi_init calling irqchip/loongson-pch-pic: Fix registration of syscore_ops irqchip/loongson-eiointc: Fix registration of syscore_ops irqchip/loongson-eiointc: Fix incorrect use of acpi_get_vec_parent irqchip/loongson-eiointc: Fix returned value on parsing MADT irqchip/riscv-intc: Add empty irq_eoi() for chained irq handlers RISC-V: Use IPIs for remote icache flush when possible RISC-V: Use IPIs for remote TLB flush when possible RISC-V: Allow marking IPIs as suitable for remote FENCEs RISC-V: Treat IPIs as normal Linux IRQs irqchip/riscv-intc: Allow drivers to directly discover INTC hwnode RISC-V: Clear SIP bit only when using SBI IPI operations irqchip/irq-sifive-plic: Add syscore callbacks for hibernation irqchip: Use of_property_read_bool() for boolean properties irqchip/bcm-6345-l1: Request memory region irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 ... commit 15bbeec0fe9f1e910cb6a173005a02b6b4582f3c Merge: 29e95a4b2686b 8c8fa605f7b8b Author: Linus Torvalds Date: Tue Apr 25 11:05:04 2023 -0700 Merge tag 'core-entry-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core entry/ptrace update from Thomas Gleixner: "Provide a ptrace set/get interface for syscall user dispatch. The main purpose is to enable checkpoint/restore (CRIU) to handle processes which utilize syscall user dispatch correctly" * tag 'core-entry-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftest, ptrace: Add selftest for syscall user dispatch config api ptrace: Provide set/get interface for syscall user dispatch syscall_user_dispatch: Untag selector address before access_ok() syscall_user_dispatch: Split up set_syscall_user_dispatch() commit 29e95a4b2686b2cfb5564b3fb31371d5f71c6b66 Merge: bc1bb2a49bae9 63a759694eed6 Author: Linus Torvalds Date: Tue Apr 25 11:00:45 2023 -0700 Merge tag 'core-debugobjects-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core debugobjects update from Thomas Gleixner: "A single update to debugobjects: Prevent a race vs statically initialized objects. Such objects are usually not initialized via an init() function. They are special cased and detected on first use under the assumption that they are already correctly initialized via the static initializer. This works correctly unless there are two concurrent debug object operations on such an object. The first one detects that the object is not yet tracked and tries to establish a tracking object after dropping the debug objects hash bucket lock. The concurrent operation does the same. The one which wins the race ends up modifying the state of the object which makes the other one fail resulting in a bogus debug objects warning. Prevent this by making the detection of a static object and the allocation of a tracking object atomic under the hash bucket lock. So the first one to acquire the hash bucket lock will succeed and the second one will observe the correct tracking state. This race existed forever but was only exposed when the timer wheel code added a debug_object_assert_init() call outside of the timer base locked region. This replaced the previous warning about timer::function being NULL which had to be removed when the timer_shutdown() mechanics were added" * tag 'core-debugobjects-2023-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobject: Prevent init race with static objects commit bc1bb2a49bae915107fd58705edb1e32db92c635 Merge: c42b59bfaa009 812b0597fb404 Author: Linus Torvalds Date: Tue Apr 25 10:48:08 2023 -0700 Merge tag 'x86_sev_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV updates from Borislav Petkov: - Add the necessary glue so that the kernel can run as a confidential SEV-SNP vTOM guest on Hyper-V. A vTOM guest basically splits the address space in two parts: encrypted and unencrypted. The use case being running unmodified guests on the Hyper-V confidential computing hypervisor - Double-buffer messages between the guest and the hardware PSP device so that no partial buffers are copied back'n'forth and thus potential message integrity and leak attacks are possible - Name the return value the sev-guest driver returns when the hw PSP device hasn't been called, explicitly - Cleanups * tag 'x86_sev_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hyperv: Change vTOM handling to use standard coco mechanisms init: Call mem_encrypt_init() after Hyper-V hypercall init is done x86/mm: Handle decryption/re-encryption of bss_decrypted consistently Drivers: hv: Explicitly request decrypted in vmap_pfn() calls x86/hyperv: Reorder code to facilitate future work x86/ioremap: Add hypervisor callback for private MMIO mapping in coco VM x86/sev: Change snp_guest_issue_request()'s fw_err argument virt/coco/sev-guest: Double-buffer messages crypto: ccp: Get rid of __sev_platform_init_locked()'s local function pointer crypto: ccp - Name -1 return value as SEV_RET_NO_FW_CALL commit c42b59bfaa0091833b6758be772c54ec7183daa5 Merge: 4a4a28fca6966 11af36cb89812 Author: Linus Torvalds Date: Tue Apr 25 10:32:51 2023 -0700 Merge tag 'x86_paravirt_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 paravirt updates from Borislav Petkov: - Convert a couple of paravirt callbacks to asm to prevent '-fzero-call-used-regs' builds from zeroing live registers because paravirt hides the CALLs from the compiler so latter doesn't know there's a CALL in the first place - Merge two paravirt callbacks into one, as their functionality is identical * tag 'x86_paravirt_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/paravirt: Convert simple paravirt functions to asm x86/paravirt: Merge activate_mm() and dup_mmap() callbacks commit 4a4a28fca6966ff2aee7d8313db6defcc8fcf70b Merge: e3420f98f8984 5910f06503aae Author: Linus Torvalds Date: Tue Apr 25 10:27:02 2023 -0700 Merge tag 'x86_misc_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Borislav Petkov: - Add a x86 hw vulnerabilities section to MAINTAINERS so that the folks involved in it can get CCed on patches - Add some more CPUID leafs to the kcpuid tool and extend its functionality to be more useful when grepping for CPUID bits * tag 'x86_misc_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: MAINTAINERS: Add x86 hardware vulnerabilities section tools/x86/kcpuid: Dump the CPUID function in detailed view tools/x86/kcpuid: Update AMD leaf Fn80000001 tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007 commit e3420f98f8984c4ffde72e6a877bccbcc9cad6b6 Merge: 1699dbebf31f0 36168bc061b43 Author: Linus Torvalds Date: Tue Apr 25 10:20:52 2023 -0700 Merge tag 'x86_cpu_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu model updates from Borislav Petkov: - Add Emerald Rapids to the list of Intel models supporting PPIN - Finally use a CPUID bit for split lock detection instead of enumerating every model - Make sure automatic IBRS is set on AMD, even though the AP bringup code does that now by replicating the MSR which contains the switch * tag 'x86_cpu_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Add Xeon Emerald Rapids to list of CPUs that support PPIN x86/split_lock: Enumerate architectural split lock disable bit x86/CPU/AMD: Make sure EFER[AIBRSE] is set commit 1699dbebf31f0b26a8408d24da3c7f3b113f0340 Merge: d3464152e541b 22767544e9763 Author: Linus Torvalds Date: Tue Apr 25 10:05:00 2023 -0700 Merge tag 'x86_acpi_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 ACPI update from Borislav Petkov: - Improve code generation in ACPI's global lock's acquisition function * tag 'x86_acpi_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/ACPI/boot: Improve __acpi_acquire_global_lock commit d3464152e541b08fdc3c60664c01a28f8844a655 Merge: e94ee641f9cef 4c1cdec319b9a Author: Linus Torvalds Date: Tue Apr 25 09:56:33 2023 -0700 Merge tag 'ras_core_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Borislav Petkov: - Just cleanups and fixes this time around: make threshold_ktype const, an objtool fix and use proper size for a bitmap * tag 'ras_core_for_v6.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/MCE/AMD: Use an u64 for bank_map x86/mce: Always inline old MCA stubs x86/MCE/AMD: Make kobj_type structure constant commit e94ee641f9cef2502adfe5e0c264b271420c7ab5 Merge: f7301270a29fb ce8ac91130b96 Author: Linus Torvalds Date: Tue Apr 25 09:44:07 2023 -0700 Merge tag 'edac_updates_for_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - skx_edac: Fix overflow when decoding 32G DIMM ranks - i10nm_edac: Add Sierra Forest support - amd64_edac: Split driver code between legacy and SMCA systems. The final goal is adding support for more hw, like GPUs - The usual minor cleanups and fixes * tag 'edac_updates_for_v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: (25 commits) EDAC/i10nm: Add Intel Sierra Forest server support EDAC/amd64: Fix indentation in umc_determine_edac_cap() EDAC/altera: Remove MODULE_LICENSE in non-module EDAC: Sanitize MODULE_AUTHOR strings EDAC/amd81[13]1: Remove trailing newline from MODULE_AUTHOR EDAC/amd64: Add get_err_info() to pvt->ops EDAC/amd64: Split dump_misc_regs() into dct/umc functions EDAC/amd64: Split init_csrows() into dct/umc functions EDAC/amd64: Split determine_edac_cap() into dct/umc functions EDAC/amd64: Rename f17h_determine_edac_ctl_cap() EDAC/amd64: Split setup_mci_misc_attrs() into dct/umc functions EDAC/amd64: Split ecc_enabled() into dct/umc functions EDAC/amd64: Split read_mc_regs() into dct/umc functions EDAC/amd64: Split determine_memory_type() into dct/umc functions EDAC/amd64: Split read_base_mask() into dct/umc functions EDAC/amd64: Split prep_chip_selects() into dct/umc functions EDAC/amd64: Rework hw_info_{get,put} EDAC/amd64: Merge struct amd64_family_type into struct amd64_pvt EDAC/amd64: Do not discover ECC symbol size for Family 17h and later EDAC/amd64: Drop dbam_to_cs() for Family 17h and later ... commit f7301270a29fb3b5b2f3ab73ef63a208e21f783a Merge: 173ea743bf7a9 aaee8c7f2a17d Author: Linus Torvalds Date: Tue Apr 25 09:37:43 2023 -0700 Merge tag 'm68k-for-v6.4-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - defconfig updates - miscellaneous fixes and improvements * tag 'm68k-for-v6.4-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: kexec: Include m68k: defconfig: Update defconfigs for v6.3-rc1 m68k: Remove obsolete config NO_KERNEL_MSG nubus: Drop noop match function commit cc5f6fa4f6590e3b9eb8d34302ea43af4a3cfed7 Author: Dhruva Gole Date: Mon Apr 24 15:55:46 2023 +0530 spi: bcm63xx: use macro DEFINE_SIMPLE_DEV_PM_OPS Using this macro makes the code more readable. It also inits the members of dev_pm_ops in the following manner without us explicitly needing to: .suspend = bcm63xx_spi_suspend, \ .resume = bcm63xx_spi_resume, \ .freeze = bcm63xx_spi_suspend, \ .thaw = bcm63xx_spi_resume, \ .poweroff = bcm63xx_spi_suspend, \ .restore = bcm63xx_spi_resume Signed-off-by: Dhruva Gole Link: https://lore.kernel.org/r/20230424102546.1604484-1-d-gole@ti.com Signed-off-by: Mark Brown commit 3f89ac587baa0c0460c977d1596e16f950815f05 Author: Chaitanya Kulkarni Date: Mon Apr 24 16:46:28 2023 -0700 block/drivers: remove dead clear of random flag QUEUE_FLAG_ADD_RANDOM is not set before we clear it for "null_blk", "brd", "nbd", "zram", and "bcache" since by default we don't set "QUEUE_FLAG_ADD_RANDOM" to MQ ops. Remove dead clear of QUEUE_FLAG_ADD_RANDOM in above listed drivers. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Sergey Senozhatsky #zram Link: https://lore.kernel.org/r/20230424234628.45544-2-kch@nvidia.com Signed-off-by: Jens Axboe commit 38c8e3dfb2a1be863b7f5aad7755d5e9727da8a5 Author: Ming Lei Date: Tue Apr 25 11:41:54 2023 +0800 block: sync part's ->bd_has_submit_bio with disk's submit_bio() always uses bio->bi_bdev->bd_has_submit_bio to decide if disk's ->submit_bio() is called, and bio->bi_bdev could point to one partition device. So we have to sync part bdev's ->bd_has_submit_bio with disk's. Reported-by: Changhui Zhong Link: https://lore.kernel.org/linux-block/ZEdItaPqif8fp85H@ovpn-8-24.pek2.redhat.com/T/#t Fixes: 9f4107b07b17 ("block: store bdev->bd_disk->fops->submit_bio state in bdev") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230425034154.110099-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit c915d8f5918bea7c3962b09b8884ca128bfd9b0c Author: Jan Kara Date: Mon Apr 24 18:32:19 2023 +0200 inotify: Avoid reporting event with invalid wd When inotify_freeing_mark() races with inotify_handle_inode_event() it can happen that inotify_handle_inode_event() sees that i_mark->wd got already reset to -1 and reports this value to userspace which can confuse the inotify listener. Avoid the problem by validating that wd is sensible (and pretend the mark got removed before the event got generated otherwise). CC: stable@vger.kernel.org Fixes: 7e790dd5fc93 ("inotify: fix error paths in inotify_update_watch") Message-Id: <20230424163219.9250-1-jack@suse.cz> Reported-by: syzbot+4a06d4373fd52f0b2f9c@syzkaller.appspotmail.com Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara commit cbfac7707ba16619006a4fd60faac46303fd2f3e Author: Juergen Gross Date: Fri Dec 16 14:49:18 2022 +0100 xen/blkback: move blkif_get_x86_*_req() into blkback.c There is no need to have the functions blkif_get_x86_32_req() and blkif_get_x86_64_req() in a header file, as they are used in one place only. So move them into the using source file and drop the inline qualifier. While at it fix some style issues, and simplify the code by variable reusing and using min() instead of open coding it. Instead of using barrier() use READ_ONCE() for avoiding multiple reads of nr_segments. Signed-off-by: Juergen Gross Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross commit e7b4c07d4b42676691f3c815f05c1bbf071dc718 Author: Juergen Gross Date: Mon Dec 12 10:37:42 2022 +0100 xen/blkback: simplify free_persistent_gnts() interface The interface of free_persistent_gnts() can be simplified, as there is only a single caller of free_persistent_gnts() and the 2nd and 3rd parameters are easily obtainable via the ring pointer, which is passed as the first parameter anyway. Signed-off-by: Juergen Gross Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross commit 656f3c1d7966ea65f9b51d17db3008ce5dbb4090 Author: Juergen Gross Date: Mon Dec 12 09:43:28 2022 +0100 xen/blkback: remove stale prototype There is no function xen_blkif_purge_persistent(), so remove its prototype from common.h. Signed-off-by: Juergen Gross Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross commit 6935321eccf32555e6f7e6d29f4cccf84a5c1e3a Author: Juergen Gross Date: Mon Dec 12 09:41:34 2022 +0100 xen/blkback: fix white space code style issues Signed-off-by: Juergen Gross Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross commit 644f6bf762fa903f64c59c2ec0f4d0d753527053 Author: Bob Peterson Date: Fri Apr 21 15:07:10 2023 -0400 gfs2: gfs2_ail_empty_gl no log flush on error Before this patch, function gfs2_ail_empty_gl called gfs2_log_flush even in cases where it encountered an error. It should probably skip the log flush and leave the file system in an inconsistent state, letting a subsequent withdraw force the journal to be replayed to reestablish metadata consistency. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit b97e583caa25abf95695cd06d7f9512b484c6c01 Author: Bob Peterson Date: Fri Apr 21 15:07:09 2023 -0400 gfs2: Issue message when revokes cannot be written Before this patch, function gfs2_ail_empty_gl would silently return an error to the caller. This would get silently set into sd_log_error which would cause a withdraw, but there was no indication why the file system was withdrawn. This patch adds a fs_err to log the appropriate error message. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 68ca088dc1cfc4e366811b11ffe2954c6dcebca1 Author: Bob Peterson Date: Fri Apr 21 15:07:08 2023 -0400 gfs2: Perform second log flush in gfs2_make_fs_ro Before this patch, function gfs2_make_fs_ro called gfs2_log_flush once to finalize the log. However, if there's dirty metadata, log flushes tend to sync the metadata and formulate revokes. Before this patch, those revokes may not be written out to the journal immediately, which meant unresolved glocks could still have revokes in their ail lists. When the glock worker runs, it tries to transition the glock, but the unresolved revokes in the ail still need to be written, so it tries to start a transaction. It's impossible to start a transaction because at that point, the SDF_JOURNAL_LIVE flag has been cleared by gfs2_make_fs_ro. That causes the glock worker to fail, unable to write the revokes. The calling sequence looked something like this: gfs2_make_fs_ro gfs2_log_flush - with GFS2_LOG_HEAD_FLUSH_SHUTDOWN flag set if (flags & GFS2_LOG_HEAD_FLUSH_SHUTDOWN) clear_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); ...meanwhile... glock_work_func do_xmote rgrp_go_sync (or possibly inode_go_sync) ... gfs2_ail_empty_gl __gfs2_trans_begin if (unlikely(!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))) { ... return -EROFS; The previous patch in the series ("gfs2: return errors from gfs2_ail_empty_gl") now causes the transaction error to no longer be ignored, so it causes a warning from MOST of the xfstests: WARNING: CPU: 11 PID: X at fs/gfs2/super.c:603 gfs2_put_super [gfs2] which corresponds to: WARN_ON(gfs2_withdrawing(sdp)); The withdraw was triggered silently from do_xmote by: if (unlikely(sdp->sd_log_error && !gfs2_withdrawn(sdp))) gfs2_withdraw_delayed(sdp); This patch adds a second log_flush to gfs2_make_fs_ro: one to sync the data and one to sync any outstanding revokes and finalize the journal. Note that both of these log flushes need to be "special," in other words, not GFS2_LOG_HEAD_FLUSH_NORMAL. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 24ab15829867a9cc09dfd16f41ed75aa8272a45f Author: Bob Peterson Date: Fri Apr 21 15:07:07 2023 -0400 gfs2: return errors from gfs2_ail_empty_gl Before this patch, function gfs2_ail_empty_gl did not return errors it encountered from __gfs2_trans_begin. Those errors usually came from the fact that the file system was made read-only, often due to unmount (but theoretically could be due to -o remount,ro), which prevented the transaction from starting. The inability to start a transaction prevented its revokes from being properly written to the journal for glocks during unmount (and transition to ro). That meant glocks could be unlocked without the metadata properly revoked in the journal. So other nodes could grab the glock thinking that their lvb values were correct, but in fact corresponded to the glock without its revokes properly synced. That presented as lvb mismatch errors. This patch allows gfs2_ail_empty_gl to return the error properly to the caller. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 37386669887d3f2ccf021322c5558353d20f2387 Author: Basavaraj Natikar Date: Mon Apr 24 21:34:06 2023 +0530 HID: amd_sfh: Fix max supported HID devices commit 4bd763568dbd ("HID: amd_sfh: Support for additional light sensor") adds additional sensor devices, but forgets to add the number of HID devices to match. Thus, the number of HID devices does not match the actual number of sensors. In order to prevent corruption and system hangs when more than the allowed number of HID devices are accessed, the number of HID devices is increased accordingly. Fixes: 4bd763568dbd ("HID: amd_sfh: Support for additional light sensor") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217354 Signed-off-by: Basavaraj Natikar Link: https://lore.kernel.org/r/20230424160406.2579888-1-Basavaraj.Natikar@amd.com Signed-off-by: Benjamin Tissoires commit 28b17f6270f182e22cdad5a0fdc4979031e4486a Author: wuych Date: Tue Apr 25 13:15:32 2023 +0800 net: phy: marvell-88x2222: remove unnecessary (void*) conversions Pointer variables of void * type do not require type cast. Signed-off-by: wuych Signed-off-by: David S. Miller commit 50749f2dd6854a41830996ad302aef2ffaf011d8 Author: Kuniyuki Iwashima Date: Mon Apr 24 15:20:22 2023 -0700 tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY skbs. We can reproduce the problem with these sequences: sk = socket(AF_INET, SOCK_DGRAM, 0) sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE) sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1) sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53)) sk.close() sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct ubuf_info_msgzc indirectly holds a refcnt of the socket. When the skb is sent, __skb_tstamp_tx() clones it and puts the clone into the socket's error queue with the TX timestamp. When the original skb is received locally, skb_copy_ubufs() calls skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt. This additional count is decremented while freeing the skb, but struct ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is not called. The last refcnt is not released unless we retrieve the TX timestamped skb by recvmsg(). Since we clear the error queue in inet_sock_destruct() after the socket's refcnt reaches 0, there is a circular dependency. If we close() the socket holding such skbs, we never call sock_put() and leak the count, sk, and skb. TCP has the same problem, and commit e0c8bccd40fc ("net: stream: purge sk_error_queue in sk_stream_kill_queues()") tried to fix it by calling skb_queue_purge() during close(). However, there is a small chance that skb queued in a qdisc or device could be put into the error queue after the skb_queue_purge() call. In __skb_tstamp_tx(), the cloned skb should not have a reference to the ubuf to remove the circular dependency, but skb_clone() does not call skb_copy_ubufs() for zerocopy skb. So, we need to call skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs(). [0]: BUG: memory leak unreferenced object 0xffff88800c6d2d00 (size 1152): comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................ 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024 [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083 [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline] [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245 [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515 [<00000000b9b11231>] sock_create net/socket.c:1566 [inline] [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline] [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline] [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636 [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline] [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline] [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd BUG: memory leak unreferenced object 0xffff888017633a00 (size 240): comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m..... backtrace: [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497 [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline] [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596 [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline] [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370 [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037 [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652 [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253 [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819 [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline] [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734 [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117 [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline] [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline] [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125 [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY") Fixes: b5947e5d1e71 ("udp: msg_zerocopy") Reported-by: syzbot Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb Author: Gencen Gan Date: Mon Apr 24 23:28:01 2023 +0800 net: amd: Fix link leak when verifying config failed After failing to verify configuration, it returns directly without releasing link, which may cause memory leak. Paolo Abeni thinks that the whole code of this driver is quite "suboptimal" and looks unmainatained since at least ~15y, so he suggests that we could simply remove the whole driver, please take it into consideration. Simon Horman suggests that the fix label should be set to "Linux-2.6.12-rc2" considering that the problem has existed since the driver was introduced and the commit above doesn't seem to exist in net/net-next. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Gan Gecen Reviewed-by: Dongliang Mu Signed-off-by: David S. Miller commit 5fc46f94219d1d103ffb5f0832be9da674d85a73 Author: Martin Willi Date: Tue Apr 25 09:46:18 2023 +0200 Revert "Fix XFRM-I support for nested ESP tunnels" This reverts commit b0355dbbf13c0052931dd14c38c789efed64d3de. The reverted commit clears the secpath on packets received via xfrm interfaces to support nested IPsec tunnels. This breaks Netfilter policy matching using xt_policy in the FORWARD chain, as the secpath is missing during forwarding. Additionally, Benedict Wong reports that it breaks Transport-in-Tunnel mode. Fix this regression by reverting the commit until we have a better approach for nested IPsec tunnels. Fixes: b0355dbbf13c ("Fix XFRM-I support for nested ESP tunnels") Link: https://lore.kernel.org/netdev/20230412085615.124791-1-martin@strongswan.org/ Signed-off-by: Martin Willi Signed-off-by: Steffen Klassert commit 73b41dc51fbeffa4a216b20193274cfe92b5d95b Author: Sakari Ailus Date: Wed Mar 29 15:57:50 2023 +0100 media: ov5670: Fix probe on ACPI devm_clk_get() will return either an error or NULL, which the driver handles, continuing to use the clock of reading the value of the clock-frequency property. However, the value of ov5670->xvclk is left as-is and the other clock framework functions aren't capable of handling error values. Use devm_clk_get_optional() to obtain NULL instead of -ENOENT. Fixes: 8004c91e2095 ("media: i2c: ov5670: Use common clock framework") Signed-off-by: Sakari Ailus Reviewed-by: Jacopo Mondi Signed-off-by: Mauro Carvalho Chehab commit e5c23bec0f121b4160dc8ca61e751e734652bd05 Author: Geert Uytterhoeven Date: Thu Mar 23 11:22:59 2023 +0100 sh: Replace by As arch/sh/include/uapi/asm/types.h doesn't exist, sh doesn't provide any sh-specific uapi definitions, and it can just include , like most other architectures. Signed-off-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/26932016c83c2ad350db59f5daf96117a38bbbd8.1679566927.git.geert@linux-m68k.org Signed-off-by: John Paul Adrian Glaubitz commit 8bc6666f13fe1971cb870e5e0c3082435e3caa9c Author: Geert Uytterhoeven Date: Thu Mar 23 11:18:07 2023 +0100 sh: Use generic GCC library routines The C implementations of __ashldi3(), __ashrdi3__(), and __lshrdi3() in arch/sh/lib/ are identical to the generic C implementations in lib/. Reduce duplication by switching SH to the generic versions. Update the include path in arch/sh/boot/compressed accordingly. Signed-off-by: Geert Uytterhoeven Acked-by: Palmer Dabbelt Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/74dbe68dc8e2ffb6180092f73723fe21ab692c7a.1679566500.git.geert+renesas@glider.be Signed-off-by: John Paul Adrian Glaubitz commit c5749639f2d0a1f6cbe187d05f70c2e7c544d748 Author: Zheng Wang Date: Thu Apr 13 11:34:22 2023 +0800 scsi: qedi: Fix use after free bug in qedi_remove() In qedi_probe() we call __qedi_probe() which initializes &qedi->recovery_work with qedi_recovery_handler() and &qedi->board_disable_work with qedi_board_disable_work(). When qedi_schedule_recovery_handler() is called, schedule_delayed_work() will finally start the work. In qedi_remove(), which is called to remove the driver, the following sequence may be observed: Fix this by finishing the work before cleanup in qedi_remove(). CPU0 CPU1 |qedi_recovery_handler qedi_remove | __qedi_remove | iscsi_host_free | scsi_host_put | //free shost | |iscsi_host_for_each_session |//use qedi->shost Cancel recovery_work and board_disable_work in __qedi_remove(). Fixes: 4b1068f5d74b ("scsi: qedi: Add MFW error recovery process") Signed-off-by: Zheng Wang Link: https://lore.kernel.org/r/20230413033422.28003-1-zyytlz.wz@163.com Acked-by: Manish Rangankar Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit 948afc69615167a3c82430f99bfd046332b89912 Author: Alice Chao Date: Mon Apr 24 16:03:56 2023 +0800 scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue When ufshcd_err_handler() is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcd_handle_mcq_cq_events() and also in ufs_mtk_mcq_intr(). The following warning message will be generated when &hwq->cq_lock is used in IRQ context with IRQ enabled. Use ufshcd_mcq_poll_cqe_lock() with spin_lock_irqsave instead of spin_lock to resolve the deadlock issue. [name:lockdep&]WARNING: inconsistent lock state [name:lockdep&]-------------------------------- [name:lockdep&]inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [name:lockdep&]kworker/u16:4/260 [HC0[0]:SC0[0]:HE1:SE1] takes: ffffff8028444600 (&hwq->cq_lock){?.-.}-{2:2}, at: ufshcd_mcq_poll_cqe_lock+0x30/0xe0 [name:lockdep&]{IN-HARDIRQ-W} state was registered at: lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufs_mtk_mcq_intr+0x60/0x1bc [ufs_mediatek_mod] __handle_irq_event_percpu+0x140/0x3ec handle_irq_event+0x50/0xd8 handle_fasteoi_irq+0x148/0x2b0 generic_handle_domain_irq+0x4c/0x6c gic_handle_irq+0x58/0x134 call_on_irq_stack+0x40/0x74 do_interrupt_handler+0x84/0xe4 el1_interrupt+0x3c/0x78 Possible unsafe locking scenario: CPU0 ---- lock(&hwq->cq_lock); lock(&hwq->cq_lock); *** DEADLOCK *** 2 locks held by kworker/u16:4/260: [name:lockdep&] stack backtrace: CPU: 7 PID: 260 Comm: kworker/u16:4 Tainted: G S W OE 6.1.17-mainline-android14-2-g277223301adb #1 Workqueue: ufs_eh_wq_0 ufshcd_err_handler Call trace: dump_backtrace+0x10c/0x160 show_stack+0x20/0x30 dump_stack_lvl+0x98/0xd8 dump_stack+0x20/0x60 print_usage_bug+0x584/0x76c mark_lock_irq+0x488/0x510 mark_lock+0x1ec/0x25c __lock_acquire+0x4d8/0xffc lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufshcd_poll+0x68/0x1b0 ufshcd_transfer_req_compl+0x9c/0xc8 ufshcd_err_handler+0x3bc/0xea0 process_one_work+0x2f4/0x7e8 worker_thread+0x234/0x450 kthread+0x110/0x134 ret_from_fork+0x10/0x20 Fixes: ed975065c31c ("scsi: ufs: core: mcq: Add completion support in poll") Reviewed-by: Can Guo Reviewed-by: Stanley Chu Signed-off-by: Alice Chao Link: https://lore.kernel.org/r/20230424080400.8955-1-alice.chao@mediatek.com Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 392e4daa8a7e3d9b103c64acef08f62f19d421aa Author: Tom Rix Date: Thu Apr 20 08:50:35 2023 -0400 scsi: ipr: Remove several unused variables gcc with W=1 reports drivers/scsi/ipr.c: In function ‘ipr_init_res_entry’: drivers/scsi/ipr.c:1104:22: error: variable ‘proto’ set but not used [-Werror=unused-but-set-variable] 1104 | unsigned int proto; | ^~~~~ drivers/scsi/ipr.c: In function ‘ipr_update_res_entry’: drivers/scsi/ipr.c:1261:22: error: variable ‘proto’ set but not used [-Werror=unused-but-set-variable] 1261 | unsigned int proto; | ^~~~~ drivers/scsi/ipr.c: In function ‘ipr_change_queue_depth’: drivers/scsi/ipr.c:4417:36: error: variable ‘res’ set but not used [-Werror=unused-but-set-variable] 4417 | struct ipr_resource_entry *res; | ^~~ These variables are not used, so remove them. The lock around res is not needed so remove that. This makes ioa_cfg and lock_flags unneeded so remove them as well. Fixes: 65a15d6560df ("scsi: ipr: Remove SATA support") Signed-off-by: Tom Rix Link: https://lore.kernel.org/r/20230420125035.3888188-1-trix@redhat.com Acked-by: Brian King Signed-off-by: Martin K. Petersen commit 81221ab76490622952f1df2a45c41d6ffb10b303 Author: Akshat Jain Date: Tue Apr 11 23:06:50 2023 +0000 scsi: pm80xx: Log device registration Log combination of phy_id and device_id in device registration response. Signed-off-by: Akshat Jain Signed-off-by: Pranav Prasad Link: https://lore.kernel.org/r/20230411230650.1760757-1-pranavpp@google.com Acked-by: Jack Wang Signed-off-by: Martin K. Petersen commit 173ea743bf7a9eef04460e03b00ba267cc52aee2 Merge: 181b69dd6e612 eb2317b13b188 Author: Linus Torvalds Date: Mon Apr 24 19:43:32 2023 -0700 Merge tag 'pull-nios2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull trivial nios2 cleanup from Al Viro. * tag 'pull-nios2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: nios2: _TIF_ALLWORK_MASK is unused commit 181b69dd6e61235b04742b473c23b00b731f62c3 Merge: 11b32219cba46 73bb5a9017b93 Author: Linus Torvalds Date: Mon Apr 24 19:38:34 2023 -0700 Merge tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs pile from Al Viro. Random minor cleanups. * tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: Fix description of vfs_tmpfile() sysv: switch to put_and_unmap_page() fs/sysv: Don't round down address for kunmap_flush_on_unmap() commit 11b32219cba462b1e12cfd91069ba82574bc2dcc Merge: 0e497ad525506 0aaf08de8426f Author: Linus Torvalds Date: Mon Apr 24 19:28:49 2023 -0700 Merge tag 'pull-old-dio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull legacy dio cleanup from Al Viro. * tag 'pull-old-dio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: __blockdev_direct_IO(): get rid of submit_io callback commit 0e497ad5255069b2d394168568790d26bbc8d365 Merge: ef36b9afc2edb 2d68317582717 Author: Linus Torvalds Date: Mon Apr 24 19:20:27 2023 -0700 Merge tag 'pull-write-one-page' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs write_one_page removal from Al Viro: "write_one_page series" * tag 'pull-write-one-page' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: mm,jfs: move write_one_page/folio_write_one to jfs ocfs2: don't use write_one_page in ocfs2_duplicate_clusters_by_page ufs: don't flush page immediately for DIRSYNC directories commit ef36b9afc2edb0764cb3df7a1cb5e86406267b40 Merge: 61d325dcbc05d 4a892c0fe4bb0 Author: Linus Torvalds Date: Mon Apr 24 19:14:20 2023 -0700 Merge tag 'pull-fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fget updates from Al Viro: "fget() to fdget() conversions" * tag 'pull-fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fuse_dev_ioctl(): switch to fdget() cgroup_get_from_fd(): switch to fdget_raw() bpf: switch to fdget_raw() build_mount_idmapped(): switch to fdget() kill the last remaining user of proc_ns_fget() SVM-SEV: convert the rest of fget() uses to fdget() in there convert sgx_set_attribute() to fdget()/fdput() convert setns(2) to fdget()/fdput() commit 4774ad841bef97cc51df90195338c5b2573dd4cb Author: Christian Marangi Date: Sun Apr 23 19:28:00 2023 +0200 net: phy: marvell: Fix inconsistent indenting in led_blink_set Fix inconsistent indeinting in m88e1318_led_blink_set reported by kernel test robot, probably done by the presence of an if condition dropped in later revision of the same code. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304240007.0VEX8QYG-lkp@intel.com/ Fixes: ea9e86485dec ("net: phy: marvell: Implement led_blink_set()") Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230423172800.3470-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 700f11eb2cbea349bda2599b4b676b49d43b4175 Author: Horatiu Vultur Date: Sat Apr 22 16:23:44 2023 +0200 lan966x: Don't use xdp_frame when action is XDP_TX When the action of an xdp program was XDP_TX, lan966x was creating a xdp_frame and use this one to send the frame back. But it is also possible to send back the frame without needing a xdp_frame, because it is possible to send it back using the page. And then once the frame is transmitted is possible to use directly page_pool_recycle_direct as lan966x is using page pools. This would save some CPU usage on this path, which results in higher number of transmitted frames. Bellow are the statistics: Frame size: Improvement: 64 ~8% 256 ~11% 512 ~8% 1000 ~0% 1500 ~0% Signed-off-by: Horatiu Vultur Reviewed-by: Alexander Lobakin Link: https://lore.kernel.org/r/20230422142344.3630602-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit ee3392ed16b064594a14ce5886e412efb05ed17b Merge: 9610a8dc0aaaf be7dbd275dc6b Author: Jakub Kicinski Date: Mon Apr 24 18:45:11 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Alexei Starovoitov says: ==================== pull-request: bpf-next 2023-04-24 We've added 5 non-merge commits during the last 3 day(s) which contain a total of 7 files changed, 87 insertions(+), 44 deletions(-). The main changes are: 1) Workaround for bpf iter selftest due to lack of subprog support in precision tracking, from Andrii. 2) Disable bpf_refcount_acquire kfunc until races are fixed, from Dave. 3) One more test_verifier test converted from asm macro to asm in C, from Eduard. 4) Fix build with NETFILTER=y INET=n config, from Florian. 5) Add __rcu_read_{lock,unlock} into deny list, from Yafang. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: selftests/bpf: avoid mark_all_scalars_precise() trigger in one of iter tests bpf: Add __rcu_read_{lock,unlock} into btf id deny list bpf: Disable bpf_refcount_acquire kfunc calls until race conditions are fixed selftests/bpf: verifier/prevent_map_lookup converted to inline assembly bpf: fix link failure with NETFILTER=y INET=n ==================== Link: https://lore.kernel.org/r/20230425005648.86714-1-alexei.starovoitov@gmail.com Signed-off-by: Jakub Kicinski commit 9610a8dc0aaaf146630ff5566b5d8804fcd22d15 Merge: 938f65adc4202 cd275c236b3f3 Author: Jakub Kicinski Date: Mon Apr 24 18:22:39 2023 -0700 Merge branch 'tsnep-xdp-socket-zero-copy-support' Gerhard Engleder says: ==================== tsnep: XDP socket zero-copy support Implement XDP socket zero-copy support for tsnep driver. I tried to follow existing drivers like igc as far as possible. But one main difference is that tsnep does not need any reconfiguration for XDP BPF program setup. So I decided to keep this behavior no matter if a XSK pool is used or not. As a result, tsnep starts using the XSK pool even if no XDP BPF program is available. Another difference is that I tried to prevent potentially failing allocations during XSK pool setup. E.g. both memory models for page pool and XSK pool are registered all the time. Thus, XSK pool setup cannot end up with not working queues. Some prework is done to reduce the last two XSK commits to actual XSK changes. ==================== Link: https://lore.kernel.org/r/20230421194656.48063-1-gerhard@engleder-embedded.com Signed-off-by: Jakub Kicinski commit cd275c236b3f342cb7d9437ef5adcdeaf42fdd2c Author: Gerhard Engleder Date: Fri Apr 21 21:46:56 2023 +0200 tsnep: Add XDP socket zero-copy TX support Send and complete XSK pool frames within TX NAPI context. NAPI context is triggered by ndo_xsk_wakeup. Test results with A53 1.2GHz: xdpsock txonly copy mode, 64 byte frames: pps pkts 1.00 tx 284,409 11,398,144 Two CPUs with 100% and 10% utilization. xdpsock txonly zero-copy mode, 64 byte frames: pps pkts 1.00 tx 511,929 5,890,368 Two CPUs with 100% and 1% utilization. xdpsock l2fwd copy mode, 64 byte frames: pps pkts 1.00 rx 248,985 7,315,885 tx 248,921 7,315,885 Two CPUs with 100% and 10% utilization. xdpsock l2fwd zero-copy mode, 64 byte frames: pps pkts 1.00 rx 254,735 3,039,456 tx 254,735 3,039,456 Two CPUs with 100% and 4% utilization. Packet rate increases and CPU utilization is reduced in both cases. Signed-off-by: Gerhard Engleder Reviewed-by: Maciej Fijalkowski Signed-off-by: Jakub Kicinski commit 3fc2333933fdf1148b694d15db824e10449ecbc1 Author: Gerhard Engleder Date: Fri Apr 21 21:46:55 2023 +0200 tsnep: Add XDP socket zero-copy RX support Add support for XSK zero-copy to RX path. The setup of the XSK pool can be done at runtime. If the netdev is running, then the queue must be disabled and enabled during reconfiguration. This can be done easily with functions introduced in previous commits. A more important property is that, if the netdev is running, then the setup of the XSK pool shall not stop the netdev in case of errors. A broken netdev after a failed XSK pool setup is bad behavior. Therefore, the allocation and setup of resources during XSK pool setup is done only before any queue is disabled. Additionally, freeing and later allocation of resources is eliminated in some cases. Page pool entries are kept for later use. Two memory models are registered in parallel. As a result, the XSK pool setup cannot fail during queue reconfiguration. In contrast to other drivers, XSK pool setup and XDP BPF program setup are separate actions. XSK pool setup can be done without any XDP BPF program. The XDP BPF program can be added, removed or changed without any reconfiguration of the XSK pool. Test results with A53 1.2GHz: xdpsock rxdrop copy mode, 64 byte frames: pps pkts 1.00 rx 856,054 10,625,775 Two CPUs with both 100% utilization. xdpsock rxdrop zero-copy mode, 64 byte frames: pps pkts 1.00 rx 889,388 4,615,284 Two CPUs with 100% and 20% utilization. Packet rate increases and CPU utilization is reduced. 100% CPU load seems to the base load. This load is consumed by ksoftirqd just for dropping the generated packets without xdpsock running. Using batch API reduced CPU utilization slightly, but measurements are not stable enough to provide meaningful numbers. Signed-off-by: Gerhard Engleder Reviewed-by: Maciej Fijalkowski Signed-off-by: Jakub Kicinski commit c2d64697f41b0c188690f4f5841045ed86243134 Author: Gerhard Engleder Date: Fri Apr 21 21:46:54 2023 +0200 tsnep: Move skb receive action to separate function The function tsnep_rx_poll() is already pretty long and the skb receive action can be reused for XSK zero-copy support. Move page based skb receive to separate function. Signed-off-by: Gerhard Engleder Reviewed-by: Maciej Fijalkowski Signed-off-by: Jakub Kicinski commit 2ea0a282ba09d29915f1d59b22c38207b5c7ed62 Author: Gerhard Engleder Date: Fri Apr 21 21:46:53 2023 +0200 tsnep: Add functions for queue enable/disable Move queue enable and disable code to separate functions. This way the activation and deactivation of the queues are defined actions, which can be used in future execution paths. This functions will be used for the queue reconfiguration at runtime, which is necessary for XSK zero-copy support. Signed-off-by: Gerhard Engleder Reviewed-by: Maciej Fijalkowski Signed-off-by: Jakub Kicinski commit 33b0ee02c84c962a9701107be5683f7a600ebffd Author: Gerhard Engleder Date: Fri Apr 21 21:46:52 2023 +0200 tsnep: Rework TX/RX queue initialization Make initialization of TX and RX queues less dynamic by moving some initialization from netdev open/close to device probing. Additionally, move some initialization code to separate functions to enable future use in other execution paths. This is done as preparation for queue reconfigure at runtime, which is necessary for XSK zero-copy support. Signed-off-by: Gerhard Engleder Reviewed-by: Maciej Fijalkowski Signed-off-by: Jakub Kicinski commit 42fb2962b4a6f8b46aa1c141748319e01d0c7c39 Author: Gerhard Engleder Date: Fri Apr 21 21:46:51 2023 +0200 tsnep: Replace modulo operation with mask TX/RX ring size is static and power of 2 to enable compiler to optimize modulo operation to mask operation. Make this optimization already in the code and don't rely on the compiler. CPU utilisation during high packet rate has not changed. So no performance improvement has been measured. But it is best practice to prevent modulo operations. Suggested-by: Maciej Fijalkowski Signed-off-by: Gerhard Engleder Reviewed-by: Maciej Fijalkowski Signed-off-by: Jakub Kicinski commit 938f65adc4202da8ed3c85ef5a40dd3b8ee328d9 Author: Alexander Stein Date: Mon Apr 24 15:46:25 2023 +0200 net: phy: dp83867: Add led_brightness_set support Up to 4 LEDs can be attached to the PHY, add support for setting brightness manually. Signed-off-by: Alexander Stein Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230424134625.303957-1-alexander.stein@ew.tq-group.com Signed-off-by: Jakub Kicinski commit aed8fdad2152d946add50bec00a6b07c457bdcdf Author: Alexander Stein Date: Mon Apr 24 16:16:48 2023 +0200 net: phy: Fix reading LED reg property 'reg' is always encoded in 32 bits, thus it has to be read using the function with the corresponding bit width. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Signed-off-by: Alexander Stein Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230424141648.317944-1-alexander.stein@ew.tq-group.com Signed-off-by: Jakub Kicinski commit e515c330d7e22692d03475740fa45d179281cdf7 Author: Jianuo Kuang Date: Mon Apr 24 10:41:40 2023 +0800 drivers: nfc: nfcsim: remove return value check of `dev_dir` Smatch complains that: nfcsim_debugfs_init_dev() warn: 'dev_dir' is an error pointer or valid According to the documentation of the debugfs_create_dir() function, there is no need to check the return value of this function. Just delete the dead code. Signed-off-by: Jianuo Kuang Reviewed-by: Dongliang Mu Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230424024140.34607-1-u202110722@hust.edu.cn Signed-off-by: Jakub Kicinski commit 86c2b51f203ec89adc18492a46343472055fd3c8 Author: wuych Date: Mon Apr 24 18:15:50 2023 +0800 net: phy: dp83867: Remove unnecessary (void*) conversions Pointer variables of void * type do not require type cast. Signed-off-by: wuych Reviewed-by: Leon Romanovsky Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230424101550.664319-1-yunchuan@nfschina.com Signed-off-by: Jakub Kicinski commit 00d0f31a1ec8eb3e4d692bdf2455daf0fb865bb3 Author: Jakub Kicinski Date: Thu Apr 20 16:33:02 2023 -0700 net: ethtool: coalesce: try to make user settings stick twice SET_COALESCE may change operation mode and parameters in one call. Changing operation mode may cause the driver to reset the parameter values to what is a reasonable default for new operation mode. Since driver does not know which parameters come from user and which are echoed back from ->get, driver may ignore the parameters when switching operation modes. This used to be inevitable for ioctl() but in netlink we know which parameters are actually specified by the user. We could inform which parameters were set by the user but this would lead to a lot of code duplication in the drivers. Instead try to call the drivers twice if both mode and params are changed. The set method already checks if any params need updating so in case the driver did the right thing the first time around - there will be no second call to it's ->set method (only an extra call to ->get()). For mlx5 for example before this patch we'd see: # ethtool -C eth0 adaptive-rx on adaptive-tx on # ethtool -C eth0 adaptive-rx off adaptive-tx off \ tx-usecs 123 rx-usecs 123 Adaptive RX: off TX: off rx-usecs: 3 rx-frames: 32 tx-usecs: 16 tx-frames: 32 [...] After the change: # ethtool -C eth0 adaptive-rx on adaptive-tx on # ethtool -C eth0 adaptive-rx off adaptive-tx off \ tx-usecs 123 rx-usecs 123 Adaptive RX: off TX: off rx-usecs: 123 rx-frames: 32 tx-usecs: 123 tx-frames: 32 [...] This only works for netlink, so it's a small discrepancy between netlink and ioctl(). Since we anticipate most users to move to netlink I believe it's worth making their lives easier. Link: https://lore.kernel.org/r/20230420233302.944382-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c90b3bbff2a097f4b6861c6d1aac18ed66f15261 Author: Masahiro Yamada Date: Mon Apr 17 23:35:35 2023 +0900 kbuild: rpm-pkg: remove kernel-drm PROVIDES This code was added more than 20 years ago. [1] I checked the kernel spec files in Fedora and OpenSUSE, but did not see 'kernel-drm'. I do not know if there exists a distro that uses it in RPM dependency. Remove this, and let's see if somebody complains about it. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/?id=6d956df7d6b716b28c910c4f5b360c4d44d96c4d Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit 086c161678b8cc291aa21ff8ef2b53df83ee44aa Merge: 8e8e47d9e84ff df18f2da302f1 Author: Jakub Kicinski Date: Mon Apr 24 18:08:54 2023 -0700 Merge branch 'update-coding-style-and-check-alloc_frag' Haiyang Zhang says: ==================== Update coding style and check alloc_frag Follow up patches for the jumbo frame support. As suggested by Jakub Kicinski, update coding style, and check napi_alloc_frag for possible fallback to single pages. ==================== Link: https://lore.kernel.org/r/1682096818-30056-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Jakub Kicinski commit df18f2da302f169e1a29098c6ca3b474f1b0269e Author: Haiyang Zhang Date: Fri Apr 21 10:06:58 2023 -0700 net: mana: Check if netdev/napi_alloc_frag returns single page netdev/napi_alloc_frag() may fall back to single page which is smaller than the requested size. Add error checking to avoid memory overwritten. Signed-off-by: Haiyang Zhang Signed-off-by: Jakub Kicinski commit 5c74064f43c291d9add2b436a2d70205b71a7cc7 Author: Haiyang Zhang Date: Fri Apr 21 10:06:57 2023 -0700 net: mana: Rename mana_refill_rxoob and remove some empty lines Rename mana_refill_rxoob for naming consistency. And remove some empty lines between function call and error checking. Signed-off-by: Haiyang Zhang Signed-off-by: Jakub Kicinski commit 8e8e47d9e84ff9a6f1072177bd7ec1d2f12f4d5c Merge: ffcddcaed6e06 4fc418053ec7b Author: Jakub Kicinski Date: Mon Apr 24 18:07:09 2023 -0700 Merge branch 'add-page_pool-support-for-page-recycling-in-veth-driver' Lorenzo Bianconi says: ==================== add page_pool support for page recycling in veth driver Introduce page_pool support in veth driver in order to recycle pages in veth_convert_skb_to_xdp_buff routine and avoid reallocating the skb through the page allocator when we run a xdp program on the device and we receive skbs from the stack. ==================== Link: https://lore.kernel.org/r/cover.1682188837.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 4fc418053ec7b839d98533d0d4ee83e11ffbaf53 Author: Lorenzo Bianconi Date: Sat Apr 22 20:54:33 2023 +0200 net: veth: add page_pool stats Introduce page_pool stats support to report info about local page_pool through ethtool Tested-by: Maryam Tahhan Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit 0ebab78cbcbfd698d40bd307b68337bdf1b47e9b Author: Lorenzo Bianconi Date: Sat Apr 22 20:54:32 2023 +0200 net: veth: add page_pool for page recycling Introduce page_pool support in veth driver in order to recycle pages in veth_convert_skb_to_xdp_buff routine and avoid reallocating the skb through the page allocator. The patch has been tested sending tcp traffic to a veth pair where the remote peer is running a simple xdp program just returning xdp_pass: veth upstream codebase: MTU 1500B: ~ 8Gbps MTU 8000B: ~ 13.9Gbps veth upstream codebase + pp support: MTU 1500B: ~ 9.2Gbps MTU 8000B: ~ 16.2Gbps Tested-by: Maryam Tahhan Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 Author: Kuniyuki Iwashima Date: Fri Apr 21 11:52:55 2023 -0700 netlink: Use copy_to_user() for optval in netlink_getsockopt(). Brad Spencer provided a detailed report [0] that when calling getsockopt() for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such options require at least sizeof(int) as length. The options return a flag value that fits into 1 byte, but such behaviour confuses users who do not initialise the variable before calling getsockopt() and do not strictly check the returned value as char. Currently, netlink_getsockopt() uses put_user() to copy data to optlen and optval, but put_user() casts the data based on the pointer, char *optval. As a result, only 1 byte is set to optval. To avoid this behaviour, we need to use copy_to_user() or cast optval for put_user(). Note that this changes the behaviour on big-endian systems, but we document that the size of optval is int in the man page. $ man 7 netlink ... Socket options To set or get a netlink socket option, call getsockopt(2) to read or setsockopt(2) to write the option with the option level argument set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to an int. Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups") Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option") Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag") Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option") Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting") Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps") Reported-by: Brad Spencer Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Johannes Berg Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 1d29b4c223811871017542e96ac00ee562a37497 Author: Masahiro Yamada Date: Mon Apr 17 23:25:48 2023 +0900 kbuild: deb-pkg: add KDEB_SOURCE_COMPRESS to specify source compression Add KDEB_SOURCE_COMPRESS to specify the compression for the orig and debian tarballs. (cf. the existing KDEB_COMPRESS is used to specify the compression for binary packages.) Supported algorithms are gzip, bzip2, lzma, and xz, all of which are supported by dpkg-source. The current default is gzip. You can change it via the environment variable, for example, 'KDEB_SOURCE_COMPRESS=xz make deb-pkg'. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit be7dbd275dc6b911a5b9a22c4f9cb71b2c7fd847 Author: Andrii Nakryiko Date: Mon Apr 24 16:51:28 2023 -0700 selftests/bpf: avoid mark_all_scalars_precise() trigger in one of iter tests iter_pass_iter_ptr_to_subprog subtest is relying on actual array size being passed as subprog parameter. This combined with recent fixes to precision tracking in conditional jumps ([0]) is now causing verifier to backtrack all the way to the point where sum() and fill() subprogs are called, at which point precision backtrack bails out and forces all the states to have precise SCALAR registers. This in turn causes each possible value of i within fill() and sum() subprogs to cause a different non-equivalent state, preventing iterator code to converge. For now, change the test to assume fixed size of passed in array. Once BPF verifier supports precision tracking across subprogram calls, these changes will be reverted as unnecessary. [0] 71b547f56124 ("bpf: Fix incorrect verifier pruning due to missing register precision taints") Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20230424235128.1941726-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit ffcddcaed6e06255811a8204458e1f380a3c2b21 Merge: 2efb07b5ced64 207296f1a03bf Author: Jakub Kicinski Date: Mon Apr 24 15:37:35 2023 -0700 Merge tag 'nf-next-23-04-22' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next 1) Reduce jumpstack footprint: Stash chain in last rule marker in blob for tracing. Remove last rule and chain from jumpstack. From Florian Westphal. 2) nf_tables validates all tables before committing the new rules. Unfortunately, this has two drawbacks: - Since addition of the transaction mutex pernet state gets written to outside of the locked section from the cleanup callback, this is wrong so do this cleanup directly after table has passed all checks. - Revalidate tables that saw no changes. This can be avoided by keeping the validation state per table, not per netns. From Florian Westphal. 3) Get rid of a few redundant pointers in the traceinfo structure. The three removed pointers are used in the expression evaluation loop, so gcc keeps them in registers. Passing them to the (inlined) helpers thus doesn't increase nft_do_chain text size, while stack is reduced by another 24 bytes on 64bit arches. From Florian Westphal. 4) IPVS cleanups in several ways without implementing any functional changes, aside from removing some debugging output: - Update width of source for ip_vs_sync_conn_options The operation is safe, use an annotation to describe it properly. - Consistently use array_size() in ip_vs_conn_init() It seems better to use helpers consistently. - Remove {Enter,Leave}Function. These seem to be well past their use-by date. - Correct spelling in comments. From Simon Horman. 5) Extended netlink error report for netdevice in flowtables and netdev/chains. Allow for incrementally add/delete devices to netdev basechain. Allow to create netdev chain without device. * tag 'nf-next-23-04-22' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_tables: allow to create netdev chain without device netfilter: nf_tables: support for deleting devices in an existing netdev chain netfilter: nf_tables: support for adding new devices to an existing netdev chain netfilter: nf_tables: rename function to destroy hook list netfilter: nf_tables: do not send complete notification of deletions netfilter: nf_tables: extended netlink error reporting for netdevice ipvs: Correct spelling in comments ipvs: Remove {Enter,Leave}Function ipvs: Consistently use array_size() in ip_vs_conn_init() ipvs: Update width of source for ip_vs_sync_conn_options netfilter: nf_tables: do not store rule in traceinfo structure netfilter: nf_tables: do not store verdict in traceinfo structure netfilter: nf_tables: do not store pktinfo in traceinfo structure netfilter: nf_tables: remove unneeded conditional netfilter: nf_tables: make validation state per table netfilter: nf_tables: don't write table validation state without mutex netfilter: nf_tables: don't store chain address on jump netfilter: nf_tables: don't store address of last rule on jump netfilter: nf_tables: merge nft_rules_old structure and end of ruleblob marker ==================== Link: https://lore.kernel.org/r/20230421235021.216950-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit ea90f303e8c195f0cbb25b5df21d203d2bb503e0 Merge: fe15c26ee26ef 32c2f2a46db13 Author: Stephen Boyd Date: Mon Apr 24 15:18:23 2023 -0700 Merge tag 'qcom-clk-for-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: New drivers for Global clock controller on SM7150, IPQ9574, MSM8917 and IPQ5332 are added. New GPU clock controllers for SM6115, SM6125, SM6375 and SA8775P are added. The APSS IPQ PLL driver is refactored to support different PLL types, support for the Stromer Plus PLL type is added, and support for IPQ5332 is introduced. Helpers for settings sleep, wake and retain bits of CBCR registers are introduced and used in some of the newly introduced GPU clock drivers. The platform_driver remove callbacks is transitioned to remove_new, as part of the system wide cleanup effort. In the Display clock controller for QCM2290, the MDSS_CORE reset is introduced and the non-existent DSI1PHY clock is removed. IPQ4019 Global clock controller is transitioned to parent_data. USB GDSCs in SM6375, MSM8996 and MSM8998 are changed to use retention as disabled state, to avoid collapsing them during suspend. The CX GDSC in the SM6375 GPU clock controller has it's disable-wait value corrected. QCM2290 SDCC2 src clock moves to floor_ops. The two EMAC GDSCs are added for SC8280XP. Relevant RCGs in the SM6115 Global clock controller are moved to use shared_ops. PCIe PIPE clock operations on SM8350 are updated, to ensure the mux is parked when the parent PLL is disabled. GDSCs are added to the SC7280 LPASS audio clock controller. The RPM clock controller is transitioned to use the managed version of of_clk_add_hw_provider(). Missing XO clocks are added to MSM8226 and MSM8974. DeviceTree bindings are added for the various newly supported clock controllers, the binding for KPSS ACC and GCC drivers are converted to YAML and a few fixes are introduced. * tag 'qcom-clk-for-6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (57 commits) clk: qcom: gcc-sc8280xp: Add EMAC GDSCs clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk clk: qcom: add the GPUCC driver for sa8775p dt-bindings: clock: qcom: describe the GPUCC clock for SA8775P clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks in lpass_cc_sc7280_desc clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration dt-bindings: clock: qcom,sc7280-lpasscc: Add qcom,adsp-pil-mode property clk: qcom: rpm: Use managed `of_clk_add_hw_provider()` clk: qcom: Add Global Clock Controller driver for IPQ9574 dt-bindings: clock: Add ipq9574 clock and reset definitions clk: qcom: gpucc-sm6375: Configure CX_GDSC disable wait value clk: qcom: gcc-sm6115: Mark RCGs shared where applicable clk: qcom: dispcc-qcm2290: Add MDSS_CORE reset dt-bindings: clock: dispcc-qcm2290: Add MDSS_CORE reset clk: qcom: apss-ipq-pll: add support for IPQ5332 dt-bindings: clock: qcom,a53pll: add IPQ5332 compatible clk: qcom: apss-ipq-pll: refactor the driver to accommodate different PLL types dt-bindings: mailbox: qcom,apcs-kpss-global: fix SDX55 'if' match dt-bindings: mailbox: qcom,apcs-kpss-global: correct SDX55 clocks ... commit 61d325dcbc05d8fef88110d35ef7776f3ac3f68b Merge: 97adb49f052e7 745ed7d778340 Author: Linus Torvalds Date: Mon Apr 24 14:25:39 2023 -0700 Merge tag 'erofs-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "In this cycle, sub-page block support for uncompressed files is available. It's mainly used to enable original signing ('golden') 4k-block images on arm64 with 16/64k pages. In addition, end users could also use this feature to build a manifest to directly refer to golden tar data. Besides, long xattr name prefix support is also introduced in this cycle to avoid too many xattrs with the same prefix (e.g. overlayfs xattrs). It's useful for erofs + overlayfs combination (like Composefs model): the image size is reduced by ~14% and runtime performance is also slightly improved. Others are random fixes and cleanups as usual. Summary: - Add sub-page block size support for uncompressed files - Support flattened block device for multi-blob images to be attached into virtual machines (including cloud servers) and bare metals - Support long xattr name prefixes to optimize images with common xattr namespaces (e.g. files with overlayfs xattrs) use cases - Various minor cleanups & fixes" * tag 'erofs-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: cleanup i_format-related stuffs erofs: sunset erofs_dbg() erofs: fix potential overflow calculating xattr_isize erofs: get rid of z_erofs_fill_inode() erofs: enable long extended attribute name prefixes erofs: handle long xattr name prefixes properly erofs: add helpers to load long xattr name prefixes erofs: introduce on-disk format for long xattr name prefixes erofs: move packed inode out of the compression part erofs: keep meta inode into erofs_buf erofs: initialize packed inode after root inode is assigned erofs: stop parsing non-compact HEAD index if clusterofs is invalid erofs: don't warn ztailpacking feature anymore erofs: simplify erofs_xattr_generic_get() erofs: rename init_inode_xattrs with erofs_ prefix erofs: move several xattr helpers into xattr.c erofs: tidy up EROFS on-disk naming erofs: support flattened block device for multi-blob images erofs: set block size to the on-disk block size erofs: avoid hardcoded blocksize for subpage block support commit a0c109dcafb15b8bee187c49fb746779374f60f0 Author: Yafang Shao Date: Mon Apr 24 16:11:03 2023 +0000 bpf: Add __rcu_read_{lock,unlock} into btf id deny list The tracing recursion prevention mechanism must be protected by rcu, that leaves __rcu_read_{lock,unlock} unprotected by this mechanism. If we trace them, the recursion will happen. Let's add them into the btf id deny list. When CONFIG_PREEMPT_RCU is enabled, it can be reproduced with a simple bpf program as such: SEC("fentry/__rcu_read_lock") int fentry_run() { return 0; } Signed-off-by: Yafang Shao Link: https://lore.kernel.org/r/20230424161104.3737-2-laoar.shao@gmail.com Signed-off-by: Alexei Starovoitov commit 97adb49f052e70455c3529509885f8aa3b40c370 Merge: e2eff52ce512e 43b450632676f Author: Linus Torvalds Date: Mon Apr 24 14:06:41 2023 -0700 Merge tag 'v6.4/vfs.open' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs open fixlet from Christian Brauner: "EINVAL ist keinmal: This contains the changes to make O_DIRECTORY when specified together with O_CREAT an invalid request. The wider background is that a regression report about the behavior of O_DIRECTORY | O_CREAT was sent to fsdevel about a behavior that was changed multiple years and LTS releases earlier during v5.7 development. This has also been covered in https://lwn.net/Articles/926782/ which provides an excellent summary of the discussion" * tag 'v6.4/vfs.open' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: open: return EINVAL for O_DIRECTORY | O_CREAT commit 7deca5eae83389ca40ac1b1bde96e4af17cca84f Author: Dave Marchevsky Date: Mon Apr 24 13:43:21 2023 -0700 bpf: Disable bpf_refcount_acquire kfunc calls until race conditions are fixed As reported by Kumar in [0], the shared ownership implementation for BPF programs has some race conditions which need to be addressed before it can safely be used. This patch does so in a minimal way instead of ripping out shared ownership entirely, as proper fixes for the issues raised will follow ASAP, at which point this patch's commit can be reverted to re-enable shared ownership. The patch removes the ability to call bpf_refcount_acquire_impl from BPF programs. Programs can only bump refcount and obtain a new owning reference using this kfunc, so removing the ability to call it effectively disables shared ownership. Instead of changing success / failure expectations for bpf_refcount-related selftests, this patch just disables them from running for now. [0]: https://lore.kernel.org/bpf/d7hyspcow5wtjcmw4fugdgyp3fwhljwuscp3xyut5qnwivyeru@ysdq543otzv2/ Reported-by: Kumar Kartikeya Dwivedi Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230424204321.2680232-1-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit 16eb51aba0a72b8f60c6b98d1493844230293450 Author: Rob Clark Date: Mon Apr 17 15:55:04 2023 -0700 drm/msm: Fix vmap madv warning Commit d6ae7d1cd58e ("drm/msm/gem: Simplify vmap vs LRU tracking") introduced a splat in the pin_pages_locked() path for buffers that had been MADV_DONTNEED. ------------[ cut here ]------------ msm_obj->madv != 0 WARNING: CPU: 1 PID: 144 at drivers/gpu/drm/msm/msm_gem.c:230 msm_gem_pin_pages_locked+0x9c/0xd4 Modules linked in: lzo_rle cros_ec_lid_angle cros_ec_sensors cros_ec_sensors_core venus_dec venus_enc videobuf2_dma_contig cdc_ether usbnet mii uvcvideo videobuf2_vmalloc hci_uart btqca qcom_spmi_adc5 uvc qcom_spmi_temp_alarm qcom_vadc_common cros_ec_sensorhub videobuf2_memops cros_ec_typec sx9324 sx_common typec joydev bluetooth industrialio_triggered_buffer ecdh_generic kfifo_buf ecc venus_core qcom_stats v4l2_mem2mem videobuf2_v4l2 videobuf2_common ath11k_ahb ath11k mac80211 cfg80211 fuse zram zsmalloc CPU: 1 PID: 144 Comm: ring0 Tainted: G W 6.3.0-rc2-debug+ #622 Hardware name: Google Villager (rev1+) with LTE (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : msm_gem_pin_pages_locked+0x9c/0xd4 lr : msm_gem_pin_pages_locked+0x9c/0xd4 sp : ffffffc009ffbab0 x29: ffffffc009ffbab0 x28: ffffffee8da75008 x27: ffffff80a10274d0 x26: ffffff8087fe3bf8 x25: ffffff8087fe3c08 x24: 0000000000000001 x23: ffffff80891d5800 x22: ffffff809d0de480 x21: ffffff8081e5a080 x20: 0000000000000002 x19: ffffff80a3564c00 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000000a9620 x14: 0000000000000000 x13: 2d2d2d2d2d2d2d2d x12: 2d2d2d2d5d206572 x11: 656820747563205b x10: 2d2d2d2d2d2d2d2d x9 : ffffffee8c705dfc x8 : ffffffee8da75000 x7 : ffffffee8d34e6d0 x6 : 0000000000000000 x5 : 00000000000affa8 x4 : 000000000000000d x3 : ffffffee8da75008 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8088048040 Call trace: msm_gem_pin_pages_locked+0x9c/0xd4 get_vaddr+0xb0/0x150 msm_gem_get_vaddr_active+0x1c/0x28 snapshot_buf+0x90/0x10c msm_rd_dump_submit+0x30c/0x380 msm_gpu_submit+0x88/0x174 msm_job_run+0x68/0x118 drm_sched_main+0x2b8/0x3a0 kthread+0xf0/0x100 ret_from_fork+0x10/0x20 irq event stamp: 3358 hardirqs last enabled at (3357): [] __up_console_sem+0x7c/0x80 hardirqs last disabled at (3358): [] el1_dbg+0x24/0x80 softirqs last enabled at (3330): [] __do_softirq+0x21c/0x4bc softirqs last disabled at (3325): [] ____do_softirq+0x18/0x24 ---[ end trace 0000000000000000 ]--- But, as with msm_gem_get_vaddr_active(), this is a special case because we know that the buffer won't be purged evicted until it's fence is signaled. We just forgot to propagate the logic get_vaddr() to pin_pages_locked(). Fixes: d6ae7d1cd58e ("drm/msm/gem: Simplify vmap vs LRU tracking") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/532616/ Link: https://lore.kernel.org/r/20230417225504.494934-1-robdclark@gmail.com commit e2eff52ce512ec725f9f1daf975c45a499be1e1e Merge: 7bcff5a3969b0 81b21c0f0138f Author: Linus Torvalds Date: Mon Apr 24 13:39:58 2023 -0700 Merge tag 'v6.4/vfs.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "This contains a pile of various smaller fixes. Most of them aren't very interesting so this just highlights things worth mentioning: - Various filesystems contained the same little helper to convert from the mode of a dentry to the DT_* type of that dentry. They have now all been switched to rely on the generic fs_umode_to_dtype() helper. All custom helpers are removed (Jeff) - Fsnotify now reports ACCESS and MODIFY events for splice (Chung-Chiang Cheng) - After converting timerfd a long time ago to rely on wait_event_interruptible_*() apis, convert eventfd as well. This removes the complex open-coded wait code (Wen Yang) - Simplify sysctl registration for devpts, avoiding the declaration of two tables. Instead, just use a prefixed path with register_sysctl() (Luis) - The setattr_should_drop_sgid() helper is now exported so NFS can use it. By switching NFS to this helper an NFS setgid inheritance bug is fixed (me)" * tag 'v6.4/vfs.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() pnode: pass mountpoint directly eventfd: use wait_event_interruptible_locked_irq() helper splice: report related fsnotify events fs: consolidate duplicate dt_type helpers nfs: use vfs setgid helper Update relatime comments to include equality fs/buffer: Remove redundant assignment to err fs_context: drop the unused lsm_flags member fs/namespace: fnic: Switch to use %ptTd Documentation: update idmappings.rst devpts: simplify two-level sysctl registration for pty_kern_table eventpoll: align comment with nested epoll limitation commit 7bcff5a3969b0e396087516ba4131596296a4478 Merge: ec40758b31ef6 e499214ce3ef5 Author: Linus Torvalds Date: Mon Apr 24 13:35:23 2023 -0700 Merge tag 'v6.4/vfs.acl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull acl updates from Christian Brauner: "After finishing the introduction of the new posix acl api last cycle the generic POSIX ACL xattr handlers are still around in the filesystems xattr handlers for two reasons: (1) Because a few filesystems rely on the ->list() method of the generic POSIX ACL xattr handlers in their ->listxattr() inode operation. (2) POSIX ACLs are only available if IOP_XATTR is raised. The IOP_XATTR flag is raised in inode_init_always() based on whether the sb->s_xattr pointer is non-NULL. IOW, the registered xattr handlers of the filesystem are used to raise IOP_XATTR. Removing the generic POSIX ACL xattr handlers from all filesystems would risk regressing filesystems that only implement POSIX ACL support and no other xattrs (nfs3 comes to mind). This contains the work to decouple POSIX ACLs from the IOP_XATTR flag as they don't depend on xattr handlers anymore. So it's now possible to remove the generic POSIX ACL xattr handlers from the sb->s_xattr list of all filesystems. This is a crucial step as the generic POSIX ACL xattr handlers aren't used for POSIX ACLs anymore and POSIX ACLs don't depend on the xattr infrastructure anymore. Adressing problem (1) will require more long-term work. It would be best to get rid of the ->list() method of xattr handlers completely at some point. For erofs, ext{2,4}, f2fs, jffs2, ocfs2, and reiserfs the nop POSIX ACL xattr handler is kept around so they can continue to use array-based xattr handler indexing. This update does simplify the ->listxattr() implementation of all these filesystems however" * tag 'v6.4/vfs.acl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: acl: don't depend on IOP_XATTR ovl: check for ->listxattr() support reiserfs: rework priv inode handling fs: rename generic posix acl handlers reiserfs: rework ->listxattr() implementation fs: simplify ->listxattr() implementation fs: drop unused posix acl handlers xattr: remove unused argument xattr: add listxattr helper xattr: simplify listxattr helpers commit ce902336d9b3472d6104316e876e1a8752531916 Author: Rob Clark Date: Tue Apr 18 09:41:58 2023 -0700 drm/msm/atomic: Don't try async if crtc not active For a similar reason as commit f2c7ca890182 ("drm/atomic-helper: Don't set deadline for modesets"), we need the crtc to be already active in order to compute a target vblank time for an async commit. Otherwise we get this splat reminding us that we are doing it wrong: ------------[ cut here ]------------ msm_dpu ae01000.mdp: drm_WARN_ON_ONCE(drm_drv_uses_atomic_modeset(dev)) WARNING: CPU: 7 PID: 1923 at drivers/gpu/drm/drm_vblank.c:728 drm_crtc_vblank_helper_get_vblank_timestamp_internal+0x148/0x370 Modules linked in: snd_seq_dummy snd_seq snd_seq_device bridge stp llc tun vhost_vsock vhost vhost_iotlb vmw_vsock_virtio_transport_common vsock uinput rfcomm algif_hash algif_skcipher af_alg veth venus_dec venus_enc cros_ec_typec typec qcom_spmi_temp_alarm qcom_spmi_adc_tm5 qcom_spmi_adc5 xt_cgroup qcom_vadc_common qcom_stats hci_uart btqca xt_MASQUERADE venus_core 8021q coresight_tmc coresight_funnel coresight_etm4x coresight_replicator snd_soc_lpass_sc7180 coresight snd_soc_sc7180 ip6table_nat fuse ath10k_snoc ath10k_core ath mac80211 iio_trig_sysfs bluetooth cfg80211 cros_ec_sensors cros_ec_sensors_core ecdh_generic industrialio_triggered_buffer ecc kfifo_buf cros_ec_sensorhub r8153_ecm cdc_ether usbnet r8152 mii lzo_rle lzo_compress zram hid_vivaldi hid_google_hammer hid_vivaldi_common joydev CPU: 7 PID: 1923 Comm: DrmThread Not tainted 5.15.107-18853-g3be267609a0b-dirty #16 a1ffc1a66e79c21c3536d8c9a42e819236e39714 Hardware name: Google Wormdingler rev1+ BOE panel board (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drm_crtc_vblank_helper_get_vblank_timestamp_internal+0x148/0x370 lr : drm_crtc_vblank_helper_get_vblank_timestamp_internal+0x144/0x370 sp : ffffffc012e2b800 x29: ffffffc012e2b840 x28: ffffff8083676094 x27: ffffffc012e2bb28 x26: ffffff8084539800 x25: 0000000000000000 x24: ffffff8083676000 x23: ffffffd3c8cdc5a0 x22: ffffff80845b9d00 x21: ffffffc012e2b8b4 x20: ffffffc012e2b910 x19: 0000000000000001 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000010 x15: ffffffd3c8451a88 x14: 0000000000000003 x13: 0000000000000004 x12: 0000000000000001 x11: c0000000ffffdfff x10: ffffffd3c973ef58 x9 : 8ea3526b3cc95900 x8 : 8ea3526b3cc95900 x7 : 0000000000000000 x6 : 000000000000003a x5 : ffffffd3c99676cd x4 : 0000000000000000 x3 : ffffffc012e2b4b8 x2 : ffffffc012e2b4c0 x1 : 00000000ffffdfff x0 : 0000000000000000 Call trace: drm_crtc_vblank_helper_get_vblank_timestamp_internal+0x148/0x370 drm_crtc_vblank_helper_get_vblank_timestamp+0x20/0x30 drm_crtc_get_last_vbltimestamp+0x68/0xb0 drm_crtc_next_vblank_start+0x5c/0xa8 msm_atomic_commit_tail+0x264/0x664 commit_tail+0xac/0x160 drm_atomic_helper_commit+0x160/0x168 drm_atomic_commit+0xfc/0x128 drm_atomic_helper_disable_plane+0x8c/0x110 __setplane_atomic+0x10c/0x138 drm_mode_cursor_common+0x3a8/0x410 drm_mode_cursor_ioctl+0x48/0x70 drm_ioctl_kernel+0xe0/0x158 drm_ioctl+0x25c/0x4d8 __arm64_sys_ioctl+0x98/0xd0 invoke_syscall+0x4c/0x100 el0_svc_common+0x98/0x104 do_el0_svc+0x30/0x90 el0_svc+0x20/0x50 el0t_64_sync_handler+0x78/0x108 el0t_64_sync+0x1a4/0x1a8 ---[ end trace a0f587e1ab9589e8 ]--- Fixes: 52ff0d3073d2 ("drm/msm/atomic: Switch to vblank_start helper") Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/532727/ Link: https://lore.kernel.org/r/20230418164158.549873-1-robdclark@gmail.com commit ec40758b31ef6f492a48267e9e02edff6b4d62c9 Merge: 3323ddce085cd eee3a0e93924f Author: Linus Torvalds Date: Mon Apr 24 13:03:42 2023 -0700 Merge tag 'v6.4/pidfd.file' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull pidfd updates from Christian Brauner: "This adds a new pidfd_prepare() helper which allows the caller to reserve a pidfd number and allocates a new pidfd file that stashes the provided struct pid. It should be avoided installing a file descriptor into a task's file descriptor table just to close it again via close_fd() in case an error occurs. The fd has been visible to userspace and might already be in use. Instead, a file descriptor should be reserved but not installed into the caller's file descriptor table. If another failure path is hit then the reserved file descriptor and file can just be put without any userspace visible side-effects. And if all failure paths are cleared the file descriptor and file can be installed into the task's file descriptor table. This helper is now used in all places that open coded this functionality before. For example, this is currently done during copy_process() and fanotify used pidfd_create(), which returns a pidfd that has already been made visibile in the caller's file descriptor table, but then closed it using close_fd(). In one of the next merge windows there is also new functionality coming to unix domain sockets that will have to rely on pidfd_prepare()" * tag 'v6.4/pidfd.file' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: fanotify: use pidfd_prepare() fork: use pidfd_prepare() pid: add pidfd_prepare() commit 3323ddce085cdb33331c2c1bb7a88233023566a9 Merge: a632b76b427d8 6e890c5d5021c Author: Linus Torvalds Date: Mon Apr 24 12:52:35 2023 -0700 Merge tag 'v6.4/kernel.user_worker' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull user work thread updates from Christian Brauner: "This contains the work generalizing the ability to create a kernel worker from a userspace process. Such user workers will run with the same credentials as the userspace process they were created from providing stronger security and accounting guarantees than the traditional override_creds() approach ever could've hoped for. The original work was heavily based and optimzed for the needs of io_uring which was the first user. However, as it quickly turned out the ability to create user workers inherting properties from a userspace process is generally useful. The vhost subsystem currently creates workers using the kthread api. The consequences of using the kthread api are that RLIMITs don't work correctly as they are inherited from khtreadd. This leads to bugs where more workers are created than would be allowed by the RLIMITs of the userspace process in lieu of which workers are created. Problems like this disappear with user workers created from the userspace processes for which they perform the work. In addition, providing this api allows vhost to remove additional complexity. For example, cgroup and mm sharing will just work out of the box with user workers based on the relevant userspace process instead of manually ensuring the correct cgroup and mm contexts are used. So the vhost subsystem should simply be made to use the same mechanism as io_uring. To this end the original mechanism used for create_io_thread() is generalized into user workers: - Introduce PF_USER_WORKER as a generic indicator that a given task is a user worker, i.e., a kernel task that was created from a userspace process. Now a PF_IO_WORKER thread is just a specialized version of PF_USER_WORKER. So io_uring io workers raise both flags. - Make copy_process() available to core kernel code - Extend struct kernel_clone_args with the following bitfields allowing to indicate to copy_process(): - to create a user worker (raise PF_USER_WORKER) - to not inherit any files from the userspace process - to ignore signals After all generic changes are in place the vhost subsystem implements a new dedicated vhost api based on user workers. Finally, vhost is switched to rely on the new api moving it off of kthreads. Thanks to Mike for sticking it out and making it through this rather arduous journey" * tag 'v6.4/kernel.user_worker' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: vhost: use vhost_tasks for worker threads vhost: move worker thread fields to new struct vhost_task: Allow vhost layer to use copy_process fork: allow kernel code to call copy_process fork: Add kernel_clone_args flag to ignore signals fork: add kernel_clone_args flag to not dup/clone files fork/vm: Move common PF_IO_WORKER behavior to new flag kernel: Make io_thread and kthread bit fields kthread: Pass in the thread's name during creation kernel: Allow a kernel thread's name to be set in copy_process csky: Remove kernel_thread declaration commit a632b76b427d886911221331f4bfcd44a3e58197 Merge: c23f28975abc2 d95debbdc528d Author: Linus Torvalds Date: Mon Apr 24 12:48:33 2023 -0700 Merge tag 'v6.4/kernel.clone3.tests' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull clone3 selftest fix from Christian Brauner: "This is a single fix to the clone3() selftstests. It fell through the sefltest tree cracks a few times so I'll provide it here. It has low urgency but we should still correctly report the number of tests" * tag 'v6.4/kernel.clone3.tests' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: selftests/clone3: fix number of tests in ksft_set_plan commit 0d68683838f2850dd8ff31f1121e05bfb7a2def0 Author: Jani Nikula Date: Thu Apr 6 16:46:15 2023 +0300 drm/dsc: fix DP_DSC_MAX_BPP_DELTA_* macro values The macro values just don't match the specs. Fix them. Fixes: 1482ec00be4a ("drm: Add missing DP DSC extended capability definitions.") Cc: Vinod Govindapillai Cc: Stanislav Lisovskiy Signed-off-by: Jani Nikula Reviewed-by: Ankit Nautiyal Link: https://patchwork.freedesktop.org/patch/msgid/20230406134615.1422509-2-jani.nikula@intel.com commit 13525645e2246ebc8a21bd656248d86022a6ee8f Author: Jani Nikula Date: Thu Apr 6 16:46:14 2023 +0300 drm/dsc: fix drm_edp_dsc_sink_output_bpp() DPCD high byte usage The operator precedence between << and & is wrong, leading to the high byte being completely ignored. For example, with the 6.4 format, 32 becomes 0 and 24 becomes 8. Fix it, and remove the slightly confusing and unnecessary DP_DSC_MAX_BITS_PER_PIXEL_HI_SHIFT macro while at it. Fixes: 0575650077ea ("drm/dp: DRM DP helper/macros to get DP sink DSC parameters") Cc: Stanislav Lisovskiy Cc: Manasi Navare Cc: Anusha Srivatsa Cc: # v5.0+ Signed-off-by: Jani Nikula Reviewed-by: Ankit Nautiyal Link: https://patchwork.freedesktop.org/patch/msgid/20230406134615.1422509-1-jani.nikula@intel.com commit c23f28975abc2eb02cecc8bc1f2c95473a59ed2e Merge: 1be89faab3cf1 7e8472c820f04 Author: Linus Torvalds Date: Mon Apr 24 12:35:49 2023 -0700 Merge tag 'docs-6.4' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "Commit volume in documentation is relatively low this time, but there is still a fair amount going on, including: - Reorganize the architecture-specific documentation under Documentation/arch This makes the structure match the source directory and helps to clean up the mess that is the top-level Documentation directory a bit. This work creates the new directory and moves x86 and most of the less-active architectures there. The current plan is to move the rest of the architectures in 6.5, with the patches going through the appropriate subsystem trees. - Some more Spanish translations and maintenance of the Italian translation - A new "Kernel contribution maturity model" document from Ted - A new tutorial on quickly building a trimmed kernel from Thorsten Plus the usual set of updates and fixes" * tag 'docs-6.4' of git://git.lwn.net/linux: (47 commits) media: Adjust column width for pdfdocs media: Fix building pdfdocs docs: clk: add documentation to log which clocks have been disabled docs: trace: Fix typo in ftrace.rst Documentation/process: always CC responsible lists docs: kmemleak: adjust to config renaming ELF: document some de-facto PT_* ABI quirks Documentation: arm: remove stih415/stih416 related entries docs: turn off "smart quotes" in the HTML build Documentation: firmware: Clarify firmware path usage docs/mm: Physical Memory: Fix grammar Documentation: Add document for false sharing dma-api-howto: typo fix docs: move m68k architecture documentation under Documentation/arch/ docs: move parisc documentation under Documentation/arch/ docs: move ia64 architecture docs under Documentation/arch/ docs: Move arc architecture docs under Documentation/arch/ docs: move nios2 documentation under Documentation/arch/ docs: move openrisc documentation under Documentation/arch/ docs: move superh documentation under Documentation/arch/ ... commit 1be89faab3cf1f3dd6eb4924b60d2b9094e7206b Merge: 0f50767d7e380 a42077b787680 Author: Linus Torvalds Date: Mon Apr 24 12:31:32 2023 -0700 Merge tag 'linux-kselftest-kunit-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit updates from Shuah Khan: - several fixes to kunit tool - new klist structure test - support for m68k under QEMU - support for overriding the QEMU serial port - support for SH under QEMU * tag 'linux-kselftest-kunit-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: add tests for using current KUnit test field kunit: tool: Add support for SH under QEMU kunit: tool: Add support for overriding the QEMU serial port .gitignore: Unignore .kunitconfig list: test: Test the klist structure kunit: increase KUNIT_LOG_SIZE to 2048 bytes kunit: Use gfp in kunit_alloc_resource() kernel-doc kunit: tool: fix pre-existing `mypy --strict` errors and update run_checks.py kunit: tool: remove unused imports and variables kunit: tool: add subscripts for type annotations where appropriate kunit: fix bug of extra newline characters in debugfs logs kunit: fix bug in the order of lines in debugfs logs kunit: fix bug in debugfs logs of parameterized tests kunit: tool: Add support for m68k under QEMU commit 0f50767d7e380618f81134a62e9a753dea2aecfb Merge: 5dfb75e842e0e 50ad2fb7ec2b1 Author: Linus Torvalds Date: Mon Apr 24 12:28:34 2023 -0700 Merge tag 'linux-kselftest-next-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest updates from Shuah Khan: - several patches to enhance and fix resctrl test - nolibc support for kselftest with an addition to vprintf() to tools/nolibc/stdio and related test changes - Refactor 'peeksiginfo' ptrace test part - add 'malloc' failures checks in cgroup test_memcontrol - a new prctl test - enhancements sched test with additional ore schedule prctl calls * tag 'linux-kselftest-next-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (25 commits) selftests/resctrl: Fix incorrect error return on test complete selftests/resctrl: Remove duplicate codes that clear each test result file selftests/resctrl: Commonize the signal handler register/unregister for all tests selftests/resctrl: Cleanup properly when an error occurs in CAT test selftests/resctrl: Flush stdout file buffer before executing fork() selftests/resctrl: Return MBA check result and make it to output message selftests/resctrl: Fix set up schemata with 100% allocation on first run in MBM test selftests/resctrl: Use correct exit code when tests fail kselftest/arm64: Convert za-fork to use kselftest.h kselftest: Support nolibc tools/nolibc/stdio: Implement vprintf() selftests/resctrl: Correct get_llc_perf() param in function comment selftests/resctrl: Use remount_resctrlfs() consistently with boolean selftests/resctrl: Change name from CBM_MASK_PATH to INFO_PATH selftests/resctrl: Change initialize_llc_perf() return type to void selftests/resctrl: Replace obsolete memalign() with posix_memalign() selftests/resctrl: Check for return value after write_schemata() selftests/resctrl: Allow ->setup() to return errors selftests/resctrl: Move ->setup() call outside of test specific branches selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem ... commit 5dfb75e842e0ef59fc7bf307e5c52eab215bdb4c Merge: 5d77652fbf231 8ae99857748be Author: Linus Torvalds Date: Mon Apr 24 12:16:14 2023 -0700 Merge tag 'rcu.6.4.april5.2023.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jfern/linux Pull RCU updates from Joel Fernandes: - Updates and additions to MAINTAINERS files, with Boqun being added to the RCU entry and Zqiang being added as an RCU reviewer. I have also transitioned from reviewer to maintainer; however, Paul will be taking over sending RCU pull-requests for the next merge window. - Resolution of hotplug warning in nohz code, achieved by fixing cpu_is_hotpluggable() through interaction with the nohz subsystem. Tick dependency modifications by Zqiang, focusing on fixing usage of the TICK_DEP_BIT_RCU_EXP bitmask. - Avoid needless calls to the rcu-lazy shrinker for CONFIG_RCU_LAZY=n kernels, fixed by Zqiang. - Improvements to rcu-tasks stall reporting by Neeraj. - Initial renaming of k[v]free_rcu() to k[v]free_rcu_mightsleep() for increased robustness, affecting several components like mac802154, drbd, vmw_vmci, tracing, and more. A report by Eric Dumazet showed that the API could be unknowingly used in an atomic context, so we'd rather make sure they know what they're asking for by being explicit: https://lore.kernel.org/all/20221202052847.2623997-1-edumazet@google.com/ - Documentation updates, including corrections to spelling, clarifications in comments, and improvements to the srcu_size_state comments. - Better srcu_struct cache locality for readers, by adjusting the size of srcu_struct in support of SRCU usage by Christoph Hellwig. - Teach lockdep to detect deadlocks between srcu_read_lock() vs synchronize_srcu() contributed by Boqun. Previously lockdep could not detect such deadlocks, now it can. - Integration of rcutorture and rcu-related tools, targeted for v6.4 from Boqun's tree, featuring new SRCU deadlock scenarios, test_nmis module parameter, and more - Miscellaneous changes, various code cleanups and comment improvements * tag 'rcu.6.4.april5.2023.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jfern/linux: (71 commits) checkpatch: Error out if deprecated RCU API used mac802154: Rename kfree_rcu() to kvfree_rcu_mightsleep() rcuscale: Rename kfree_rcu() to kfree_rcu_mightsleep() ext4/super: Rename kfree_rcu() to kfree_rcu_mightsleep() net/mlx5: Rename kfree_rcu() to kfree_rcu_mightsleep() net/sysctl: Rename kvfree_rcu() to kvfree_rcu_mightsleep() lib/test_vmalloc.c: Rename kvfree_rcu() to kvfree_rcu_mightsleep() tracing: Rename kvfree_rcu() to kvfree_rcu_mightsleep() misc: vmw_vmci: Rename kvfree_rcu() to kvfree_rcu_mightsleep() drbd: Rename kvfree_rcu() to kvfree_rcu_mightsleep() rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed rcu-tasks: Report stalls during synchronize_srcu() in rcu_tasks_postscan() rcu: Permit start_poll_synchronize_rcu_expedited() to be invoked early rcu: Remove never-set needwake assignment from rcu_report_qs_rdp() rcu: Register rcu-lazy shrinker only for CONFIG_RCU_LAZY=y kernels rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check rcu: Fix set/clear TICK_DEP_BIT_RCU_EXP bitmask race rcu/trace: use strscpy() to instead of strncpy() tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem ... commit 5d77652fbf2318f61af2cf27779951393dd0f749 Merge: 4a4075ada6a5f 0d8c461adbc4a Author: Linus Torvalds Date: Mon Apr 24 12:09:43 2023 -0700 Merge tag 'nolibc.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc updates from Paul McKenney: - Add support for loongarch - Fix stack-protector issues - Support additional integral types and signal-related macros - Add support for stdin, stdout, and stderr - Add getuid() and geteuid() - Allow S_I* macros to be overridden by program - Defer to linux/fcntl.h and linux/stat.h to avoid duplicate definitions - Many improvements to the selftests * tag 'nolibc.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (22 commits) tools/nolibc: x86_64: add stackprotector support tools/nolibc: i386: add stackprotector support tools/nolibc: tests: add test for -fstack-protector tools/nolibc: tests: fold in no-stack-protector cflags tools/nolibc: add support for stack protector tools/nolibc: tests: constify test_names tools/nolibc: add helpers for wait() signal exits tools/nolibc: add definitions for standard fds selftests/nolibc: Adjust indentation for Makefile selftests/nolibc: Add support for LoongArch tools/nolibc: Add support for LoongArch tools/nolibc: Add statx() and make stat() rely on statx() if necessary tools/nolibc: Include linux/fcntl.h and remove duplicate code tools/nolibc: check for S_I* macros before defining them selftests/nolibc: skip the chroot_root and link_dir tests when not privileged tools/nolibc: add getuid() and geteuid() tools/nolibc: add tests for the integer limits in stdint.h tools/nolibc: enlarge column width of tests tools/nolibc: add integer types and integer limit macros tools/nolibc: add stdint.h ... commit 4a4075ada6a5f51087d6c046b024046bf3864beb Merge: 60eb45074234b 5d65cf6ae6aea Author: Linus Torvalds Date: Mon Apr 24 12:05:08 2023 -0700 Merge tag 'locktorture.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull locktorture updates from Paul McKenney: "This adds tests for nested locking and also adds support for testing raw spinlocks in PREEMPT_RT kernels" * tag 'locktorture.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: locktorture: Add raw_spinlock* torture tests for PREEMPT_RT kernels locktorture: With nested locks, occasionally skip main lock locktorture: Add nested locking to rtmutex torture tests locktorture: Add nested locking to mutex torture tests locktorture: Add nested_[un]lock() hooks and nlocks parameter commit 60eb45074234b90333b6241b4fd8d196aa2dfd98 Merge: 406037351e08d cc4a29819b0df Author: Linus Torvalds Date: Mon Apr 24 12:02:25 2023 -0700 Merge tag 'lkmm-scripting.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull Linux Kernel Memory Model scripting updates from Paul McKenney: "This improves litmus-test documentation and improves the ability to do before/after tests on the https://github.com/paulmckrcu/litmus repo" * tag 'lkmm-scripting.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (32 commits) tools/memory-model: Remove out-of-date SRCU documentation tools/memory-model: Document LKMM test procedure tools/memory-model: Use "grep -E" instead of "egrep" tools/memory-model: Use "-unroll 0" to keep --hw runs finite tools/memory-model: Make judgelitmus.sh handle scripted Result: tag tools/memory-model: Add data-race capabilities to judgelitmus.sh tools/memory-model: Add checktheselitmus.sh to run specified litmus tests tools/memory-model: Repair parseargs.sh header comment tools/memory-model: Add "--" to parseargs.sh for additional arguments tools/memory-model: Make history-check scripts use mselect7 tools/memory-model: Make checkghlitmus.sh use mselect7 tools/memory-model: Fix scripting --jobs argument tools/memory-model: Implement --hw support for checkghlitmus.sh tools/memory-model: Add -v flag to jingle7 runs tools/memory-model: Make runlitmus.sh check for jingle errors tools/memory-model: Allow herd to deduce CPU type tools/memory-model: Keep assembly-language litmus tests tools/memory-model: Move from .AArch64.litmus.out to .litmus.AArch.out tools/memory-model: Make runlitmus.sh generate .litmus.out for --hw tools/memory-model: Split runlitmus.sh out of checklitmus.sh ... commit 406037351e08dea03735178bf11046da85f00125 Merge: 022e32094ed2a 57373671d5f5a Author: Linus Torvalds Date: Mon Apr 24 12:00:51 2023 -0700 Merge tag 'lkmm.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull Linux Kernel Memory Model updates from Paul McKenney "This improves LKMM diagnostic messages, unifies handling of the ordering produced by unlock/lock pairs, adds support for the smp_mb__after_srcu_read_unlock() macro, removes redundant members from the to-r relation, brings SRCU read-side semantics into alignment with Linux-kernel SRCU, makes ppo a subrelation of po, and improves documentation" * tag 'lkmm.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: Documentation: litmus-tests: Correct spelling tools/memory-model: Add documentation about SRCU read-side critical sections tools/memory-model: Make ppo a subrelation of po tools/memory-model: Provide exact SRCU semantics tools/memory-model: Restrict to-r to read-read address dependency tools/memory-model: Add smp_mb__after_srcu_read_unlock() tools/memory-model: Unify UNLOCK+LOCK pairings to po-unlock-lock-po tools/memory-model: Update some warning labels commit 022e32094ed2a688dcb2721534abd0a291905f29 Merge: 1a0beef98b582 8dec88070d964 Author: Linus Torvalds Date: Mon Apr 24 11:46:53 2023 -0700 Merge tag 'kcsan.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull KCSAN updates from Paul McKenney: "Kernel concurrency sanitizer (KCSAN) updates for v6.4 This fixes kernel-doc warnings and also updates instrumentation from READ_ONCE() to volatile in order to avoid unaligned load-acquire instructions on arm64 in kernels built with LTO" * tag 'kcsan.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: kcsan: Avoid READ_ONCE() in read_instrumented_memory() instrumented.h: Fix all kernel-doc format warnings commit 1a0beef98b582b69a2ba44e468f7dfecbcfab48e Merge: dc7e22a368c2a bd8621ca1510e Author: Linus Torvalds Date: Mon Apr 24 11:40:26 2023 -0700 Merge tag 'tpmdd-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: - The .machine keyring, used for Machine Owner Keys (MOK), acquired the ability to store only CA enforced keys, and put rest to the .platform keyring, thus separating the code signing keys from the keys that are used to sign certificates. This essentially unlocks the use of the .machine keyring as a trust anchor for IMA. It is an opt-in feature, meaning that the additional contraints won't brick anyone who does not care about them. - Enable interrupt based transactions with discrete TPM chips (tpm_tis). There was code for this existing but it never really worked so I consider this a new feature rather than a bug fix. Before the driver just fell back to the polling mode. Link: https://lore.kernel.org/linux-integrity/a93b6222-edda-d43c-f010-a59701f2aeef@gmx.de/ Link: https://lore.kernel.org/linux-integrity/20230302164652.83571-1-eric.snowberg@oracle.com/ * tag 'tpmdd-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: (29 commits) tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site tpm_tis: fix stall after iowrite*()s tpm/tpm_tis_synquacer: Convert to platform remove callback returning void tpm/tpm_tis: Convert to platform remove callback returning void tpm/tpm_ftpm_tee: Convert to platform remove callback returning void tpm: tpm_tis_spi: Mark ACPI and OF related data as maybe unused tpm: st33zp24: Mark ACPI and OF related data as maybe unused tpm, tpm_tis: Enable interrupt test tpm, tpm_tis: startup chip before testing for interrupts tpm, tpm_tis: Claim locality when interrupts are reenabled on resume tpm, tpm_tis: Claim locality in interrupt handler tpm, tpm_tis: Request threaded interrupt handler tpm, tpm: Implement usage counter for locality tpm, tpm_tis: do not check for the active locality in interrupt handler tpm, tpm_tis: Move interrupt mask checks into own function tpm, tpm_tis: Only handle supported interrupts tpm, tpm_tis: Claim locality before writing interrupt registers tpm, tpm_tis: Do not skip reset of original interrupt vector tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register ... commit dc7e22a368c2a217d2d3338b3bd984fdd0301173 Merge: 62443646a5fdd de93e515db306 Author: Linus Torvalds Date: Mon Apr 24 11:37:24 2023 -0700 Merge tag 'Smack-for-6.4' of https://github.com/cschaufler/smack-next Pull smack updates from Casey Schaufler: "There are two changes, one small and one more substantial: - Remove of an unnecessary cast - The mount option processing introduced with the mount rework makes copies of mount option values. There is no good reason to make copies of Smack labels, as they are maintained on a list and never removed. The code now uses pointers to entries on the list, reducing processing time and memory use" * tag 'Smack-for-6.4' of https://github.com/cschaufler/smack-next: Smack: Improve mount process memory use smack_lsm: remove unnecessary type casting commit 62443646a5fddd2c15dacd670fda84044ee7f748 Merge: 5af4b523ba9be ed35e2f2f0ded Author: Linus Torvalds Date: Mon Apr 24 11:35:15 2023 -0700 Merge tag 'landlock-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock update from Mickaël Salaün: "Improve user space documentation" * tag 'landlock-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Clarify documentation for the LANDLOCK_ACCESS_FS_REFER right commit 5af4b523ba9be70372eafab02ebfb9babf77ec7d Merge: 08e30833f86ba c120c98486c28 Author: Linus Torvalds Date: Mon Apr 24 11:33:07 2023 -0700 Merge tag 'tomoyo-pr-20230424' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1 Pull tomoyo update from Tetsuo Handa: "One cleanup patch from Vlastimil Babka" * tag 'tomoyo-pr-20230424' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1: tomoyo: replace tomoyo_round2() with kmalloc_size_roundup() commit fd35fdcbf75b5f31dba6c284886b676bb2145fe6 Author: Davidlohr Bueso Date: Sun Apr 23 15:12:31 2023 -0700 cxl/test: Add mock test for set_timestamp Support the command testing in a unit-test fashion. Reviewed-by: Ira Weiny Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20230423221231.6357-1-dave@stgolabs.net Signed-off-by: Dan Williams commit 08e30833f86ba25945e416b9f372791aacfef153 Merge: 72eaa0967b594 d82dcd9e21b77 Author: Linus Torvalds Date: Mon Apr 24 11:21:50 2023 -0700 Merge tag 'lsm-pr-20230420' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: - Move the LSM hook comment blocks into security/security.c For many years the LSM hook comment blocks were located in a very odd place, include/linux/lsm_hooks.h, where they lived on their own, disconnected from both the function prototypes and definitions. In keeping with current kernel conventions, this moves all of these comment blocks to the top of the function definitions, transforming them into the kdoc format in the process. This should make it much easier to maintain these comments, which are the main source of LSM hook documentation. For the most part the comment contents were left as-is, although some glaring errors were corrected. Expect additional edits in the future as we slowly update and correct the comment blocks. This is the bulk of the diffstat. - Introduce LSM_ORDER_LAST Similar to how LSM_ORDER_FIRST is used to specify LSMs which should be ordered before "normal" LSMs, the LSM_ORDER_LAST is used to specify LSMs which should be ordered after "normal" LSMs. This is one of the prerequisites for transitioning IMA/EVM to a proper LSM. - Remove the security_old_inode_init_security() hook The security_old_inode_init_security() LSM hook only allows for a single xattr which is problematic both for LSM stacking and the IMA/EVM-as-a-LSM effort. This finishes the conversion over to the security_inode_init_security() hook and removes the single-xattr LSM hook. - Fix a reiserfs problem with security xattrs During the security_old_inode_init_security() removal work it became clear that reiserfs wasn't handling security xattrs properly so we fixed it. * tag 'lsm-pr-20230420' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (32 commits) reiserfs: Add security prefix to xattr name in reiserfs_security_write() security: Remove security_old_inode_init_security() ocfs2: Switch to security_inode_init_security() reiserfs: Switch to security_inode_init_security() security: Remove integrity from the LSM list in Kconfig Revert "integrity: double check iint_cache was initialized" security: Introduce LSM_ORDER_LAST and set it for the integrity LSM device_cgroup: Fix typo in devcgroup_css_alloc description lsm: fix a badly named parameter in security_get_getsecurity() lsm: fix doc warnings in the LSM hook comments lsm: styling fixes to security/security.c lsm: move the remaining LSM hook comments to security/security.c lsm: move the io_uring hook comments to security/security.c lsm: move the perf hook comments to security/security.c lsm: move the bpf hook comments to security/security.c lsm: move the audit hook comments to security/security.c lsm: move the binder hook comments to security/security.c lsm: move the sysv hook comments to security/security.c lsm: move the key hook comments to security/security.c lsm: move the xfrm hook comments to security/security.c ... commit 72eaa0967b594cb9886c2f277a69ac1ea935b1a8 Merge: a5624566431de 4ce1f694eb5d8 Author: Linus Torvalds Date: Mon Apr 24 11:11:59 2023 -0700 Merge tag 'selinux-pr-20230420' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Stop passing the 'selinux_state' pointers as function arguments As discussed during the end of the last development cycle, passing a selinux_state pointer through the SELinux code has a noticeable impact on performance, and with the current code it is not strictly necessary. This simplifies things by referring directly to the single selinux_state global variable which should help improve SELinux performance. - Uninline the unlikely portions of avc_has_perm_noaudit() This change was also based on a discussion from the last development cycle, and is heavily based on an initial proof of concept patch from you. The core issue was that avc_has_perm_noaudit() was not able to be inlined, as intended, due to its size. We solved this issue by extracting the less frequently hit portions of avc_has_perm_noaudit() into a separate function, reducing the size of avc_has_perm_noaudit() to the point where the compiler began inlining the function. We also took the opportunity to clean up some ugly RCU locking in the code that became uglier with the change. - Remove the runtime disable functionality After several years of work by the userspace and distro folks, we are finally in a place where we feel comfortable removing the runtime disable functionality which we initially deprecated at the start of 2020. There is plenty of information in the kernel's deprecation (now removal) notice, but the main motivation was to be able to safely mark the LSM hook structures as '__ro_after_init'. LWN also wrote a good summary of the deprecation this morning which offers a more detailed history: https://lwn.net/SubscriberLink/927463/dcfa0d4ed2872f03 - Remove the checkreqprot functionality The original checkreqprot deprecation notice stated that the removal would happen no sooner than June 2021, which means this falls hard into the "better late than never" bucket. The Kconfig and deprecation notice has more detail on this setting, but the basic idea is that we want to ensure that the SELinux policy allows for the memory protections actually applied by the kernel, and not those requested by the process. While we haven't found anyone running a supported distro that is affected by this deprecation/removal, anyone who is affected would only need to update their policy to reflect the reality of their applications' mapping protections. - Minor Makefile improvements Some minor Makefile improvements to correct some dependency issues likely only ever seen by SELinux developers. I expect we will have at least one more tweak to the Makefile during the next merge window, but it didn't quite make the cutoff this time around. * tag 'selinux-pr-20230420' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: ensure av_permissions.h is built when needed selinux: fix Makefile dependencies of flask.h selinux: stop returning node from avc_insert() selinux: clean up dead code after removing runtime disable selinux: update the file list in MAINTAINERS selinux: remove the runtime disable functionality selinux: remove the 'checkreqprot' functionality selinux: stop passing selinux_state pointers and their offspring selinux: uninline unlikely parts of avc_has_perm_noaudit() commit 8375be2b6414577487486a92995bdc97a7934033 Author: Qi Han Date: Tue Apr 18 14:09:54 2023 +0800 f2fs: remove unnessary comment in __may_age_extent_tree This comment make no sense and is in the wrong place, so let's remove it. Signed-off-by: Qi Han Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 994b442b66a4624a2f471aba5cbae37a79213313 Author: Daeho Jeong Date: Tue Apr 18 10:42:01 2023 -0700 f2fs: allocate node blocks for atomic write block replacement When a node block is missing for atomic write block replacement, we need to allocate it in advance of the replacement. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd Author: Daeho Jeong Date: Tue Apr 18 10:52:06 2023 -0700 f2fs: use cow inode data when updating atomic write Need to use cow inode data content instead of the one in the original inode, when we try to write the already updated atomic write files. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2e2c6e9b72ce3d137984c867eb5625b8498cfe2b Author: Jaegeuk Kim Date: Mon Apr 17 17:12:52 2023 -0700 f2fs: remove power-of-two limitation of zoned device In f2fs, there's no reason to force po2. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d1efa4a0a696e487f349f837f53a0db88f8f0d74 Author: James Clark Date: Mon Apr 24 14:47:47 2023 +0100 perf cs-etm: Add separate decode paths for timeless and per-thread modes Timeless and per-thread are orthogonal concepts that are currently treated as if they are the same (per-thread == timeless). This breaks when you modify the command line or itrace options to something that the current logic doesn't expect. For example: # Force timeless with Z --itrace=Zi10i # Or inconsistent record options -e cs_etm/timestamp=1/ --per-thread Adding Z for decoding in per-cpu mode is particularly bad because in per-thread mode trace channel IDs are discarded and all assumed to be 0, which would mix trace from different CPUs in per-cpu mode. Although the results might not be perfect in all scenarios, if the user requests no timestamps, it should still be possible to decode in either mode. Especially if the relative times of samples in different processes aren't interesting, quite a bit of space can be saved by turning off timestamps in per-cpu mode. Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Denis Nikitin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: Yang Shi Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230424134748.228137-8-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 1764ce069bb05c630de2f108aadb66eaa470131e Author: James Clark Date: Mon Apr 24 14:47:46 2023 +0100 perf cs-etm: Use bool type for boolean values Using u8 for boolean values makes the code a bit more difficult to read so be more explicit by using bool. Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Denis Nikitin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: Yang Shi Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230424134748.228137-7-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 7bfc1544d91121dddd3a6e7a289b03b63c660b57 Author: James Clark Date: Mon Apr 24 14:47:45 2023 +0100 perf cs-etm: Allow user to override timestamp and contextid settings Timestamps and context tracking are automatically enabled in per-core mode and it's impossible to override this. Use the new utility function to set them conditionally. Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Denis Nikitin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: Yang Shi Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230424134748.228137-6-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 35c51f83dd1ed5db9ddf90e90caf5cb2aa608a35 Author: James Clark Date: Mon Apr 24 14:47:44 2023 +0100 perf cs-etm: Validate options after applying them Currently the cs_etm_set_option() function both validates and applies the config options. Because it's only called when they are added automatically, there are some paths where the user can apply the option on the command line and skip the validation. By moving it to the end it covers both cases. Also, options don't need to be re-applied anyway, Perf handles parsing and applying the config terms automatically. Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Denis Nikitin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: Yang Shi Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230424134748.228137-5-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 3963d84b1bf0af98f604c85436076a1eb46373f3 Author: James Clark Date: Mon Apr 24 14:47:43 2023 +0100 perf cs-etm: Don't test full_auxtrace because it's always set There is no path in cs-etm where this isn't true so it doesn't need to be tested. Also re-order the beginning of cs_etm_recording_options() so that nothing is done until the early exit is passed. Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Denis Nikitin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: Yang Shi Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230424134748.228137-4-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 6593f019c26cbdee3432f28a3d1ffac9605cf562 Author: James Clark Date: Mon Apr 24 14:47:42 2023 +0100 perf tools: Add util function for overriding user set config values There is some duplicated code to only override config values if they haven't already been set by the user so make a util function for this. Signed-off-by: James Clark Acked-by: Adrian Hunter Cc: Alexander Shishkin Cc: Denis Nikitin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: Yang Shi Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230424134748.228137-3-james.clark@arm.com [ Moved evsel__set_config_if_unset() to util/pmu.c to avoid dragging stuff into the python binding ] Signed-off-by: Arnaldo Carvalho de Melo commit a5624566431de76b17862383d9ae254d9606cba9 Merge: 487c20b016dc4 034ff37d34071 Author: Linus Torvalds Date: Mon Apr 24 10:39:27 2023 -0700 Merge branch 'x86-rep-insns': x86 user copy clarifications Merge my x86 user copy updates branch. This cleans up a lot of our x86 memory copy code, particularly for user accesses. I've been pushing for microarchitectural support for good memory copying and clearing for a long while, and it's been visible in how the kernel has aggressively used 'rep movs' and 'rep stos' whenever possible. And that micro-architectural support has been improving over the years, to the point where on modern CPU's the best option for a memory copy that would become a function call (as opposed to being something that can just be turned into individual 'mov' instructions) is now to inline the string instruction sequence instead. However, that only makes sense when we have the modern markers for this: the x86 FSRM and FSRS capabilities ("Fast Short REP MOVS/STOS"). So this cleans up a lot of our historical code, gets rid of the legacy marker use ("REP_GOOD" and "ERMS") from the memcpy/memset cases, and replaces it with that modern reality. Note that REP_GOOD and ERMS end up still being used by the known large cases (ie page copyin gand clearing). The reason much of this ends up being about user memory accesses is that the normal in-kernel cases are done by the compiler (__builtin_memcpy() and __builtin_memset()) and getting to the point where we can use our instruction rewriting to inline those to be string instructions will need some compiler support. In contrast, the user accessor functions are all entirely controlled by the kernel code, so we can change those arbitrarily. Thanks to Borislav Petkov for feedback on the series, and Jens testing some of this on micro-architectures I didn't personally have access to. * x86-rep-insns: x86: rewrite '__copy_user_nocache' function x86: remove 'zerorest' argument from __copy_user_nocache() x86: set FSRS automatically on AMD CPUs that have FSRM x86: improve on the non-rep 'copy_user' function x86: improve on the non-rep 'clear_user' function x86: inline the 'rep movs' in user copies for the FSRM case x86: move stac/clac from user copy routines into callers x86: don't use REP_GOOD or ERMS for user memory clearing x86: don't use REP_GOOD or ERMS for user memory copies x86: don't use REP_GOOD or ERMS for small memory clearing x86: don't use REP_GOOD or ERMS for small memory copies commit 487c20b016dc48230367a7be017f40313e53e3bd Author: Linus Torvalds Date: Thu Mar 30 14:53:51 2023 -0700 iov: improve copy_iovec_from_user() code generation Use the same pattern as the compat version of this code does: instead of copying the whole array to a kernel buffer and then having a separate phase of verifying it, just do it one entry at a time, verifying as you go. On Jens' /dev/zero readv() test this improves performance by ~6%. [ This was obviously triggered by Jens' ITER_UBUF updates series ] Reported-and-tested-by: Jens Axboe Link: https://lore.kernel.org/all/de35d11d-bce7-e976-7372-1f2caf417103@kernel.dk/ Signed-off-by: Linus Torvalds commit b9dff2195f8a5847fad801046b26955e05670d31 Merge: d88867a24fa7e 50f9a76ef1273 Author: Linus Torvalds Date: Mon Apr 24 10:29:28 2023 -0700 Merge tag 'iter-ubuf.2-2023-04-21' of git://git.kernel.dk/linux Pull ITER_UBUF updates from Jens Axboe: "This turns singe vector imports into ITER_UBUF, rather than ITER_IOVEC. The former is more trivial to iterate and advance, and hence a bit more efficient. From some very unscientific testing, ~60% of all iovec imports are single vector" * tag 'iter-ubuf.2-2023-04-21' of git://git.kernel.dk/linux: iov_iter: Mark copy_compat_iovec_from_user() noinline iov_iter: import single vector iovecs as ITER_UBUF iov_iter: convert import_single_range() to ITER_UBUF iov_iter: overlay struct iovec and ubuf/len iov_iter: set nr_segs = 1 for ITER_UBUF iov_iter: remove iov_iter_iovec() iov_iter: add iter_iov_addr() and iter_iov_len() helpers ALSA: pcm: check for user backed iterator, not specific iterator type IB/qib: check for user backed iterator, not specific iterator type IB/hfi1: check for user backed iterator, not specific iterator type iov_iter: add iter_iovec() helper block: ensure bio_alloc_map_data() deals with ITER_UBUF correctly commit 449067f3fc9f340da54e383738286881e6634d0b Author: James Clark Date: Mon Apr 24 14:47:41 2023 +0100 perf cs-etm: Fix timeless decode mode detection In this context, timeless refers to the trace data rather than the perf event data. But when detecting whether there are timestamps in the trace data or not, the presence of a timestamp flag on any perf event is used. Since commit f42c0ce573df ("perf record: Always get text_poke events with --kcore option") timestamps were added to a tracking event when --kcore is used which breaks this detection mechanism. Fix it by detecting if trace timestamps exist by looking at the ETM config flags. This would have always been a more accurate way of doing it anyway. This fixes the following error message when using --kcore with Coresight: $ perf record --kcore -e cs_etm// --per-thread $ perf report The perf.data/data data has no samples! Fixes: f42c0ce573df79d1 ("perf record: Always get text_poke events with --kcore option") Reported-by: Yang Shi Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: denik@google.com Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/lkml/CAHbLzkrJQTrYBtPkf=jf3OpQ-yBcJe7XkvQstX9j2frz4WF-SQ@mail.gmail.com/ Link: https://lore.kernel.org/r/20230424134748.228137-2-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit ce1d3bc2733224573600e5564203345caea814eb Author: Arnaldo Carvalho de Melo Date: Thu Apr 20 15:54:11 2023 -0300 perf evsel: Introduce evsel__name_is() method to check if the evsel name is equal to a given string This makes the logic a bit clear by avoiding the !strcmp() pattern and also a way to intercept the pointer if we need to do extra validation on it or to do lazy setting of evsel->name via evsel__name(evsel). Reviewed-by: "Liang, Kan" Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZEGLM8VehJbS0gP2@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d88867a24fa7e9c75b8f86df20d4f40e2fe61e9b Merge: 1a261a6e10e80 60261442c1b91 Author: Linus Torvalds Date: Mon Apr 24 10:26:22 2023 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM development updates from Russell King: "Four changes for v6.4: - simplify the path to the top vmlinux - three patches to fix vfp with instrumentation enabled (eg lockdep)" * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9294/2: vfp: Fix broken softirq handling with instrumentation enabled ARM: 9293/1: vfp: Pass successful return address via register R3 ARM: 9292/1: vfp: Pass thread_info pointer to vfp_support_entry ARM: 9291/1: decompressor: simplify the path to the top vmlinux commit 1a261a6e10e80cd7c69c3f5bdf47cd41f928fd08 Author: Ruihan Li Date: Tue Apr 25 00:21:10 2023 +0800 scripts: Remove ICC-related dead code Intel compiler support has already been completely removed in commit 95207db8166a ("Remove Intel compiler support"). However, it appears that there is still some ICC-related code in scripts/cc-version.sh. There is no harm in leaving the code as it is, but removing the dead code makes the codebase a bit cleaner. Hopefully all ICC-related stuff in the build scripts will be removed after this commit, given the grep output as below: (linux/scripts) $ grep -i -w -R 'icc' cc-version.sh:ICC) cc-version.sh: min_version=$($min_tool_version icc) dtc/include-prefixes/arm64/qcom/sm6350.dtsi:#include Fixes: 95207db8166a ("Remove Intel compiler support") Signed-off-by: Ruihan Li Reviewed-by: Nick Desaulniers Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit d3f2c402e44887e507b65d65f0d0515d46575bf5 Merge: 21def611d8297 73d73f5ee7fb0 ddd66d6347351 0ba4962d01b6a 34ea427e01ea6 Author: Rafael J. Wysocki Date: Mon Apr 24 18:37:20 2023 +0200 Merge branches 'pm-core', 'pm-sleep', 'pm-opp' and 'pm-tools' Merge PM core changes, updates related to system sleep support, operating performance points (OPP) changes and power management utilities changes for 6.4-rc1: - Drop unnecessary (void *) conversions from the PM core (Li zeming). - Add sysfs files to represent time spent in a platform sleep state during suspend-to-idle and make AMD and Intel PMC drivers use them (Mario Limonciello). - Use of_property_present() for testing DT property presence (Rob Herring). - Add set_required_opps() callback to the 'struct opp_table', to make the code paths cleaner (Viresh Kumar). - Update the pm-graph siute of utilities to v5.11 with the following changes: * New script which allows users to install the latest pm-graph from the upstream github repo. * Update all the dmesg suspend/resume PM print formats to be able to process recent timelines using dmesg only. * Add ethtool output to the log for the system's ethernet device if ethtool exists. * Make the tool more robustly handle events where mangled dmesg or ftrace outputs do not include all the requisite data. - Make the sleepgraph utility recognize "CPU killed" messages (Xueqin Luo). * pm-core: PM: core: Remove unnecessary (void *) conversions * pm-sleep: platform/x86/intel/pmc: core: Report duration of time in HW sleep state platform/x86/intel/pmc: core: Always capture counters on suspend platform/x86/amd: pmc: Report duration of time in hw sleep state PM: Add sysfs files to represent time spent in hardware sleep state * pm-opp: OPP: Move required opps configuration to specialized callback OPP: Handle all genpd cases together in _set_required_opps() opp: Use of_property_present() for testing DT property presence * pm-tools: PM: tools: sleepgraph: Recognize "CPU killed" messages pm-graph: Update to v5.11 commit 21def611d82976a1dca8c29b800194f29e013151 Merge: 640324e3e62b5 f914bfdd7f846 Author: Rafael J. Wysocki Date: Mon Apr 24 18:36:07 2023 +0200 Merge branch 'pm-cpuidle' Merge a cpuidle change for 6.4-rc1: - Use of_property_present() for testing DT property presence in the cpuidle code (Rob Herring). * pm-cpuidle: cpuidle: Use of_property_present() for testing DT property presence commit 640324e3e62b5d0fada90a6d120d540956b4774b Merge: 8271f3846fa81 0bdd95cede51d Author: Rafael J. Wysocki Date: Mon Apr 24 18:24:47 2023 +0200 Merge branch 'pm-cpufreq' Merge cpufreq updates for 6.4-rc1: - Fix the frequency unit in cpufreq_verify_current_freq checks() (Sanjay Chandrashekara). - Make mode_state_machine in amd-pstate static (Tom Rix). - Make the cpufreq core require drivers with target_index() to set freq_table (Viresh Kumar). - Fix typo in the ARM_BRCMSTB_AVS_CPUFREQ Kconfig entry (Jingyu Wang). - Use of_property_read_bool() for boolean properties in the pmac32 cpufreq driver (Rob Herring). - Make the cpufreq sysfs interface return proper error codes on obviously invalid input (qinyu). - Add guided autonomous mode support to the AMD P-state driver (Wyes Karny). - Make the Intel P-state driver enable HWP IO boost on all server platforms (Srinivas Pandruvada). - Add opp and bandwidth support to tegra194 cpufreq driver (Sumit Gupta). - Use of_property_present() for testing DT property presence (Rob Herring). - Remove MODULE_LICENSE in non-modules (Nick Alcock). - Add SM7225 to cpufreq-dt-platdev blocklist (Luca Weiss). - Optimizations and fixes for qcom-cpufreq-hw driver (Krzysztof Kozlowski, Konrad Dybcio, and Bjorn Andersson). - DT binding updates for qcom-cpufreq-hw driver (Konrad Dybcio and Bartosz Golaszewski). - Updates and fixes for mediatek driver (Jia-Wei Chang and AngeloGioacchino Del Regno). * pm-cpufreq: (29 commits) cpufreq: use correct unit when verify cur freq cpufreq: tegra194: add OPP support and set bandwidth cpufreq: amd-pstate: Make varaiable mode_state_machine static cpufreq: drivers with target_index() must set freq_table cpufreq: qcom-cpufreq-hw: Revert adding cpufreq qos dt-bindings: cpufreq: cpufreq-qcom-hw: Add QCM2290 dt-bindings: cpufreq: cpufreq-qcom-hw: Sanitize data per compatible dt-bindings: cpufreq: cpufreq-qcom-hw: Allow just 1 frequency domain cpufreq: Add SM7225 to cpufreq-dt-platdev blocklist cpufreq: qcom-cpufreq-hw: fix double IO unmap and resource release on exit cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623 cpufreq: mediatek: raise proc/sram max voltage for MT8516 cpufreq: mediatek: fix KP caused by handler usage after regulator_put/clk_put cpufreq: mediatek: fix passing zero to 'PTR_ERR' cpufreq: pmac32: Use of_property_read_bool() for boolean properties cpufreq: Fix typo in the ARM_BRCMSTB_AVS_CPUFREQ Kconfig entry cpufreq: warn about invalid vals to scaling_max/min_freq interfaces Documentation: cpufreq: amd-pstate: Update amd_pstate status sysfs for guided cpufreq: amd-pstate: Add guided mode control support via sysfs cpufreq: amd-pstate: Add guided autonomous mode ... commit 4f810294e00bd99da9ec3c8fe3185a73e39bcd6c Merge: 21fc506cf5ef5 2c5a06e5505a7 55f4f6ead46c0 Author: Rafael J. Wysocki Date: Mon Apr 24 18:07:56 2023 +0200 Merge branches 'acpi-utils' and 'acpi-docs' Merge ACPI utilities and documentation updates for 6.4-rc1: - Fix acpi_evaluate_dsm_typed() redefinition error (Kiran K). - Update the pm_profile sysfs attribute documentation (Rafael Wysocki). * acpi-utils: ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error * acpi-docs: ACPI: docs: Update the pm_profile sysfs attribute documentation commit 21fc506cf5ef5de9c2cdc04036e35169d2b3e7d6 Merge: 0f318baaf23d0 faae443738c6f abe4f5ae5efa6 45166620b7254 Author: Rafael J. Wysocki Date: Mon Apr 24 18:01:57 2023 +0200 Merge branches 'acpi-bus', 'acpi-video' and 'acpi-misc' Merge ACPI bus type driver changes, ACPI backlight driver updates and a series of cleanups related to of.h for 6.4-rc1: - Ensure that ACPI notify handlers are not running after removal and clean up code in acpi_sb_notify() (Rafael Wysocki). - Remove register_backlight_delay module option and code and remove quirks for false-positive backlight control support advertised on desktop boards (Hans de Goede). - Replace irqdomain.h include with struct declarations in ACPI headers and update several pieces of code previously including of.h implicitly through those headers (Rob Herring). * acpi-bus: ACPI: bus: Ensure that notify handlers are not running after removal ACPI: bus: Add missing braces to acpi_sb_notify() * acpi-video: ACPI: video: Remove desktops without backlight DMI quirks ACPI: video: Remove register_backlight_delay module option and code * acpi-misc: ACPI: Replace irqdomain.h include with struct declarations fpga: lattice-sysconfig-spi: Add explicit include for of.h tpm: atmel: Add explicit include for of.h virtio-mmio: Add explicit include for of.h pata: ixp4xx: Add explicit include for of.h ata: pata_macio: Add explicit include of irqdomain.h serial: 8250_tegra: Add explicit include for of.h net: rfkill-gpio: Add explicit include for of.h staging: iio: resolver: ad2s1210: Add explicit include for of.h iio: adc: ad7292: Add explicit include for of.h commit 0f318baaf23d0feb939cf9d3251712198c429879 Merge: 0e838286080d0 f1e65718ec185 1fbd9029c8d5c 3bd554e03ef41 0dc9a715578b0 Author: Rafael J. Wysocki Date: Mon Apr 24 17:54:02 2023 +0200 Merge branches 'acpi-apei', 'acpi-properties', 'acpi-sbs' and 'acpi-thermal' Merge ACPI APEI changes, ACPI device properties handling update, ACPI SBS driver fixes and ACPI thermal driver cleanup for 6.4-rc1: - Make the APEI error injection code warn on invalid arguments when explicitly indicated by platform (Shuai Xue). - Add CXL error types to the error injection code in APEI (Tony Luck). - Refactor acpi_data_prop_read_single() (Andy Shevchenko). - Fix two issues in the ACPI SBS driver (Armin Wolf). - Replace ternary operator with min_t() in the generic ACPI thermal zone driver (Jiangshan Yi). * acpi-apei: ACPI: APEI: EINJ: warn on invalid argument when explicitly indicated by platform ACPI: APEI: EINJ: Add CXL error types * acpi-properties: ACPI: property: Refactor acpi_data_prop_read_single() * acpi-sbs: ACPI: SBS: Fix handling of Smart Battery Selectors ACPI: EC: Fix oops when removing custom query handlers ACPI: EC: Limit explicit removal of query handlers to custom query handlers * acpi-thermal: ACPI: thermal: Replace ternary operator with min_t() commit 0e838286080d0f458aa20751b15f35f3a7924830 Merge: c90b29cede952 073828e954459 f2cba54a7fbf9 47d26684185d0 4f855dcead6c5 Author: Rafael J. Wysocki Date: Mon Apr 24 17:45:49 2023 +0200 Merge branches 'acpi-processor', 'acpi-pm', 'acpi-tables' and 'acpi-sysfs' Merge ACPI processor driver changes, ACPI power management updates, changes related to parsing ACPI tables and an ACPI sysfs interface update for 6.4-rc1: - Fix evaluating the _PDC ACPI control method when running as Xen dom0 (Roger Pau Monne). - Use platform devices to load ACPI PPC and PCC drivers (Petr Pavlu). - Check for null return of devm_kzalloc() in fch_misc_setup() (Kang Chen). - Log a message if enable_irq_wake() fails for the ACPI SCI (Simon Gaiser). - Initialize the correct IOMMU fwspec while parsing ACPI VIOT (Jean-Philippe Brucker). - Amend indentation and prefix error messages with FW_BUG in the ACPI SPCR parsing code (Andy Shevchenko). - Enable ACPI sysfs support for CCEL records (Kuppuswamy Sathyanarayanan). * acpi-processor: ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 ACPI: cpufreq: Use platform devices to load ACPI PPC and PCC drivers ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() * acpi-pm: ACPI: s2idle: Log when enabling wakeup IRQ fails * acpi-tables: ACPI: VIOT: Initialize the correct IOMMU fwspec ACPI: SPCR: Amend indentation ACPI: SPCR: Prefix error messages with FW_BUG * acpi-sysfs: ACPI: sysfs: Enable ACPI sysfs support for CCEL records commit c963e2ec095cb3f855890be53f56f5a6c6fbe371 Author: Hans de Goede Date: Fri Apr 21 20:37:14 2023 +0200 ASoC: Intel: soc-acpi-byt: Fix "WM510205" match no longer working Commit 7e1d728a94ca ("ASoC: Intel: soc-acpi-byt: Add new WM5102 ACPI HID") added an extra HID to wm5102_comp_ids.codecs, but it forgot to bump wm5102_comp_ids.num_codecs, causing the last codec HID in the codecs list to no longer work. Bump wm5102_comp_ids.num_codecs to fix this. Fixes: 7e1d728a94ca ("ASoC: Intel: soc-acpi-byt: Add new WM5102 ACPI HID") Signed-off-by: Hans de Goede Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230421183714.35186-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit 9e868ca1f269dec9f2062bb8de42b8a94773924e Author: Maxim Kochetkov Date: Sat Apr 22 00:19:50 2023 +0300 ASoC: max98090: make it selectable There is no way to select max98090 from menuconfig right now. Add a Kconfig menu description to allow building the driver standalone. It will allow this codec to be used by any other I2S master without adding extra sound card entry in Kconfig. Signed-off-by: Maxim Kochetkov Link: https://lore.kernel.org/r/20230421211950.20972-1-fido_max@inbox.ru Signed-off-by: Mark Brown commit c90b29cede952452f76477296cef3ef411727dd3 Merge: 03c57b0160f62 df2286655ce12 Author: Rafael J. Wysocki Date: Mon Apr 24 17:31:41 2023 +0200 Merge branch 'acpica' Merge ACPICA material for 6.4-rc1: - Delete bogus node_array array of pointers from AEST table (Jessica Clarke). - Add support for trace buffer extension in GICC to the ACPI MADT parser (Xiongfeng Wang). - Add missing macro ACPI_FUNCTION_TRACE() for acpi_ns_repair_HID() (Xiongfeng Wang). - Add missing tables to astable (Pedro Falcato). - Add support for 64 bit loong_arch compilation to ACPICA (Huacai Chen). - Add support for ASPT table in disassembler to ACPICA (Jeremi Piotrowski). - Add support for Arm's MPAM ACPI table version 2 (Hesham Almatary). - Update all copyrights/signons in ACPICA to 2023 (Bob Moore). - Add support for ClockInput resource (v6.5) (Niyas Sait). - Add RISC-V INTC interrupt controller definition to the list of supported interrupt controllers for MADT (Sunil V L). - Add structure definitions for the RISC-V RHCT ACPI table (Sunil V L). - Address several cases in which the ACPICA code might lead to undefined behavior (Tamir Duberstein). - Make ACPICA code support flexible arrays properly (Kees Cook). - Check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects() (void0red). - Add os specific support for Zephyr RTOS to ACPICA (Najumon). - Update version to 20230331 (Bob Moore). * acpica: (32 commits) ACPICA: Update version to 20230331 ACPICA: add os specific support for Zephyr RTOS ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects ACPICA: acpi_resource_irq: Replace 1-element arrays with flexible array ACPICA: acpi_madt_oem_data: Fix flexible array member definition ACPICA: acpi_dmar_andd: Replace 1-element array with flexible array ACPICA: acpi_pci_routing_table: Replace fixed-size array with flex array member ACPICA: struct acpi_resource_dma: Replace 1-element array with flexible array ACPICA: Introduce ACPI_FLEX_ARRAY ACPICA: struct acpi_nfit_interleave: Replace 1-element array with flexible array ACPICA: actbl2: Replace 1-element arrays with flexible arrays ACPICA: actbl1: Replace 1-element arrays with flexible arrays ACPICA: struct acpi_resource_vendor: Replace 1-element array with flexible array ACPICA: Avoid undefined behavior: load of misaligned address ACPICA: Avoid undefined behavior: member access within misaligned address ACPICA: Avoid undefined behavior: member access within misaligned address ACPICA: Avoid undefined behavior: member access within misaligned address ACPICA: Avoid undefined behavior: member access within misaligned address ACPICA: Avoid undefined behavior: member access within null pointer ACPICA: Avoid undefined behavior: applying zero offset to null pointer ... commit e2a1406c84c43bd104e2f85c4d8ab0b0b1609ab0 Author: Cristian Ciocaltea Date: Wed Apr 19 21:13:08 2023 +0300 dt-bindings: timer: rockchip: Add rk3588 compatible Add compatible string for Rockchip RK3588 timer. Signed-off-by: Cristian Ciocaltea Reviewed-by: Heiko Stuebner Acked-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230419181309.338354-3-cristian.ciocaltea@collabora.com commit 51010c1dc487e7764b7e1ec1c4954068e5880757 Author: Cristian Ciocaltea Date: Wed Apr 19 21:13:07 2023 +0300 dt-bindings: timer: rockchip: Drop superfluous rk3288 compatible The compatible string for Rockchip RK3288 is wrongly provided in the 'enum' item, in addition to the subsequent 'const', which allows the usage of an incorrect specification: compatible = "rockchip,rk3288-timer", "rockchip,rk3288-timer"; As the rk3288 string is also specified in the top-most 'const' item, the binding already allows the usage of the correct variant: compatible = "rockchip,rk3288-timer"; Drop the unwanted rk3288 entry from the enum. Fixes: faa186adbd06 ("dt-bindings: timer: convert rockchip,rk-timer.txt to YAML") Signed-off-by: Cristian Ciocaltea Reviewed-by: Heiko Stuebner Reviewed-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230419181309.338354-2-cristian.ciocaltea@collabora.com commit 87dd04f9b1a37a92ebbea5eb46e4941551d3547e Author: Rob Herring Date: Fri Mar 10 08:47:01 2023 -0600 clocksource/drivers/ti: Use of_property_read_bool() for boolean properties It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. Convert reading boolean properties to to of_property_read_bool(). Signed-off-by: Rob Herring Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230310144702.1541660-1-robh@kernel.org commit 8d7aac5153f21108365137b76e395dcf9bb3a800 Author: Tony Lindgren Date: Wed Apr 12 09:41:41 2023 +0300 clocksource/drivers/timer-ti-dm: Fix finding alwon timer Clean-up commit b6999fa1c847 ("clocksource/drivers/timer-ti-dm: Use of_address_to_resource()") caused a regression where pa is never set making all related SoCs fail to boot. Let's fix this by setting pa if found. Fixes: b6999fa1c847 ("clocksource/drivers/timer-ti-dm: Use of_address_to_resource()") Cc: Rob Herring Signed-off-by: Tony Lindgren Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230412064142.12726-1-tony@atomide.com commit fb73556386e074e9bee9fa2d253aeaefe4e063e0 Author: Qinrun Dai Date: Thu Apr 13 13:50:37 2023 +0000 clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails Smatch reports: drivers/clocksource/timer-davinci.c:332 davinci_timer_register() warn: 'base' from ioremap() not released on lines: 274. Fix this and other potential memory leak problems by adding a set of corresponding exit lables. Fixes: 721154f972aa ("clocksource/drivers/davinci: Add support for clockevents") Signed-off-by: Qinrun Dai Link: https://lore.kernel.org/r/20230413135037.1505799-1-flno@hust.edu.cn Signed-off-by: Daniel Lezcano commit b6f228e800ccf285906bb1c4c366ce3848a5443e Author: Krzysztof Kozlowski Date: Sat Mar 11 18:38:03 2023 +0100 clocksource/drivers/stm32-lp: Drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). drivers/clocksource/timer-stm32-lp.c:203:34: error: ‘stm32_clkevent_lp_of_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230311173803.263446-1-krzysztof.kozlowski@linaro.org commit b1f0390048e2641d3451f8cdbbef24c79d1a8fdd Author: Uwe Kleine-König Date: Mon Mar 13 08:54:30 2023 +0100 clocksource/drivers/timer-ti-dm: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230313075430.2730803-6-u.kleine-koenig@pengutronix.de commit d7b76421c03fa58d16a52eb839302f582602997a Author: Uwe Kleine-König Date: Mon Mar 13 08:54:29 2023 +0100 clocksource/drivers/timer-tegra186: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230313075430.2730803-5-u.kleine-koenig@pengutronix.de commit 8efcbe927c5129d5b2528bbb40034c7dde87a6b6 Author: Uwe Kleine-König Date: Mon Mar 13 08:54:28 2023 +0100 clocksource/drivers/timer-ti-dm: Improve error message in .remove If a platform driver's remove callback returns an error code, the driver core emits a generic (and thus little helpful) error message. Instead emit a more specifc error message about the actual error and return zero to suppress the core's message. Note that returning zero has no side effects apart from not emitting said error message. This prepares converting platform driver's remove message to return void. Signed-off-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230313075430.2730803-4-u.kleine-koenig@pengutronix.de commit ede38f924a9e3c60382a13576347dc41967e8762 Author: Uwe Kleine-König Date: Mon Mar 13 08:54:27 2023 +0100 clocksource/drivers/timer-stm32-lp: Mark driver as non-removable The comment in the remove callback suggests that the driver is not supposed to be unbound. However returning an error code in the remove callback doesn't accomplish that. Instead set the suppress_bind_attrs property (which makes it impossible to unbind the driver via sysfs). The only remaining way to unbind an stm32-lp device would be module unloading, but that doesn't apply here, as the driver cannot be built as a module. Also drop the useless remove callback. [dlezcano] : Fixed up the wrong function removed Signed-off-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230313075430.2730803-3-u.kleine-koenig@pengutronix.de commit 78012e3880a62e0eb130a0b5a10230162ad42a06 Author: Uwe Kleine-König Date: Mon Mar 13 08:54:26 2023 +0100 clocksource/drivers/sh_mtu2: Mark driver as non-removable The comment in the remove callback suggests that the driver is not supposed to be unbound. However returning an error code in the remove callback doesn't accomplish that. Instead set the suppress_bind_attrs property (which makes it impossible to unbind the driver via sysfs). The only remaining way to unbind a sh_tmu2 device would be module unloading, but that doesn't apply here, as the driver cannot be built as a module. Also drop the useless remove callback. Signed-off-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230313075430.2730803-2-u.kleine-koenig@pengutronix.de commit 0fabf9f3a0c1ca44e01c5c4dccacfe69143413c5 Author: Rob Herring Date: Sun Mar 19 11:32:20 2023 -0500 clocksource/drivers/timer-ti-dm: Use of_address_to_resource() Replace of_get_address() and of_translate_address() calls with single call to of_address_to_resource(). Signed-off-by: Rob Herring Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230319163220.226273-1-robh@kernel.org commit f68a40ee4732731f149961abab27a45b6c11f413 Author: Fabio Estevam Date: Tue Mar 7 09:43:13 2023 -0300 clocksource/drivers/timer-imx-gpt: Remove non-DT function mxc_timer_init() was originally only used by non-DT i.MX platforms. i.MX has already been converted to be a DT-only platform. Remove the unused mxc_timer_init() function. Signed-off-by: Fabio Estevam Acked-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230307124313.708255-1-festevam@denx.de commit 49d576ea72a4fa5be15717babfa308b70b2bc5a4 Author: AngeloGioacchino Del Regno Date: Thu Mar 9 11:39:13 2023 +0100 clocksource/drivers/timer-mediatek: Split out CPUXGPT timers On MediaTek platforms, CPUXGPT is the source for the AArch64 System Timer, read through CNTVCT_EL0. The handling for starting this timer ASAP was introduced in commit 327e93cf9a59 ("clocksource/drivers/timer-mediatek: Implement CPUXGPT timers") which description also contains an important full explanation of the reasons why this driver is necessary and cannot be a module. In preparation for an eventual conversion of timer-mediatek to a platform_driver that would be possibly built as a module, split out the CPUXGPT timers driver to a new timer-mediatek-cpux.c driver. This commit brings no functional changes. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Walter Chang Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230309103913.116775-1-angelogioacchino.delregno@collabora.com commit fd3f088f35f610a7ee3045b7d172b362342e43c6 Author: Krzysztof Kozlowski Date: Mon Apr 3 11:40:17 2023 +0200 clocksource/drivers/exynos_mct: Explicitly return 0 for shared timer For a shared timers, the mct_init_dt() should not initialize the clock even with global comparator. This is not an error, thus the function should simply return 0, not 'ret'. This also fixes smatch warning: drivers/clocksource/exynos_mct.c:635 mct_init_dt() warn: missing error code? 'ret' Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202304021446.46XVKag0-lkp@intel.com/ Signed-off-by: Krzysztof Kozlowski Reviewed-by: Vincent Whitchurch Reviewed-by: Alim Akhtar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230403094017.9556-1-krzysztof.kozlowski@linaro.org commit c9c8133080c75ce2440001d765dbe8c24f932ea2 Merge: 1b47b80e2fa77 6486a57f05d3d Author: Petr Mladek Date: Mon Apr 24 16:49:08 2023 +0200 Merge branch 'for-6.4/doc' into for-linus commit 83794367dcc6749662b17a1e4b8ec085023fc53b Author: Damien Le Moal Date: Mon Apr 24 22:13:18 2023 +0900 block: Cleanup set_capacity()/bdev_set_nr_sectors() The code for setting a block device capacity (bd_nr_sectors field of struct block_device) is duplicated in set_capacity() and bdev_set_nr_sectors(). Clean this up by making bdev_set_nr_sectors() a block layer internal function defined in block/bdev.c instead of having this function statically defined in block/partitions/core.c. With this change, set_capacity() implementation can be simplified to only calling bdev_set_nr_sectors(). Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230424131318.79935-1-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 32c2f2a46db1322caaf78d5ea747ed5c56d2e353 Author: Andrew Halaney Date: Thu Apr 13 14:15:39 2023 -0500 clk: qcom: gcc-sc8280xp: Add EMAC GDSCs Add the EMAC GDSCs to allow the EMAC hardware to be enabled. Acked-by: Stephen Boyd Reviewed-by: Konrad Dybcio Tested-by: Brian Masney Signed-off-by: Andrew Halaney Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230413191541.1073027-2-ahalaney@redhat.com commit 36cd9fb5344675e9b9d9f96eabcb3cdfdbacc841 Author: Andreas Kemnade Date: Wed Apr 19 13:18:05 2023 +0200 dt-bindings: leds: Add ROHM BD2606MVV LED Document ROHM BD2606MVV LED driver devicetree bindings. Signed-off-by: Andreas Kemnade Reviewed-by: Matti Vaittinen Reviewed-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230419111806.1100437-2-andreas@kemnade.info commit bd8621ca1510e6e802df9855bdc35a04a3cfa932 Author: Jarkko Sakkinen Date: Sun Apr 23 18:49:58 2023 +0300 tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site The following crash was reported: [ 1950.279393] list_del corruption, ffff99560d485790->next is NULL [ 1950.279400] ------------[ cut here ]------------ [ 1950.279401] kernel BUG at lib/list_debug.c:49! [ 1950.279405] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 1950.279407] CPU: 11 PID: 5886 Comm: modprobe Tainted: G O 6.2.8_1 #1 [ 1950.279409] Hardware name: Gigabyte Technology Co., Ltd. B550M AORUS PRO-P/B550M AORUS PRO-P, BIOS F15c 05/11/2022 [ 1950.279410] RIP: 0010:__list_del_entry_valid+0x59/0xc0 [ 1950.279415] Code: 48 8b 01 48 39 f8 75 5a 48 8b 72 08 48 39 c6 75 65 b8 01 00 00 00 c3 cc cc cc cc 48 89 fe 48 c7 c7 08 a8 13 9e e8 b7 0a bc ff <0f> 0b 48 89 fe 48 c7 c7 38 a8 13 9e e8 a6 0a bc ff 0f 0b 48 89 fe [ 1950.279416] RSP: 0018:ffffa96d05647e08 EFLAGS: 00010246 [ 1950.279418] RAX: 0000000000000033 RBX: ffff99560d485750 RCX: 0000000000000000 [ 1950.279419] RDX: 0000000000000000 RSI: ffffffff9e107c59 RDI: 00000000ffffffff [ 1950.279420] RBP: ffffffffc19c5168 R08: 0000000000000000 R09: ffffa96d05647cc8 [ 1950.279421] R10: 0000000000000003 R11: ffffffff9ea2a568 R12: 0000000000000000 [ 1950.279422] R13: ffff99560140a2e0 R14: ffff99560127d2e0 R15: 0000000000000000 [ 1950.279422] FS: 00007f67da795380(0000) GS:ffff995d1f0c0000(0000) knlGS:0000000000000000 [ 1950.279424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1950.279424] CR2: 00007f67da7e65c0 CR3: 00000001feed2000 CR4: 0000000000750ee0 [ 1950.279426] PKRU: 55555554 [ 1950.279426] Call Trace: [ 1950.279428] [ 1950.279430] hwrng_unregister+0x28/0xe0 [rng_core] [ 1950.279436] tpm_chip_unregister+0xd5/0xf0 [tpm] Add the forgotten !tpm_amd_is_rng_defective() invariant to the hwrng_unregister() call site inside tpm_chip_unregister(). Cc: stable@vger.kernel.org Reported-by: Martin Dimov Link: https://lore.kernel.org/linux-integrity/3d1d7e9dbfb8c96125bc93b6b58b90a7@dmarto.com/ Fixes: f1324bbc4011 ("tpm: disable hwrng for fTPM on some AMD designs") Fixes: b006c439d58d ("hwrng: core - start hwrng kthread also for untrusted sources") Tested-by: Martin Dimov Signed-off-by: Jarkko Sakkinen commit 77218e83c83c1cd4b994edfb5b162ece42e73ffe Author: Haris Okanovic Date: Wed Apr 19 17:41:30 2023 +0200 tpm_tis: fix stall after iowrite*()s ioread8() operations to TPM MMIO addresses can stall the CPU when immediately following a sequence of iowrite*()'s to the same region. For example, cyclitest measures ~400us latency spikes when a non-RT usermode application communicates with an SPI-based TPM chip (Intel Atom E3940 system, PREEMPT_RT kernel). The spikes are caused by a stalling ioread8() operation following a sequence of 30+ iowrite8()s to the same address. I believe this happens because the write sequence is buffered (in CPU or somewhere along the bus), and gets flushed on the first LOAD instruction (ioread*()) that follows. The enclosed change appears to fix this issue: read the TPM chip's access register (status code) after every iowrite*() operation to amortize the cost of flushing data to chip across multiple instructions. Signed-off-by: Haris Okanovic Link: https://lore.kernel.org/r/20230323153436.B2SATnZV@linutronix.de Signed-off-by: Sebastian Andrzej Siewior Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 7b69ef62034492b816c65b1d15b45834df2b194e Author: Uwe Kleine-König Date: Mon Mar 20 09:06:07 2023 +0100 tpm/tpm_tis_synquacer: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit c3da2c6eeb10e71cc7be33c4b17ced60024fd9b0 Author: Uwe Kleine-König Date: Mon Mar 20 09:06:06 2023 +0100 tpm/tpm_tis: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit bd88328607c4650ee8e7746a287375c5a618d09e Author: Uwe Kleine-König Date: Mon Mar 20 09:06:05 2023 +0100 tpm/tpm_ftpm_tee: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. ftpm_tee_remove() returns zero unconditionally (and cannot easily converted to return void). So ignore the return value to be able to make ftpm_plat_tee_remove() return void. Signed-off-by: Uwe Kleine-König Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 3fb29a23fcdadc9d7b60d323bbc1d9896249f6ac Author: Krzysztof Kozlowski Date: Sat Mar 11 18:35:41 2023 +0100 tpm: tpm_tis_spi: Mark ACPI and OF related data as maybe unused The driver can be compile tested with !CONFIG_OF or !CONFIG_ACPI making unused: drivers/char/tpm/tpm_tis_spi_main.c:234:34: error: ‘of_tis_spi_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jarkko Sakkinen commit c3985d8b9c224b359851f0a521ad25a83db6bdca Author: Krzysztof Kozlowski Date: Sat Mar 11 18:35:40 2023 +0100 tpm: st33zp24: Mark ACPI and OF related data as maybe unused The driver can be compile tested with !CONFIG_OF or !CONFIG_ACPI making drivers/char/tpm/st33zp24/i2c.c:141:34: error: ‘of_st33zp24_i2c_match’ defined but not used [-Werror=unused-const-variable=] drivers/char/tpm/st33zp24/spi.c:258:34: error: ‘of_st33zp24_spi_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jarkko Sakkinen commit e644b2f498d297a928efcb7ff6f900c27f8b788e Author: Lino Sanfilippo Date: Thu Nov 24 14:55:38 2022 +0100 tpm, tpm_tis: Enable interrupt test The test for interrupts in tpm_tis_send() is skipped if the flag TPM_CHIP_FLAG_IRQ is not set. Since the current code never sets the flag initially the test is never executed. Fix this by setting the flag in tpm_tis_gen_interrupt() right after interrupts have been enabled and before the test is executed. Signed-off-by: Lino Sanfilippo Tested-by: Michael Niewöhner Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 548eb516ec0f7a484a23a902835899341164b8ea Author: Lino Sanfilippo Date: Thu Nov 24 14:55:37 2022 +0100 tpm, tpm_tis: startup chip before testing for interrupts In tpm_tis_gen_interrupt() a request for a property value is sent to the TPM to test if interrupts are generated. However after a power cycle the TPM responds with TPM_RC_INITIALIZE which indicates that the TPM is not yet properly initialized. Fix this by first starting the TPM up before the request is sent. For this the startup implementation is removed from tpm_chip_register() and put into the new function tpm_chip_startup() which is called before the interrupts are tested. Signed-off-by: Lino Sanfilippo Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 955df4f87760b3bb2af253d3fbb12fb712b3ffa6 Author: Lino Sanfilippo Date: Thu Nov 24 14:55:36 2022 +0100 tpm, tpm_tis: Claim locality when interrupts are reenabled on resume In tpm_tis_resume() make sure that the locality has been claimed when tpm_tis_reenable_interrupts() is called. Otherwise the writings to the register might not have any effect. Fixes: 45baa1d1fa39 ("tpm_tis: Re-enable interrupts upon (S3) resume") Signed-off-by: Lino Sanfilippo Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 0e069265bce5a40c4eee52e2364bbbd4dabee94a Author: Lino Sanfilippo Date: Thu Nov 24 14:55:35 2022 +0100 tpm, tpm_tis: Claim locality in interrupt handler Writing the TPM_INT_STATUS register in the interrupt handler to clear the interrupts only has effect if a locality is held. Since this is not guaranteed at the time the interrupt is fired, claim the locality explicitly in the handler. Signed-off-by: Lino Sanfilippo Tested-by: Michael Niewöhner Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 0c7e66e5fd69bf21034c9a9b081d7de7c3eb2cea Author: Lino Sanfilippo Date: Thu Nov 24 14:55:34 2022 +0100 tpm, tpm_tis: Request threaded interrupt handler The TIS interrupt handler at least has to read and write the interrupt status register. In case of SPI both operations result in a call to tpm_tis_spi_transfer() which uses the bus_lock_mutex of the spi device and thus must only be called from a sleepable context. To ensure this request a threaded interrupt handler. Signed-off-by: Lino Sanfilippo Tested-by: Michael Niewöhner Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 7a2f55d0be296c4e81fd782f3d6c43ed4ec7e265 Author: Lino Sanfilippo Date: Thu Nov 24 14:55:33 2022 +0100 tpm, tpm: Implement usage counter for locality Implement a usage counter for the (default) locality used by the TPM TIS driver: Request the locality from the TPM if it has not been claimed yet, otherwise only increment the counter. Also release the locality if the counter is 0 otherwise only decrement the counter. Since in case of SPI the register accesses are locked by means of the SPI bus mutex use a sleepable lock (i.e. also a mutex) to ensure thread-safety of the counter which may be accessed by both a userspace thread and the interrupt handler. By doing this refactor the names of the amended functions to use a more appropriate prefix. Signed-off-by: Lino Sanfilippo Tested-by: Michael Niewöhner Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 35f621287ead686b66aa17aa605ed5d7c95883dc Author: Lino Sanfilippo Date: Thu Nov 24 14:55:32 2022 +0100 tpm, tpm_tis: do not check for the active locality in interrupt handler After driver initialization tpm_tis_data->locality may only be modified in case of a LOCALITY CHANGE interrupt. In this case the interrupt handler iterates over all localities only to assign the active one to tpm_tis_data->locality. However this information is never used any more, so the assignment is not needed. Furthermore without the assignment tpm_tis_data->locality cannot change any more at driver runtime, and thus no protection against concurrent modification is required when the variable is read at other places. So remove this iteration entirely. Signed-off-by: Lino Sanfilippo Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 4303553bced7a1d84583dada552393f5ebd31e54 Author: Lino Sanfilippo Date: Thu Nov 24 14:55:31 2022 +0100 tpm, tpm_tis: Move interrupt mask checks into own function Clean up wait_for_tpm_stat() by moving multiple similar interrupt mask checks into an own function. Signed-off-by: Lino Sanfilippo Suggested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit e87fcf0dc2b47fac5b4824f00f74dfbcd4acd363 Author: Lino Sanfilippo Date: Thu Nov 24 14:55:30 2022 +0100 tpm, tpm_tis: Only handle supported interrupts According to the TPM Interface Specification (TIS) support for "stsValid" and "commandReady" interrupts is only optional. This has to be taken into account when handling the interrupts in functions like wait_for_tpm_stat(). To determine the supported interrupts use the capability query. Also adjust wait_for_tpm_stat() to only wait for interrupt reported status changes. After that process all the remaining status changes by polling the status register. Signed-off-by: Lino Sanfilippo Tested-by: Michael Niewöhner Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 15d7aa4e46eba87242a320f39773aa16faddadee Author: Lino Sanfilippo Date: Thu Nov 24 14:55:29 2022 +0100 tpm, tpm_tis: Claim locality before writing interrupt registers In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR, TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts. Currently these modifications are done without holding a locality thus they have no effect. Fix this by claiming the (default) locality before the registers are written. Since now tpm_tis_gen_interrupt() is called with the locality already claimed remove locality request and release from this function. Signed-off-by: Lino Sanfilippo Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit ed9be0e6c892a783800d77a41ca4c7255c6af8c5 Author: Lino Sanfilippo Date: Thu Nov 24 14:55:28 2022 +0100 tpm, tpm_tis: Do not skip reset of original interrupt vector If in tpm_tis_probe_irq_single() an error occurs after the original interrupt vector has been read, restore the interrupts before the error is returned. Since the caller does not check the error value, return -1 in any case that the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function tpm_tis_gen_interrupt() is not longer used, make it a void function. Fixes: 1107d065fdf1 ("tpm_tis: Introduce intermediate layer for TPM access") Signed-off-by: Lino Sanfilippo Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 6d789ad726950e612a7f31044260337237c5b490 Author: Lino Sanfilippo Date: Thu Nov 24 14:55:27 2022 +0100 tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed Both functions tpm_tis_probe_irq_single() and tpm_tis_probe_irq() may setup the interrupts and then return with an error. This case is indicated by a missing TPM_CHIP_FLAG_IRQ flag in chip->flags. Currently the interrupt setup is only undone if tpm_tis_probe_irq_single() fails. Undo the setup also if tpm_tis_probe_irq() fails. Signed-off-by: Lino Sanfilippo Tested-by: Michael Niewöhner Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 282657a8bd7fddcf511b834f43705001668b33a7 Author: Lino Sanfilippo Date: Thu Nov 24 14:55:26 2022 +0100 tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register In disable_interrupts() the TPM_GLOBAL_INT_ENABLE bit is unset in the TPM_INT_ENABLE register to shut the interrupts off. However modifying the register is only possible with a held locality. So claim the locality before disable_interrupts() is called. Signed-off-by: Lino Sanfilippo Tested-by: Michael Niewöhner Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 858e8b792d06f45c427897bd90205a1d90bf430f Author: Lino Sanfilippo Date: Thu Nov 24 14:55:25 2022 +0100 tpm, tpm_tis: Avoid cache incoherency in test for interrupts The interrupt handler that sets the boolean variable irq_tested may run on another CPU as the thread that checks irq_tested as part of the irq test in tpm_tis_send(). Since nothing guarantees cache coherency between CPUs for unsynchronized accesses to boolean variables the testing thread might not perceive the value change done in the interrupt handler. Avoid this issue by setting the bit TPM_TIS_IRQ_TESTED in the flags field of the tpm_tis_data struct and by accessing this field with the bit manipulating functions that provide cache coherency. Also convert all other existing sites to use the proper macros when accessing this bitfield. Signed-off-by: Lino Sanfilippo Tested-by: Michael Niewöhner Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 099f26f22f5834ad744aee093ed4d11de13cac15 Author: Eric Snowberg Date: Thu Mar 2 11:46:52 2023 -0500 integrity: machine keyring CA configuration Add machine keyring CA restriction options to control the type of keys that may be added to it. The motivation is separation of certificate signing from code signing keys. Subsquent work will limit certificates being loaded into the IMA keyring to code signing keys used for signature verification. When no restrictions are selected, all Machine Owner Keys (MOK) are added to the machine keyring. When CONFIG_INTEGRITY_CA_MACHINE_KEYRING is selected, the CA bit must be true. Also the key usage must contain keyCertSign, any other usage field may be set as well. When CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX is selected, the CA bit must be true. Also the key usage must contain keyCertSign and the digitialSignature usage may not be set. Signed-off-by: Eric Snowberg Acked-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit 76adb2fbc69a13c80b39042aab4d34e99309c8d4 Author: Eric Snowberg Date: Thu Mar 2 11:46:51 2023 -0500 KEYS: CA link restriction Add a new link restriction. Restrict the addition of keys in a keyring based on the key to be added being a CA. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit 567671281a751b80918a4531c4ba84b90a2a42c0 Author: Eric Snowberg Date: Thu Mar 2 11:46:50 2023 -0500 KEYS: X.509: Parse Key Usage Parse the X.509 Key Usage. The key usage extension defines the purpose of the key contained in the certificate. id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } KeyUsage ::= BIT STRING { digitalSignature (0), contentCommitment (1), keyEncipherment (2), dataEncipherment (3), keyAgreement (4), keyCertSign (5), cRLSign (6), encipherOnly (7), decipherOnly (8) } If the keyCertSign or digitalSignature is set, store it in the public_key structure. Having the purpose of the key being stored during parsing, allows enforcement on the usage field in the future. This will be used in a follow on patch that requires knowing the certificate key usage type. Link: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3 Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit 30eae2b037af54b24109dcaea21db46f6285c69b Author: Eric Snowberg Date: Thu Mar 2 11:46:49 2023 -0500 KEYS: X.509: Parse Basic Constraints for CA Parse the X.509 Basic Constraints. The basic constraints extension identifies whether the subject of the certificate is a CA. BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL } If the CA is true, store it in the public_key. This will be used in a follow on patch that requires knowing if the public key is a CA. Link: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9 Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit ef97e774713fcd34c45f7a7426c7d8845394f7be Author: Eric Snowberg Date: Thu Mar 2 11:46:48 2023 -0500 KEYS: Add missing function documentation Compiling with 'W=1' results in warnings that 'Function parameter or member not described' Add the missing parameters for restrict_link_by_builtin_and_secondary_trusted and restrict_link_to_builtin_trusted. Use /* instead of /** for get_builtin_and_secondary_restriction, since it is a static function. Fix wrong function name restrict_link_to_builtin_trusted. Fixes: d3bfe84129f6 ("certs: Add a secondary system keyring that can be added to dynamically") Signed-off-by: Eric Snowberg Reviewed-by: Petr Vorel Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit 7f8da9915fcc6386edf86471bf31e162845930a4 Author: Eric Snowberg Date: Thu Mar 2 11:46:47 2023 -0500 KEYS: Create static version of public_key_verify_signature The kernel test robot reports undefined reference to public_key_verify_signature when CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not defined. Create a static version in this case and return -EINVAL. Fixes: db6c43bd2132 ("crypto: KEYS: convert public key and digsig asym to the akcipher api") Reported-by: kernel test robot Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Petr Vorel Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit eff33245595d7ade7b821c9ed0f688272b16b07b Author: Yu Zhe Date: Thu Mar 16 16:50:37 2023 +0800 tpm: remove unnecessary (void*) conversions Pointer variables of void * type do not require type cast. Signed-off-by: Yu Zhe Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 96785d635bc2b9e6f819cc606424d342a37872b4 Author: Mark Hasemeyer Date: Tue Mar 14 13:54:04 2023 -0600 tpm: cr50: i2c: use jiffies to wait for tpm ready irq When waiting for a tpm ready completion, the cr50 i2c driver incorrectly assumes that the value of timeout_a is represented in milliseconds instead of jiffies. Remove the msecs_to_jiffies conversion. Signed-off-by: Mark Hasemeyer Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit baa6584a24494fbbd2862270d39e61b86987cc91 Merge: 7002cbd625467 dc801ea8ae37d Author: Takashi Iwai Date: Mon Apr 24 15:15:31 2023 +0200 Merge tag 'asoc-v6.4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v6.4 The bulk of the commits here are for the conversion of drivers to use void remove callbacks but there's a reasonable amount of other stuff going on, the pace of development with the SOF code continues to be high and there's a bunch of new drivers too: - More core cleanups from Morimto-san. - Update drivers to have remove() callbacks returning void, mostly mechanical with some substantial changes. - Continued feature and simplification work on SOF, including addition of a no-DSP mode for bringup, HDA MLink and extensions to the IPC4 protocol. - Hibernation support for CS35L45. - More DT binding conversions. - Support for Cirrus Logic CS35L56, Freescale QMC, Maxim MAX98363, nVidia systems with MAX9809x and RT5631, Realtek RT712, Renesas R-Car Gen4, Rockchip RK3588 and TI TAS5733. commit d9f3a60ebbbd7244fe532dc8dcd278ac1651247f Merge: 25f0617109496 967ca91a996f8 Author: Mark Brown Date: Mon Apr 24 12:59:47 2023 +0100 Tegra TPM driver with HW flow control Merge series from Krishna Yarlagadda : TPM devices may insert wait state on last clock cycle of ADDR phase. For SPI controllers that support full-duplex transfers, this can be detected using software by reading the MISO line. For SPI controllers that only support half-duplex transfers, such as the Tegra QSPI, it is not possible to detect the wait signal from software. The QSPI controller in Tegra234 and Tegra241 implement hardware detection of the wait signal which can be enabled in the controller for TPM devices. Add a flag for this in the SPI core and implement support in the Tegra QuadSPI driver. commit d944eafed618a8507270b324ad9d5405bb7f0b3e Author: Ville Syrjälä Date: Tue Apr 18 20:55:14 2023 +0300 drm/i915: Check pipe source size when using skl+ scalers The skl+ scalers only sample 12 bits of PIPESRC so we can't do any plane scaling at all when the pipe source size is >4k. Make sure the pipe source size is also below the scaler's src size limits. Might not be 100% accurate, but should at least be safe. We can refine the limits later if we discover that recent hw is less restricted. Cc: stable@vger.kernel.org Tested-by: Ross Zwisler Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8357 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230418175528.13117-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit 691248d4135fe3fae64b4ee0676bc96a7fd6950c) Signed-off-by: Joonas Lahtinen commit 46e614cc91f7bd6f7872e434e6bcfda44454aac3 Author: Tiezhu Yang Date: Sun Apr 23 09:38:03 2023 +0800 MIPS: uprobes: Restore thread.trap_nr thread.trap_nr is saved in arch_uprobe_pre_xol(), it should be restored in arch_uprobe_{post,abort}_xol() accordingly, actually it was only done in the post function, just do it in the abort function too, this change is similar with x86 and powerpc. Signed-off-by: Tiezhu Yang Signed-off-by: Thomas Bogendoerfer commit 38c87827ffd3c7e1dd61eee9a7dea13d487dc2ed Merge: 9496fffcb28f3 d663d93bb47e7 Author: Wolfram Sang Date: Mon Apr 24 12:50:20 2023 +0200 Merge branch 'i2c/for-current' into i2c/for-mergewindow This should have been in 6.3, but sadly I missed it. commit 2efb07b5ced64d053e6fe6e829e45549aa622168 Merge: fd84c569f7b8b d883a4669a1de Author: David S. Miller Date: Mon Apr 24 11:07:20 2023 +0100 Merge tag 'for-net-next-2023-04-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next bluetooth-next pull request for net-next: - Introduce devcoredump support - Add support for Realtek RTL8821CS, RTL8851B, RTL8852BS - Add support for Mediatek MT7663, MT7922 - Add support for NXP w8997 - Add support for Actions Semi ATS2851 - Add support for QTI WCN6855 - Add support for Marvell 88W8997 commit 60fd497c99b336e466db0aaeff44c7d12a1fc10a Author: Paul Mackerras Date: Mon Apr 24 09:02:32 2023 +1000 MAINTAINERS: Remove PPP maintainer I am not currently maintaining the kernel PPP code, so remove my address from the MAINTAINERS entry for it. Signed-off-by: Paul Mackerras Signed-off-by: David S. Miller commit 60ed3cd85b95184936bce70ed7f9e76a6a54a5e1 Author: Paul Mackerras Date: Mon Apr 24 08:59:16 2023 +1000 MAINTAINERS: Remove rage128 framebuffer driver maintainer I have not worked on this code for years, so remove my name as maintainer. Signed-off-by: Paul Mackerras Signed-off-by: Helge Deller commit b04ab8c13a73c10a97126fbe7076b2fbf632ba03 Author: Thomas Zimmermann Date: Mon Apr 24 10:58:25 2023 +0200 fbdev: vfb: Init owner field of struct fb_ops Initialize the owner field of struct fb_ops. Required to prevent module unloading while the driver is in use. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 25ec15abb06194963157fe42d41368b19a0d0d74 Author: Thomas Zimmermann Date: Mon Apr 24 10:58:24 2023 +0200 fbdev: ps3fb: Init owner field of struct fb_ops Initialize the owner field of struct fb_ops. Required to prevent module unloading while the driver is in use. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 55caa9a7aca0e7685ebb9f5082156e89cae36c4a Author: Thomas Zimmermann Date: Mon Apr 24 10:58:23 2023 +0200 fbdev: 68328fb: Init owner field of struct fb_ops Initialize the owner field of struct fb_ops. Required to prevent module unloading while the driver is in use. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit b3a7a9ab65ae2f2626c7222fb79cdd433f8c5252 Author: Christophe JAILLET Date: Thu Apr 13 21:33:17 2023 +0200 fbdev: mmp: Fix deferred clk handling in mmphw_probe() When dev_err_probe() is called, 'ret' holds the value of the previous successful devm_request_irq() call. 'ret' should be assigned with a meaningful value before being used in dev_err_probe(). While at it, use and return "PTR_ERR(ctrl->clk)" instead of a hard-coded "-ENOENT" so that -EPROBE_DEFER is handled and propagated correctly. Fixes: 81b63420564d ("fbdev: mmp: Make use of the helper function dev_err_probe()") Signed-off-by: Christophe JAILLET Signed-off-by: Helge Deller commit bfff83c4824308f7acce47baf88858b52bc1314f Author: Randy Dunlap Date: Tue Mar 28 19:15:29 2023 -0700 linux/vt_buffer.h: allow either builtin or modular for macros Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m. This allows the ARCH macros to be the only ones defined. In file included from ../drivers/video/console/mdacon.c:37: ../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile' 17 | static inline void scr_writew(u16 val, volatile u16 *addr) | ^~~~~~~~ ../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew' 24 | #define scr_writew(val, addr) (*(addr) = (val)) | ^~~~ ../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token 24 | #define scr_writew(val, addr) (*(addr) = (val)) | ^ ../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew' 17 | static inline void scr_writew(u16 val, volatile u16 *addr) | ^~~~~~~~~~ ../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile' 25 | static inline u16 scr_readw(volatile const u16 *addr) | ^~~~~~~~ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Randy Dunlap Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: dri-devel@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Signed-off-by: Helge Deller commit 0ddc95b59f05c280520fc3f23366293bc653d92d Author: Uwe Kleine-König Date: Sun Mar 19 00:54:28 2023 +0100 fbdev: xilinxfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 89c4bbd457af5e18026e45bedd87f6f097edc83a Author: Uwe Kleine-König Date: Sun Mar 19 00:54:27 2023 +0100 fbdev: wmt_ge_rops: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 024a3cafa5c965fd121948db5023e867cdaf73c9 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:26 2023 +0100 fbdev: wm8505fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 3ab20cdc752d82939859a2aabe76ffd3fa5ece6f Author: Uwe Kleine-König Date: Sun Mar 19 00:54:25 2023 +0100 fbdev: vt8500lcdfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 87b1e9a57445e4ee38cf1c03c203c82d5dda6aa3 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:24 2023 +0100 fbdev: via: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 4a5ef62ce73b3c73ad3f844052b37cbabd9e2357 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:23 2023 +0100 fbdev: vga16fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 24f677094e325dd669b8f60b75779e7ef8263503 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:22 2023 +0100 fbdev: vfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit f3db09aae19846f92dcf4c7c238a0ea6f9560617 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:21 2023 +0100 fbdev: vesafb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 94bada58284c93a38105637bbab0513f9caa005d Author: Uwe Kleine-König Date: Sun Mar 19 00:54:20 2023 +0100 fbdev: uvesafb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 1fd99273942058f529b7b2821ada51e0d94aac23 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:19 2023 +0100 fbdev: tcx: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 7b49f61a7235813045c6adb34fdc5b5a0b7c2862 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:18 2023 +0100 fbdev: sm501fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 4ba34066a29bd9db89525ed5c18d1838658402eb Author: Uwe Kleine-König Date: Sun Mar 19 00:54:17 2023 +0100 fbdev: simplefb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 068240885346a4f484237e24dc1f75530a58c370 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:16 2023 +0100 fbdev: sh_mobile_lcdcfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller commit 03dfa8d2be6f16c087fe871f043a99857cb38d80 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:15 2023 +0100 fbdev: sh7760fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit f2f34fb9f94f79f7d7bb12410d2e0b7f3b867a54 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:14 2023 +0100 fbdev: s3c-fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 77da73b32ceae6bb240fb57be6858042c76f9362 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:13 2023 +0100 fbdev: s1d13xxxfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit eb703b6089bdeee974a02894a001de3df804f772 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:12 2023 +0100 fbdev: pxafb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 2872c2913abf2d51c2d333477933801e14cc284b Author: Uwe Kleine-König Date: Sun Mar 19 00:54:11 2023 +0100 fbdev: pxa3xx-gcu: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit bcfb6d43bb08babd207a93bce99d86c25febd51d Author: Uwe Kleine-König Date: Sun Mar 19 00:54:10 2023 +0100 fbdev: pxa168fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit cc6a0d407c4a8c8ce9aa971124592b3c805cf6f6 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:09 2023 +0100 fbdev: platinumfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 4d7960389f9e91dc7d09734f79346850f4fd11d9 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:08 2023 +0100 fbdev: p9100: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit dc6b77badc752e4965919f7b81ad9e3725ae0a64 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:07 2023 +0100 fbdev: omapfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit db031426eb4680137f023d75fdb3646664227335 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:06 2023 +0100 fbdev: offb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit d14e9328fef310b42c58688cb5c3caaace5c967e Author: Uwe Kleine-König Date: Sun Mar 19 00:54:05 2023 +0100 fbdev: ocfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 419368fba704bf34c6d04a891b3989f47678911e Author: Uwe Kleine-König Date: Sun Mar 19 00:54:04 2023 +0100 fbdev: mx3fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit d0513776c132e040b2a438864dd1a2a362326858 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:03 2023 +0100 fbdev: metronomefb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 3a2ab02ddfacb04f92d47f2fe6e4aef4c95366e4 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:02 2023 +0100 fbdev: mb862xx: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 3eafb6a37617eff4678723acb3400fe37e77f631 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:01 2023 +0100 fbdev: leo: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 909b7a3ea3989715ff20c191682c6a90eac3b4a4 Author: Uwe Kleine-König Date: Sun Mar 19 00:54:00 2023 +0100 fbdev: imxfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit a1bb53688630aff762e79c6e4d781f33283f82a7 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:59 2023 +0100 fbdev: hitfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit f693b4de3546fa484b86437fb06ac307603aed3e Author: Uwe Kleine-König Date: Sun Mar 19 00:53:58 2023 +0100 fbdev: hgafb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 5be0ce71097d087060cc9e9a416f62fa74e5a9dd Author: Uwe Kleine-König Date: Sun Mar 19 00:53:57 2023 +0100 fbdev: hecubafb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 41aede214f2f68f69d42a802ca8aab5b1aa9ea66 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:56 2023 +0100 fbdev: grvga: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit ecab1e9a54db8a2535d3ee7b25f78c3d02dfad19 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:55 2023 +0100 fbdev: goldfishfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit e16e7ea4a8e5023ce9a68d7762102b5a9ccb17dd Author: Uwe Kleine-König Date: Sun Mar 19 00:53:54 2023 +0100 fbdev: gbefb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 0dc08e875aca46813efad5a18c98749d2fb41935 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:53 2023 +0100 fbdev: fsl-diu-fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit b917b0a9c6b92e0abb4e07a9568cd93df831b7ff Author: Uwe Kleine-König Date: Sun Mar 19 00:53:52 2023 +0100 fbdev: ffb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 81431a9eaca14166f4dec21059f67cea81fac688 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:51 2023 +0100 fbdev: ep93xx-fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 156ebfe4c87d1379fd599677d90056c911dc03f8 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:50 2023 +0100 fbdev: efifb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 33c890d022f91d7807cc9673f7017b480f64b2cf Author: Uwe Kleine-König Date: Sun Mar 19 00:53:49 2023 +0100 fbdev: da8xx-fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit ac40ac6ca0fae749417819d9081d79886b1154a4 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:48 2023 +0100 fbdev: cobalt_lcdfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit fdc757fe7cb0f14dff4dc43c843a453d6bc41a48 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:47 2023 +0100 fbdev: clps711x-fb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 2a50e4a1e685f9703763ee4a13f7bc622eecf79e Author: Uwe Kleine-König Date: Sun Mar 19 00:53:46 2023 +0100 fbdev: cg6: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit dd65e6f3fad96150cf54f8757f71884127ec4376 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:45 2023 +0100 fbdev: cg3: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 2d419df353d2558544c894509304acf7753bb4f7 Author: Uwe Kleine-König Date: Sun Mar 19 00:53:44 2023 +0100 fbdev: cg14: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 1492c6b1874ac5ed57d8ffef89e2b5c59f804aa8 Author: Henry Willard Date: Wed Apr 12 15:29:53 2023 -0600 MIPS: Don't clear _PAGE_SPECIAL in _PAGE_CHG_MASK In the special case where p = mmap(NULL, ALLOC_SIZE, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS | MAP_POPULATE, -1, 0); is followed by rc = mprotect(p, ALLOC_SIZE, PROT_NONE); the _PAGE_SPECIAL bit in the page tables will be cleared by mistake and the later unmapped operations will incorrectly modify the struct page for the the zero page. This sequence occurs in the madvise05 test of the Linux Test Project suite of tests. This was discovered while testing an older version of the kernel (5.4.17) on a MIPS device. Unfortunately, support for this device is not available in newer kernels, so I can't test this with the latest Linux kernel code. It looks like the problem exists in newer kernels, but I can't verify it. Except for the LTP test, this sequence of calls is probably not common. Passing it along in the hope it will be useful to someone. Signed-off-by: Henry Willard Signed-off-by: Thomas Bogendoerfer commit ce8ac91130b96f651cf6b5245668dfa4969c9c42 Merge: 96ae3995c6930 49aba1c5896b7 e088d80e2a1e7 Author: Borislav Petkov (AMD) Date: Mon Apr 24 09:14:30 2023 +0200 Merge branches 'edac-drivers', 'edac-amd64' and 'edac-misc' into edac-updates Combine all queued EDAC changes for submission into v6.4: * ras/edac-drivers: EDAC/i10nm: Add Intel Sierra Forest server support EDAC/skx: Fix overflows on the DRAM row address mapping arrays * ras/edac-amd64: (27 commits) EDAC/amd64: Fix indentation in umc_determine_edac_cap() EDAC/amd64: Add get_err_info() to pvt->ops EDAC/amd64: Split dump_misc_regs() into dct/umc functions EDAC/amd64: Split init_csrows() into dct/umc functions EDAC/amd64: Split determine_edac_cap() into dct/umc functions EDAC/amd64: Rename f17h_determine_edac_ctl_cap() EDAC/amd64: Split setup_mci_misc_attrs() into dct/umc functions EDAC/amd64: Split ecc_enabled() into dct/umc functions EDAC/amd64: Split read_mc_regs() into dct/umc functions EDAC/amd64: Split determine_memory_type() into dct/umc functions EDAC/amd64: Split read_base_mask() into dct/umc functions EDAC/amd64: Split prep_chip_selects() into dct/umc functions EDAC/amd64: Rework hw_info_{get,put} EDAC/amd64: Merge struct amd64_family_type into struct amd64_pvt EDAC/amd64: Do not discover ECC symbol size for Family 17h and later EDAC/amd64: Drop dbam_to_cs() for Family 17h and later EDAC/amd64: Split get_csrow_nr_pages() into dct/umc functions EDAC/amd64: Rename debug_display_dimm_sizes() * ras/edac-misc: EDAC/altera: Remove MODULE_LICENSE in non-module EDAC: Sanitize MODULE_AUTHOR strings EDAC/amd81[13]1: Remove trailing newline from MODULE_AUTHOR EDAC/i5100: Fix typo in comment EDAC/altera: Remove redundant error logging Signed-off-by: Borislav Petkov (AMD) commit 7002cbd625467084f1ef01b6e365e10b51fc4b9f Author: Oswald Buddenhagen Date: Sun Apr 23 20:10:02 2023 +0200 ALSA: emu10k1: use high-level I/O in set_filterQ() This makes the code shorter and more legible. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230423181002.1246793-2-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit d184d60aa301e424cd0cf7de90b40744710a2417 Author: Zhengkang Huang Date: Wed Apr 19 18:03:03 2023 +0800 platform/chrome: wilco_ec: remove return value check of debugfs_create_dir() Smatch complains that: wilco_ec_debugfs_probe() warn: 'debug_info->dir' is an error pointer or valid Debugfs checks are generally not supposed to be checked for errors and it is not necessary here. Just delete the dead code. Signed-off-by: Zhengkang Huang Reviewed-by: Dongliang Mu Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20230419100303.343379-1-zkhuang@hust.edu.cn commit 1f3744b89164a430865d18b757b86c4007627855 Author: Tzung-Bi Shih Date: Tue Apr 11 13:33:08 2023 +0800 platform/chrome: cros_ec_debugfs: fix kernel-doc warning Fix the following kernel-doc warning: $ ./scripts/kernel-doc -none drivers/platform/chrome/* [...] warning: This comment starts with '/**', but isn't a kernel-doc comment. Fixes: 14bb09b32f43 ("platform/chrome: cros_ec: Separate logic for getting panic info") Reported-by: kernel test robot Signed-off-by: Tzung-Bi Shih Reviewed-by: Benson Leung Link: https://lore.kernel.org/r/20230411053308.1572493-1-tzungbi@kernel.org commit 26e1dc1bef42a699734056271e790982e2ba8092 Author: Rob Barnes Date: Mon Apr 10 16:58:17 2023 +0000 platform/chrome: cros_ec: Separate logic for getting panic info Create a separate function called cros_ec_get_panicinfo for getting panic info from EC. Currently cros_ec_create_panicinfo is the only caller. Signed-off-by: Rob Barnes Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20230410165817.932449-1-robbarnes@google.com commit dc70234c408c644505a24362b0f095f713e4697e Author: Liang He Date: Wed Mar 22 12:16:57 2023 +0800 platform/chrome: cros_typec_switch: Add missing fwnode_handle_put() In cros_typec_register_switches(), we should add fwnode_handle_put() when break out of the iteration device_for_each_child_node() as it will automatically increase and decrease the refcounter. Fixes: affc804c44c8 ("platform/chrome: cros_typec_switch: Add switch driver") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20230322041657.1857001-1-windhl@126.com Signed-off-by: Prashant Malani commit 554ec02c97254962bbb0a8776c3160d294fc7e51 Author: Tzung-Bi Shih Date: Wed Mar 8 11:12:47 2023 +0800 platform/chrome: cros_ec: remove unneeded label and if-condition Both `ec_dev->ec` and `ec_dev->pd` are initialized to NULL at the beginning of cros_ec_register(). Also, platform_device_unregister() takes care if the given platform_device is NULL. Remove the unneeded goto-label and if-condition. Signed-off-by: Tzung-Bi Shih Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230308031247.2866401-1-tzungbi@kernel.org commit 32d2a15ec54a3d8b708b343e50072ccb0e5da83f Author: Gustavo A. R. Silva Date: Mon Mar 6 14:59:04 2023 -0600 platform/chrome: Replace fake flexible arrays with flexible-array member Zero-length arrays as fake flexible arrays are deprecated and we are moving towards adopting C99 flexible-array members instead. Use the DECLARE_FLEX_ARRAY() helper macro to transform zero-length arrays in unions with flexible-array members. Address the following warning found with GCC-13 and -fstrict-flex-arrays=3 enabled: drivers/iio/accel/cros_ec_accel_legacy.c:66:46: warning: array subscript is outside array bounds of ‘struct ec_response_motion_sensor_data[0]’ [-Warray-bounds=] This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. Link: https://github.com/KSPP/linux/issues/21 Link: https://github.com/KSPP/linux/issues/193 Link: https://github.com/KSPP/linux/issues/262 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/ZAZUGBmSLc5wg7AK@work commit c66bb48edd58c3a22072b4f68312c225dc1b0009 Author: Juergen Gross Date: Mon Apr 3 11:27:11 2023 +0200 xen/pvcalls: don't call bind_evtchn_to_irqhandler() under lock bind_evtchn_to_irqhandler() shouldn't be called under spinlock, as it can sleep. This requires to move the calls of create_active() out of the locked regions. This is no problem, as the worst which could happen would be a spurious call of the interrupt handler, causing a spurious wake_up(). Reported-by: Dan Carpenter Link: https://lore.kernel.org/lkml/Y+JUIl64UDmdkboh@kadam/ Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/20230403092711.15285-1-jgross@suse.com Signed-off-by: Juergen Gross commit b2c042cc802fe96d431821bf1cf2f0f04a3eda7d Author: Juergen Gross Date: Tue Mar 28 10:46:02 2023 +0200 xen/scsiback: don't call scsiback_free_translation_entry() under lock scsiback_free_translation_entry() shouldn't be called under spinlock, as it can sleep. This requires to split removing a translation entry from the v2p list from actually calling kref_put() for the entry. Reported-by: Dan Carpenter Link: https://lore.kernel.org/lkml/Y+JUIl64UDmdkboh@kadam/ Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Link: https://lore.kernel.org/r/20230328084602.20729-1-jgross@suse.com Signed-off-by: Juergen Gross commit fae65ef3a148079103ae935107c62f7830ab52c5 Author: Juergen Gross Date: Tue Mar 28 10:45:49 2023 +0200 xen/pciback: don't call pcistub_device_put() under lock pcistub_device_put() shouldn't be called under spinlock, as it can sleep. For this reason pcistub_device_get_pci_dev() needs to be modified: instead of always calling pcistub_device_get() just do the call of pcistub_device_get() only if it is really needed. This removes the need to call pcistub_device_put(). Reported-by: Dan Carpenter Link: https://lore.kernel.org/lkml/Y+JUIl64UDmdkboh@kadam/ Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Link: https://lore.kernel.org/r/20230328084549.20695-1-jgross@suse.com Signed-off-by: Juergen Gross commit 74d7970febf7e9005375aeda0df821d2edffc9f7 Author: Namjae Jeon Date: Fri Apr 21 16:09:01 2023 +0900 ksmbd: fix racy issue from using ->d_parent and ->d_name Al pointed out that ksmbd has racy issue from using ->d_parent and ->d_name in ksmbd_vfs_unlink and smb2_vfs_rename(). and use new lock_rename_child() to lock stable parent while underlying rename racy. Introduce vfs_path_parent_lookup helper to avoid out of share access and export vfs functions like the following ones to use vfs_path_parent_lookup(). - rename __lookup_hash() to lookup_one_qstr_excl(). - export lookup_one_qstr_excl(). - export getname_kernel() and putname(). vfs_path_parent_lookup() is used for parent lookup of destination file using absolute pathname given from FILE_RENAME_INFORMATION request. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit af36c51e0e111de4e908328d49cba49de758f66e Author: David Disseldorp Date: Tue Apr 4 16:29:54 2023 +0200 ksmbd: remove unused compression negotiate ctx packing build_compression_ctxt() is currently unreachable due to conn.compress_algorithm remaining zero (SMB3_COMPRESS_NONE). It appears to have been broken in a couple of subtle ways over the years: - prior to d6c9ad23b421 ("ksmbd: use the common definitions for NEGOTIATE_PROTOCOL") smb2_compression_ctx.DataLength was set to 8, which didn't account for the single CompressionAlgorithms flexible array member. - post d6c9ad23b421 smb2_compression_capabilities_context CompressionAlgorithms is a three member array, while CompressionAlgorithmCount is set to indicate only one member. assemble_neg_contexts() ctxt_size is also incorrectly incremented by sizeof(struct smb2_compression_capabilities_context) + 2, which assumes one flexible array member. Signed-off-by: David Disseldorp Acked-by: Namjae Jeon Signed-off-by: Steve French commit a12a07a85aff72e19520328f78b1c64d2281a1ec Author: David Disseldorp Date: Tue Apr 4 00:47:48 2023 +0200 ksmbd: avoid duplicate negotiate ctx offset increments Both pneg_ctxt and ctxt_size change in unison, with each adding the length of the previously added context, rounded up to an eight byte boundary. Drop pneg_ctxt increments and instead use the ctxt_size offset when passing output pointers to per-context helper functions. This slightly simplifies offset tracking and shaves off a few text bytes. Before (x86-64 gcc 7.5): text data bss dec hex filename 213234 8677 672 222583 36577 ksmbd.ko After: text data bss dec hex filename 213218 8677 672 222567 36567 ksmbd.ko Signed-off-by: David Disseldorp Acked-by: Namjae Jeon Signed-off-by: Steve French commit 34e8ccf9ce24b6b2e275bbe35cd392e18fbbd369 Author: David Disseldorp Date: Mon Apr 3 11:29:55 2023 +0200 ksmbd: set NegotiateContextCount once instead of every inc There are no early returns, so marshalling the incremented NegotiateContextCount with every context is unnecessary. Signed-off-by: David Disseldorp Acked-by: Namjae Jeon Signed-off-by: Steve French commit d883a4669a1def6d121ccf5e64ad28260d1c9531 Author: Luiz Augusto von Dentz Date: Fri Apr 21 11:37:55 2023 -0700 Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running This makes sure hci_cmd_sync_queue only queue new work if HCI_RUNNING has been set otherwise there is a risk of commands being sent while turning off. Because hci_cmd_sync_queue can no longer queue work while HCI_RUNNING is not set it cannot be used to power on adapters so instead hci_cmd_sync_submit is introduced which bypass the HCI_RUNNING check, so it behaves like the old implementation. Link: https://lore.kernel.org/all/CAB4PzUpDMvdc8j2MdeSAy1KkAE-D3woprCwAdYWeOc-3v3c9Sw@mail.gmail.com/ Signed-off-by: Luiz Augusto von Dentz commit 20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6 Author: Tim Jiang Date: Wed Apr 19 11:38:05 2023 +0800 Bluetooth: btusb: Add WCN6855 devcoredump support WCN6855 will report memdump via ACL data or HCI event when it get crashed, so we collect memdump to debug firmware. Signed-off-by: Tim Jiang Signed-off-by: Luiz Augusto von Dentz commit 42bc6793e452a526294278b234e9e57cc4a81914 Merge: 457391b038033 9bc37e04823b5 Author: Steve French Date: Mon Apr 24 00:07:14 2023 -0500 Merge tag 'pull-lock_rename_child' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs into ksmbd-for-next lock_rename_child() (for ksmbd folks) Signed-off-by: Al Viro commit b0310d6ed684b862dd29049d7b9cca5589555654 Author: Neeraj Sanjay Kale Date: Wed Apr 19 20:54:13 2023 +0530 Bluetooth: btnxpuart: Enable flow control before checking boot signature This enables flow control before checking for bootloader signature and deciding whether FW download is needed or not. In case of V1 bootloader chips w8987 and w8997, it is observed that if WLAN FW is downloaded first and power save is enabled in wlan core, bootloader signatures are not emitted by the BT core when the chip is put to sleep. As a result, the driver skips FW download and subsequent HCI commands get timeout errors in dmesg as shown below: [ 112.898867] Bluetooth: hci0: Opcode 0x c03 failed: -110 [ 114.914865] Bluetooth: hci0: Setting baudrate failed (-110) [ 116.930856] Bluetooth: hci0: Setting wake-up method failed (-110) By enabling the flow control, the host enables its RTS pin, and an interrupt in chip's UART peripheral causes the bootloader to wake up, enabling the bootloader signatures, which then helps in downloading the bluetooth FW file. This changes all instances of 0/1 for serdev_device_set_flow_control() to false/true. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit f419863588217f76eaf754e1dfce21ea7fcb026d Author: Archie Pusaka Date: Thu Apr 20 20:23:36 2023 +0800 Bluetooth: Cancel sync command before suspend and power off Some of the sync commands might take a long time to complete, e.g. LE Create Connection when the peer device isn't responding might take 20 seconds before it times out. If suspend command is issued during this time, it will need to wait for completion since both commands are using the same sync lock. This patch cancel any running sync commands before attempting to suspend or adapter power off. Signed-off-by: Archie Pusaka Reviewed-by: Ying Hsu Signed-off-by: Luiz Augusto von Dentz commit 7948fe1c92d92313eea5453f83deb7f0141355e8 Author: Max Chou Date: Tue Apr 18 13:43:54 2023 +0800 Bluetooth: btrtl: Add the support for RTL8851B Add the support for RTL8851B BT controller on USB interface. The necessary firmware will be submitted to linux-firmware project. Note that the Bluetooth devices WITH the VID=0x0bda would be set the feature quirk in btrtl_setup_realtek(). It's able to ignore the feature flag set for the specific VID and PID in blacklist_table[] of btusb.c. (check [1]) If Realtek Bluetooth chips WITHOUT the VID=0x0bda, it shall be added the feature flag for the specific VID and PID in blacklist_table[] of btusb.c. (check [2]) [1] '9ab9235fe5cf ("Bluetooth: btrtl: Enable WBS for the specific Realtek devices")' [2] '73280f13c9bb ("Bluetooth: btusb: Add the more support IDs for Realtek RTL8822CE")' The device info from /sys/kernel/debug/usb/devices as below. T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 33 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=b851 Rev= 0.00 S: Manufacturer=Realtek S: Product=802.11ax WLAN Adapter S: SerialNumber=00E04C885A01 C:* #Ifs= 3 Cfg#= 1 Atr=80 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit 9e080b53dafae52759c87a105abcb87aa0592cf4 Author: Luiz Augusto von Dentz Date: Mon Apr 17 17:01:16 2023 -0700 Bluetooth: btnxpuart: Fix sparse warnings This fixes the following sparse warnings: drivers/bluetooth/btnxpuart.c:681:23: sparse: sparse: restricted __le16 degrades to integer drivers/bluetooth/btnxpuart.c:690:82: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] req_len @@ got restricted __le16 [usertype] len @@ drivers/bluetooth/btnxpuart.c:690:82: sparse: expected unsigned short [usertype] req_len drivers/bluetooth/btnxpuart.c:690:82: sparse: got restricted __le16 [usertype] len drivers/bluetooth/btnxpuart.c:694:84: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] req_len @@ got restricted __le16 [usertype] len @@ drivers/bluetooth/btnxpuart.c:694:84: sparse: expected unsigned short [usertype] req_len drivers/bluetooth/btnxpuart.c:694:84: sparse: got restricted __le16 [usertype] len drivers/bluetooth/btnxpuart.c:708:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] requested_len @@ got restricted __le16 [usertype] len @@ drivers/bluetooth/btnxpuart.c:708:23: sparse: expected unsigned int [usertype] requested_len drivers/bluetooth/btnxpuart.c:708:23: sparse: got restricted __le16 [usertype] len drivers/bluetooth/btnxpuart.c:787:78: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] chipid @@ got restricted __le16 [usertype] chip_id @@ drivers/bluetooth/btnxpuart.c:787:78: sparse: expected unsigned short [usertype] chipid drivers/bluetooth/btnxpuart.c:787:78: sparse: got restricted __le16 [usertype] chip_id drivers/bluetooth/btnxpuart.c:810:74: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] req_len @@ got restricted __le16 [usertype] len @@ drivers/bluetooth/btnxpuart.c:810:74: sparse: expected unsigned short [usertype] req_len drivers/bluetooth/btnxpuart.c:810:74: sparse: got restricted __le16 [usertype] len drivers/bluetooth/btnxpuart.c:815:76: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] req_len @@ got restricted __le16 [usertype] len @@ drivers/bluetooth/btnxpuart.c:815:76: sparse: expected unsigned short [usertype] req_len drivers/bluetooth/btnxpuart.c:815:76: sparse: got restricted __le16 [usertype] len drivers/bluetooth/btnxpuart.c:834:16: sparse: sparse: restricted __le32 degrades to integer drivers/bluetooth/btnxpuart.c:843:55: sparse: sparse: restricted __le32 degrades to integer drivers/bluetooth/btnxpuart.c:844:36: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned long [usertype] @@ got restricted __le16 [usertype] len @@ drivers/bluetooth/btnxpuart.c:844:36: sparse: expected unsigned long [usertype] drivers/bluetooth/btnxpuart.c:844:36: sparse: got restricted __le16 [usertype] len Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304160736.Tsa0zTBU-lkp@intel.com/ Signed-off-by: Luiz Augusto von Dentz commit 9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa Author: Max Chou Date: Mon Apr 17 10:33:58 2023 +0800 Bluetooth: btrtl: Firmware format v2 support Realtek changed the format of the firmware file as v2. The driver should implement the patch to extract the firmware data from the firmware file. The future chips must apply this patch for firmware loading. This patch is compatible with the both previous format and v2 as well. Signed-off-by: Allen Chen Signed-off-by: Alex Lu Tested-by: Hilda Wu Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit 0ab905c3be8c2be368821dd2bd1f8d126064d993 Author: Zijun Hu Date: Mon Apr 17 17:39:59 2023 +0800 Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue API hci_devcd_init() stores its u32 type parameter @dump_size into skb, but it does not specify which byte order is used to store the integer, let us take little endian to store and parse the integer. Fixes: f5cc609d09d4 ("Bluetooth: Add support for hci devcoredump") Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit 25c150ac103a4ebeed0319994c742a90634ddf18 Author: Ruihan Li Date: Sun Apr 16 16:14:04 2023 +0800 bluetooth: Perform careful capability checks in hci_sock_ioctl() Previously, capability was checked using capable(), which verified that the caller of the ioctl system call had the required capability. In addition, the result of the check would be stored in the HCI_SOCK_TRUSTED flag, making it persistent for the socket. However, malicious programs can abuse this approach by deliberately sharing an HCI socket with a privileged task. The HCI socket will be marked as trusted when the privileged task occasionally makes an ioctl call. This problem can be solved by using sk_capable() to check capability, which ensures that not only the current task but also the socket opener has the specified capability, thus reducing the risk of privilege escalation through the previously identified vulnerability. Cc: stable@vger.kernel.org Fixes: f81f5b2db869 ("Bluetooth: Send control open and close messages for HCI raw sockets") Signed-off-by: Ruihan Li Signed-off-by: Luiz Augusto von Dentz commit 25e97f7b1866e6b8503be349eeea44bb52d661ce Author: Min Li Date: Mon Apr 17 10:27:54 2023 +0800 Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered. Reported-by: syzbot+9519d6b5b79cf7787cf3@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000894f5f05f95e9f4d@google.com/ Signed-off-by: Min Li Signed-off-by: Luiz Augusto von Dentz commit 000c2fa2c144c499c881a101819cf1936a1f7cf2 Author: Ruihan Li Date: Sun Apr 16 16:02:51 2023 +0800 bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() Previously, channel open messages were always sent to monitors on the first ioctl() call for unbound HCI sockets, even if the command and arguments were completely invalid. This can leave an exploitable hole with the abuse of invalid ioctl calls. This commit hardens the ioctl processing logic by first checking if the command is valid, and immediately returning with an ENOIOCTLCMD error code if it is not. This ensures that ioctl calls with invalid commands are free of side effects, and increases the difficulty of further exploitation by forcing exploitation to find a way to pass a valid command first. Signed-off-by: Ruihan Li Co-developed-by: Marcel Holtmann Signed-off-by: Marcel Holtmann Signed-off-by: Luiz Augusto von Dentz commit db2bf510bd5d57f064d9e1db395ed86a08320c54 Author: Liu Jian Date: Fri Apr 14 18:30:06 2023 +0800 Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. This patch introduces a possible null-ptr-def problem. Revert it. And the fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition"). Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work") Signed-off-by: Liu Jian Signed-off-by: Luiz Augusto von Dentz commit 91b6d02ddcd113352bdd895990b252065c596de7 Author: Raul Cheleguini Date: Thu Mar 23 10:45:39 2023 -0300 Bluetooth: Add new quirk for broken set random RPA timeout for ATS2851 The ATS2851 based controller advertises support for command "LE Set Random Private Address Timeout" but does not actually implement it, impeding the controller initialization. Add the quirk HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT to unblock the controller initialization. < HCI Command: LE Set Resolvable Private... (0x08|0x002e) plen 2 Timeout: 900 seconds > HCI Event: Command Status (0x0f) plen 4 LE Set Resolvable Private Address Timeout (0x08|0x002e) ncmd 1 Status: Unknown HCI Command (0x01) Co-developed-by: imoc Signed-off-by: imoc Signed-off-by: Raul Cheleguini Signed-off-by: Luiz Augusto von Dentz commit c09b80be6ffc338634b2f5f8cfa12b6843410834 Author: Luiz Augusto von Dentz Date: Wed Apr 12 17:45:51 2023 -0700 Bluetooth: hci_conn: Fix not waiting for HCI_EVT_LE_CIS_ESTABLISHED When submitting HCI_OP_LE_CREATE_CIS the code shall wait for HCI_EVT_LE_CIS_ESTABLISHED thus enforcing the serialization of HCI_OP_LE_CREATE_CIS as the Core spec does not allow to send them in parallel: BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2566: If the Host issues this command before all the HCI_LE_CIS_Established events from the previous use of the command have been generated, the Controller shall return the error code Command Disallowed (0x0C). Signed-off-by: Luiz Augusto von Dentz commit c14516faede33c2c31da45cf950d55dbff42962e Author: Luiz Augusto von Dentz Date: Tue Apr 11 16:14:25 2023 -0700 Bluetooth: hci_conn: Fix not matching by CIS ID This fixes only matching CIS by address which prevents creating new hcon if upper layer is requesting a specific CIS ID. Signed-off-by: Luiz Augusto von Dentz commit 06149746e7203d5ffe2d6faf9799ee36203aa8b8 Author: Luiz Augusto von Dentz Date: Tue Apr 11 16:02:22 2023 -0700 Bluetooth: hci_conn: Add support for linking multiple hcon Since it is required for some configurations to have multiple CIS with the same peer which is now covered by iso-tester in the following test cases: ISO AC 6(i) - Success ISO AC 7(i) - Success ISO AC 8(i) - Success ISO AC 9(i) - Success ISO AC 11(i) - Success Signed-off-by: Luiz Augusto von Dentz commit e4eea890369c00dd58d97b1c066dc2bddf0da2c7 Author: Dan Carpenter Date: Thu Apr 6 11:55:17 2023 +0300 Bluetooth: vhci: Fix info leak in force_devcd_write() There are a number of bugs here: 1) If "count" is less than sizeof(dump_data.data) then it copies uninitialized data. 2) If simple_write_to_buffer() returns -EFAULT then we run into a problem "ret < count" comparison. "count" is an unsigned long so the comparison is type promoted to unsigned long and the negative returns become high positive values. That also results in copying uninitialized data. 3) If "*ppos" is non-zero then the first part of the dump_data buffer is uninitialized. Using copy_from_user() instead of simple_write_to_buffer() is more appropriate here. Fixes: d5d5df6da0aa ("Bluetooth: Add vhci devcoredump support") Signed-off-by: Dan Carpenter Signed-off-by: Luiz Augusto von Dentz commit 0811ff480978a2122f0465cb8682d9f7a2f6a169 Author: Steev Klimaszewski Date: Wed Apr 12 18:58:17 2023 -0500 Bluetooth: hci_qca: mark OF related data as maybe unused The driver can be compile tested with !CONFIG_OF making certain data unused. Signed-off-by: Steev Klimaszewski Signed-off-by: Luiz Augusto von Dentz commit 9e3c2ea67a4c24f7a7517e863e3adc89c4e3b66d Author: Iulia Tanasescu Date: Tue Apr 11 10:41:35 2023 +0300 Bluetooth: hci_conn: remove extra line in hci_le_big_create_sync Remove extra line setting the broadcast code parameter of the hci_cp_le_create_big struct to 0. The broadcast code is copied from the QoS struct. Signed-off-by: Iulia Tanasescu Signed-off-by: Luiz Augusto von Dentz commit 3c690a0d64f5964977050a91b6bba8de09c13d94 Author: Lanzhe Li Date: Sun Apr 9 21:02:29 2023 +0800 Bluetooth: fix inconsistent indenting Fixed a wrong indentation before "return".This line uses a 7 space indent instead of a tab. Signed-off-by: Lanzhe Li Signed-off-by: Luiz Augusto von Dentz commit 305d6b6e485e46a7a3e85d5bfecda9af2294f423 Author: Neeraj Sanjay Kale Date: Mon Apr 3 17:54:30 2023 +0530 Bluetooth: btnxpuart: No need to check the received bootloader signature We can never assume the uart will deliver a complete packet to the BT layer at once, the expected packet may be divided into several parts by uart as uart doesn't know the received packet size, the received data count may mismatch with the expected packet size, so here is_valid_bootloader_signature() check may always return false. Even we remove the count check in is_valid_bootloader_signature(), then the first part of the data which includes the packet type can pass the is_valid_bootloader_signature() check, but the remaining parts don't have the packet type data still cannot pass the check, here return directly will cause the data loss. So need to remove the received bootloader signature check here, the h4_recv_buf() can help us combine the different data received into one packet. If any out-of-sync or incomplete bootloader signature is received, it is safe to ignore and discard it, and process the next bootloader signature. Co-developed-by: Sherry Sun Signed-off-by: Sherry Sun Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit 893410b221f4966890e5bc33be08d38d4bc968b2 Author: Neeraj Sanjay Kale Date: Mon Apr 3 17:54:29 2023 +0530 Bluetooth: btnxpuart: Disable Power Save feature on startup This sets the default power save mode setting to disabled. With this setting, this driver will behave like a normal h4 driver. If user needs to use the power save feature, it can be enabled using the following vendor command: hcitool cmd 3f 23 02 00 00 (HCI_NXP_AUTO_SLEEP_MODE) Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit 86d55f124b52de2ba0d066d89b766bcc0387fd72 Author: Neeraj Sanjay Kale Date: Mon Apr 3 17:54:28 2023 +0530 Bluetooth: btnxpuart: Deasset UART break before closing serdev device This adds a call to ps_wakeup() before closing the serdev device, to de-assert UART break. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit 38a4f83d802caf5e7ec93a187d211d87b6d67800 Author: Neeraj Sanjay Kale Date: Mon Apr 3 17:54:27 2023 +0530 Bluetooth: btnxpuart: Add support to download helper FW file for w8997 This adds support to download helper FW file for the legacy NXP chipset 88w8997 for the btnxpuart driver. This helper FW file is necessary to set the bootloader baudrate to 3000000 after which the actual BT FW file can be downloaded. This change helps bring the FW download time from around 10 sec to less than 2 sec for 88w8997 chip. For newer chipsets, both V1 and V3 bootloader, driver sends the cmd5 and cmd7 to the chip bootloader, and does not need a helper FW file. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit 09df5a91e620a2d21f7f410938e5e28364fae0bf Author: Hans de Goede Date: Fri Mar 31 23:11:24 2023 +0200 Bluetooth: hci_bcm: Add Acer Iconia One 7 B1-750 to the bcm_broken_irq_dmi_table The DSDT for the Acer Iconia One 7 B1-750 models (which share the same mainboard) specifies a IOAPIC IRQ for the HCI -> host IRQ but this is not correct. Like the Asus TF103C these tablets use pin 17 of the INT33FC:02 GPIO controller for the IRQ and this pin is _not_ configured in direct IRQ mode by the firmware. Add a DMI match for this, re-using the Asus TF103C gpiod_lookup_table, to fix bluetooth not working on these tablets. Signed-off-by: Hans de Goede Signed-off-by: Luiz Augusto von Dentz commit 9a09460274d311466b44743c281c81f36c3e4df4 Author: Hans de Goede Date: Fri Mar 31 23:11:23 2023 +0200 Bluetooth: hci_bcm: Add Lenovo Yoga Tablet 2 830 / 1050 to the bcm_broken_irq_dmi_table The DSDT for the Lenovo Yoga Tablet 2 830 / 1050 models (which share the same mainboard) specifies a IOAPIC IRQ for the HCI -> host IRQ but this is not correct. Like the Asus TF103C these tablets use pin 17 of the INT33FC:02 GPIO controller for the IRQ and this pin is _not_ configured in direct IRQ mode by the firmware. Add a DMI match for this, re-using the Asus TF103C gpiod_lookup_table, to fix bluetooth not working on these tablets. Signed-off-by: Hans de Goede Signed-off-by: Luiz Augusto von Dentz commit ce439473acdf0a3aecbda616a0f92973ab1c2e52 Author: Hans de Goede Date: Fri Mar 31 23:11:22 2023 +0200 Bluetooth: hci_bcm: Limit bcm43430a0 / bcm43430a1 baudrate to 2000000 The bcm43430a0 and bcm43430a1 BT does not support the 0xfc45 command to set the UART clock to 48 MHz and it also does not work at 4000000 baud without this command as some newer models do. These chips are found on ACPI/x86 devices where the operating baudrate does not come from the firmware but is hardcoded at 4000000, which does not work. Add a max_baudrate value to struct bcm_device_data and set this to 2000000 on all known ACPI hardware-ids for the bcm43430a0 and the bcm43430a1. Note this also adds the BCM2E9F ACPI HID which was missing until now. Signed-off-by: Hans de Goede Signed-off-by: Luiz Augusto von Dentz commit 0d218c3642b9ccf71f44987cd03c19320f3bd918 Author: Hans de Goede Date: Fri Mar 31 23:11:21 2023 +0200 Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set On some devices the BCM Bluetooth adapter does not have a valid bdaddr set. btbcm.c currently sets HCI_QUIRK_INVALID_BDADDR to indicate when this is the case. But this requires users to manual setup a btaddr, by doing e.g.: btmgmt -i hci0 public-addr 'B0:F1:EC:82:1D:B3' Which means that Bluetooth will not work out of the box on such devices. To avoid this (where possible) hci_bcm sets: HCI_QUIRK_USE_BDADDR_PROPERTY which tries to get the bdaddr from devicetree. But this only works on devicetree platforms. On UEFI based platforms there is a special Broadcom UEFI variable which when present contains the devices bdaddr, just like how there is another UEFI variable which contains wifi nvram contents including the wifi MAC address. Add support for getting the bdaddr from this Broadcom UEFI variable, so that Bluetooth will work OOTB for users on devices where this UEFI variable is present. This fixes Bluetooth not working on for example Asus T100HA 2-in-1s. Signed-off-by: Hans de Goede Signed-off-by: Luiz Augusto von Dentz commit 3c0d41f141c97e516d986f0571b0d7a745a4e2a8 Author: Qiqi Zhang Date: Tue Apr 4 10:27:11 2023 +0800 Bluetooth: hci_h5: Complements reliable packet processing logic As shown in the schematic diagram below.There may be a critical scenario in the current code. If the device does not receive an pure ack sent by the host due to insufficient receive buffer or other reasons and triggers a retransmission, the host will always be in an 'out-of-order' state.The state machine will get stuck. host device SEQ3,ACK4 ---------> <--------- SEQ4,ACK4 pure ACK ---------> (not received) (out-of-order) <--------- SEQ4,ACK4(retransmission) ........ (out-of-order) <--------- SEQ4,ACK4(retransmission) According to the description in the core specification: "whenever a reliable packet is received, an acknowledgment shall be generated." So set H5_TX_ACK_REQ bit to trigger retransmission of pure ack packet when "out-of-order" occurs. Signed-off-by: Qiqi Zhang Signed-off-by: Luiz Augusto von Dentz commit 288c90224eec55d13e786844b7954ef060752089 Author: Luiz Augusto von Dentz Date: Mon Dec 19 13:37:02 2022 -0800 Bluetooth: Enable all supported LE PHY by default This enables 2M and Coded PHY by default if they are marked as supported in the LE features bits. Signed-off-by: Luiz Augusto von Dentz commit 0fe8c8d071343fa9278980ce4b6f8e6ea24a2ed1 Author: Iulia Tanasescu Date: Fri Mar 31 18:38:01 2023 +0300 Bluetooth: Split bt_iso_qos into dedicated structures Split bt_iso_qos into dedicated unicast and broadcast structures and add additional broadcast parameters. Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Signed-off-by: Iulia Tanasescu Signed-off-by: Luiz Augusto von Dentz commit af395330abed142a2685bf3d17a938544816bf3c Author: Abhishek Pandit-Subedi Date: Thu Mar 30 09:58:26 2023 -0700 Bluetooth: btintel: Add Intel devcoredump support Intercept debug exception events from the controller and put them into a devcoredump using hci devcoredump APIs. The debug exception contains data in a TLV format and it will be parsed in userspace. Signed-off-by: Abhishek Pandit-Subedi Signed-off-by: Manish Mandlik Reviewed-by: Abhishek Pandit-Subedi Reviewed-by: Chethan Tumkur Narayan Signed-off-by: Luiz Augusto von Dentz commit 4f9c1a089623ac606e79a7886646939e0e2f89bf Author: Manish Mandlik Date: Thu Mar 30 09:58:25 2023 -0700 Bluetooth: btusb: Add btusb devcoredump support This patch implements the btusb driver side .coredump() callback to trigger a devcoredump via sysfs. Signed-off-by: Manish Mandlik Reviewed-by: Abhishek Pandit-Subedi Signed-off-by: Luiz Augusto von Dentz commit ab4e4380d4e158486e595013a2635190e07e28ce Author: Manish Mandlik Date: Thu Mar 30 09:58:24 2023 -0700 Bluetooth: Add vhci devcoredump support Add devcoredump support for vhci that creates forcce_devcoredump debugfs entry. This is used for mgmt-tester tests. Signed-off-by: Manish Mandlik Signed-off-by: Luiz Augusto von Dentz commit 9695ef876fd122cb7bbc04a4a93b8727d2e36bda Author: Abhishek Pandit-Subedi Date: Thu Mar 30 09:58:23 2023 -0700 Bluetooth: Add support for hci devcoredump Add devcoredump APIs to hci core so that drivers only have to provide the dump skbs instead of managing the synchronization and timeouts. The devcoredump APIs should be used in the following manner: - hci_devcoredump_init is called to allocate the dump. - hci_devcoredump_append is called to append any skbs with dump data OR hci_devcoredump_append_pattern is called to insert a pattern. - hci_devcoredump_complete is called when all dump packets have been sent OR hci_devcoredump_abort is called to indicate an error and cancel an ongoing dump collection. The high level APIs just prepare some skbs with the appropriate data and queue it for the dump to process. Packets part of the crashdump can be intercepted in the driver in interrupt context and forwarded directly to the devcoredump APIs. Internally, there are 5 states for the dump: idle, active, complete, abort and timeout. A devcoredump will only be in active state after it has been initialized. Once active, it accepts data to be appended, patterns to be inserted (i.e. memset) and a completion event or an abort event to generate a devcoredump. The timeout is initialized at the same time the dump is initialized (defaulting to 10s) and will be cleared either when the timeout occurs or the dump is complete or aborted. Signed-off-by: Abhishek Pandit-Subedi Signed-off-by: Manish Mandlik Reviewed-by: Abhishek Pandit-Subedi Signed-off-by: Luiz Augusto von Dentz commit 77f542b10c535c9a93bf8afdd2665524935807c2 Author: Chethan T N Date: Tue Mar 21 10:03:10 2023 +0530 Bluetooth: btintel: Add LE States quirk support Basically all Intel controllers support both Central/Peripheral LE states. This patch enables the LE States quirk by default on all Solar and Magnertor Intel controllers. Signed-off-by: Chethan T N Signed-off-by: Luiz Augusto von Dentz commit 095327fede005f4b14d40b2183b2f7965c739dbd Author: Steev Klimaszewski Date: Sun Mar 26 18:38:10 2023 -0500 Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6855 Add regulators, GPIOs and changes required to power on/off wcn6855. Add support for firmware download for wcn6855 which is in the linux-firmware repository as hpbtfw21.tlv and hpnv21.bin. Based on the assumption that this is similar to the wcn6750 Tested-on: BTFW.HSP.2.1.0-00538-VER_PATCHZ-1 Signed-off-by: Steev Klimaszewski Reviewed-by: Bjorn Andersson Tested-by: Bjorn Andersson Signed-off-by: Luiz Augusto von Dentz commit b1d00baaa0298a5e033bc00a92522e4fd07900a8 Author: Steev Klimaszewski Date: Sun Mar 26 18:38:09 2023 -0500 dt-bindings: net: Add WCN6855 Bluetooth Add bindings for the QTI WCN6855 chipset. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Steev Klimaszewski Signed-off-by: Luiz Augusto von Dentz commit 253cf30e8d3d001850a95c4729d668f916b037ab Author: Max Chou Date: Tue Mar 21 19:48:26 2023 +0800 Bluetooth: btrtl: check for NULL in btrtl_set_quirks() The btrtl_set_quirks() has accessed btrtl_dev->ic_info->lmp_subver since b8e482d02513. However, if installing a Realtek Bluetooth controller without the driver supported, it will hit the NULL point accessed. Add a check for NULL to avoid the Kernel Oops. Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit 069f534247bb6db4f8c2c2ea8e9155abf495c37e Author: Larry Finger Date: Wed Mar 22 19:52:03 2023 -0500 bluetooth: Add device 13d3:3571 to device tables This device is part of a Realtek RTW8852BE chip. The device table is as follows: T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3571 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Larry Finger Signed-off-by: Luiz Augusto von Dentz commit 730a1d1a93a3e30c3723f87af97a8517334b2203 Author: Larry Finger Date: Wed Mar 22 19:52:02 2023 -0500 bluetooth: Add device 0bda:887b to device tables This device is part of a Realtek RTW8852BE chip. The device table entry is as follows: T: Bus=03 Lev=01 Prnt=01 Port=12 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=887b Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Larry Finger Signed-off-by: Luiz Augusto von Dentz commit 11e29b4a3fda975f4427800285b7e4544f4e9152 Author: Arnd Bergmann Date: Wed Mar 22 12:16:27 2023 +0100 Bluetooth: NXP: select CONFIG_CRC8 The driver needs both CRC32 and CRC8 to link correctly: ld: drivers/bluetooth/btnxpuart.o: in function `nxp_serdev_probe': drivers/bluetooth/btnxpuart.c:1214: undefined reference to `crc8_populate_msb' ld: drivers/bluetooth/btnxpuart.o: in function `nxp_send_ack': drivers/bluetooth/btnxpuart.c:559: undefined reference to `crc8' ld: drivers/bluetooth/btnxpuart.c:559: undefined reference to `crc8' Fixes: 3e662aa4453a ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets") Signed-off-by: Arnd Bergmann Reviewed-by: Ilpo Järvinen Signed-off-by: Luiz Augusto von Dentz commit 689ca16e523278470c38832a3010645a78c544d8 Author: Neeraj Sanjay Kale Date: Thu Mar 16 22:52:14 2023 +0530 Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets This adds a driver based on serdev driver for the NXP BT serial protocol based on running H:4, which can enable the built-in Bluetooth device inside an NXP BT chip. This driver has Power Save feature that will put the chip into sleep state whenever there is no activity for 2000ms, and will be woken up when any activity is to be initiated over UART. This driver enables the power save feature by default by sending the vendor specific commands to the chip during setup. During setup, the driver checks if a FW is already running on the chip by waiting for the bootloader signature, and downloads device specific FW file into the chip over UART if bootloader signature is received.. Signed-off-by: Neeraj Sanjay Kale Reviewed-by: Ilpo Järvinen Signed-off-by: Luiz Augusto von Dentz commit ab3a769b4dccec2cf60f0a0700b140991bf9afc8 Author: Neeraj Sanjay Kale Date: Thu Mar 16 22:52:13 2023 +0530 dt-bindings: net: bluetooth: Add NXP bluetooth support Add binding document for NXP bluetooth chipsets attached over UART. Signed-off-by: Neeraj Sanjay Kale Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 8eaf839e4ac4feadf06e03eeff34059795450712 Author: Neeraj Sanjay Kale Date: Thu Mar 16 22:52:12 2023 +0530 serdev: Add method to assert break signal over tty UART port Adds serdev_device_break_ctl() and an implementation for ttyport. This function simply calls the break_ctl in tty layer, which can assert a break signal over UART-TX line, if the tty and the underlying platform and UART peripheral supports this operation. Signed-off-by: Neeraj Sanjay Kale Reviewed-by: Simon Horman Signed-off-by: Luiz Augusto von Dentz commit 29f93a687f3c435e94d026ee1fc8ad18ce56b7fb Author: Neeraj Sanjay Kale Date: Thu Mar 16 22:52:11 2023 +0530 serdev: Replace all instances of ENOTSUPP with EOPNOTSUPP This replaces all instances of ENOTSUPP with EOPNOTSUPP since ENOTSUPP is not a standard error code. This will help maintain consistency in error codes when new serdev API's are added. Signed-off-by: Neeraj Sanjay Kale Reviewed-by: Simon Horman Signed-off-by: Luiz Augusto von Dentz commit 586e154f98ac826233c2be5dc80e101303b4b2bd Author: Ilpo Järvinen Date: Thu Mar 9 10:20:30 2023 +0200 Bluetooth: hci_ldisc: Fix tty_set_termios() return value assumptions tty_set_termios() never returns anything else than 0. Make the debug prints to look directly into the new termios instead to check CRTSCTS state. Signed-off-by: Ilpo Järvinen Signed-off-by: Luiz Augusto von Dentz commit 7c2b2d2d0cb658aa543e11e90ae95621d3cb5fe6 Author: Raul Cheleguini Date: Fri Mar 10 15:14:10 2023 +0000 Bluetooth: Improve support for Actions Semi ATS2851 based devices Add two more quirks to resume the device initialization and basic operation as the device seems not to support "Read Transmit Power" and "Set Extended Scan Parameters". < HCI Command: LE Read Transmit Power (0x08|0x004b) plen 0 > HCI Event: Command Status (0x0f) plen 4 LE Read Transmit Power (0x08|0x004b) ncmd 1 Status: Unknown HCI Command (0x01) < HCI Command: LE Set Extended Scan Parameters (0x08|0x0041) plen 8 Own address type: Random (0x01) Filter policy: Accept all advertisement (0x00) PHYs: 0x01 Entry 0: LE 1M Type: Active (0x01) Interval: 11.250 msec (0x0012) Window: 11.250 msec (0x0012) > HCI Event: Command Status (0x0f) plen 4 LE Set Extended Scan Parameters (0x08|0x0041) ncmd 1 Status: Unknown HCI Command (0x01) Signed-off-by: Raul Cheleguini Signed-off-by: Luiz Augusto von Dentz commit c0123cb6c4c7fc2a42ead6cd7d3e82b8e1c25c6f Author: Vasily Khoruzhick Date: Tue Mar 7 23:17:31 2023 +0100 Bluetooth: btrtl: add support for the RTL8723CS The Realtek RTL8723CS is a SDIO WiFi chip. It also contains a Bluetooth module which is connected via UART to the host. It shares lmp subversion with 8703B, so Realtek's userspace initialization tool (rtk_hciattach) differentiates varieties of RTL8723CS (CG, VF, XX) with RTL8703B using vendor's command to read chip type. Also this chip declares support for some features it doesn't support so add a quirk to indicate that these features are broken. Signed-off-by: Vasily Khoruzhick Signed-off-by: Bastian Germann Signed-off-by: Luiz Augusto von Dentz commit 8194f1ef5a815aea815a91daf2c721eab2674f1f Author: Vasily Khoruzhick Date: Tue Mar 7 23:17:30 2023 +0100 Bluetooth: Add new quirk for broken local ext features page 2 Some adapters (e.g. RTL8723CS) advertise that they have more than 2 pages for local ext features, but they don't support any features declared in these pages. RTL8723CS reports max_page = 2 and declares support for sync train and secure connection, but it responds with either garbage or with error in status on corresponding commands. Signed-off-by: Vasily Khoruzhick Signed-off-by: Bastian Germann Signed-off-by: Luiz Augusto von Dentz commit a88ea43b73f109e446f6027df237c8f868127a78 Author: Krzysztof Kozlowski Date: Sat Mar 11 12:13:54 2023 +0100 Bluetooth: btmtkuart: mark OF related data as maybe unused The driver can be compile tested with !CONFIG_OF making certain data unused: drivers/bluetooth/btmtkuart.c:971:36: error: ‘mt7668_data’ defined but not used [-Werror=unused-const-variable=] drivers/bluetooth/btmtkuart.c:966:36: error: ‘mt7663_data’ defined but not used [-Werror=unused-const-variable=] drivers/bluetooth/btmtkuart.c:962:36: error: ‘mt7622_data’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 44fac8a2fd2f72ee98ee41e6bc9ecc7765b5d3cc Author: Krzysztof Kozlowski Date: Sat Mar 11 12:13:53 2023 +0100 Bluetooth: hci_qca: mark OF related data as maybe unused The driver can be compile tested with !CONFIG_OF making certain data unused: drivers/bluetooth/hci_qca.c:1869:37: error: ‘qca_soc_data_wcn6750’ defined but not used [-Werror=unused-const-variable=] drivers/bluetooth/hci_qca.c:1853:37: error: ‘qca_soc_data_wcn3998’ defined but not used [-Werror=unused-const-variable=] drivers/bluetooth/hci_qca.c:1841:37: error: ‘qca_soc_data_wcn3991’ defined but not used [-Werror=unused-const-variable=] drivers/bluetooth/hci_qca.c:1830:37: error: ‘qca_soc_data_wcn3990’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 04909d7bf847bc0b939a5571a1a1fcbe5f2e2ead Author: Krzysztof Kozlowski Date: Sat Mar 11 12:13:52 2023 +0100 Bluetooth: btmrvl_sdio: mark OF related data as maybe unused The driver can be compile tested with !CONFIG_OF making certain data unused: drivers/bluetooth/btmrvl_sdio.c:43:34: error: ‘btmrvl_sdio_of_match_table’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit cd97d47f3069ef578f3b3ddb8c7ae3d6ce38b61a Author: Krzysztof Kozlowski Date: Sat Mar 11 12:13:51 2023 +0100 Bluetooth: hci_ll: drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). drivers/bluetooth/hci_ll.c:769:34: error: ‘hci_ti_of_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit b8b23001b8025a61f0979578884a74faa825023e Author: Luiz Augusto von Dentz Date: Wed Mar 8 16:16:31 2023 -0800 Bluetooth: L2CAP: Delay identity address updates This delays the identity address updates to give time for userspace to process the new address otherwise there is a risk that userspace creates a duplicated device if the MGMT event is delayed for some reason. Signed-off-by: Luiz Augusto von Dentz commit 9f5ae8fcae1227e9bae3d973fcbef8319a1b25c7 Author: Inga Stotland Date: Wed Mar 8 10:32:35 2023 -0800 Bluetooth: hci_sync: Remove duplicate statement This removes the following duplicate statement in hci_le_ext_directed_advertising_sync(): cp.own_addr_type = own_addr_type; Signed-off-by: Inga Stotland Signed-off-by: Luiz Augusto von Dentz commit 493ea69970e2a4e4102fdf0be6d262456f564c3a Author: Brian Gix Date: Fri Feb 24 09:56:32 2023 -0800 Bluetooth: Convert MSFT filter HCI cmd to hci_sync The msft_set_filter_enable() command was using the deprecated hci_request mechanism rather than hci_sync. This caused the warning error: hci0: HCI_REQ-0xfcf0 Signed-off-by: Brian Gix Signed-off-by: Luiz Augusto von Dentz commit f5d13029a41d6504831ab99da0a9a0332fa7ea19 Author: Archie Pusaka Date: Mon Mar 6 17:07:07 2023 +0800 Bluetooth: hci_sync: Don't wait peer's reply when powering off Currently, when we initiate disconnection, we will wait for the peer's reply unless when we are suspending, where we fire and forget the disconnect request. A similar case is when adapter is powering off. However, we still wait for the peer's reply in this case. Therefore, if the peer is unresponsive, the command will time out and the power off sequence will fail, causing "bluetooth powered on by itself" to users. This patch makes the host doesn't wait for the peer's reply when the disconnection reason is powering off. Signed-off-by: Archie Pusaka Reviewed-by: Abhishek Pandit-Subedi Reviewed-by: Simon Horman Signed-off-by: Luiz Augusto von Dentz commit 125ede3afe5830c3e748dbc66098b7b640899321 Author: Meng Tang Date: Mon Mar 6 09:44:59 2023 +0800 Bluetooth: Add VID/PID 0489/e0e4 for MediaTek MT7922 Tested on Acer Nitro AN515-47 Notebook output from /sys/kernel/debug/usb/devices: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0e4 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Meng Tang Signed-off-by: Luiz Augusto von Dentz commit b6986b7920bb50ed64e96ddd8c4da43bca289ecc Author: Chris Morgan Date: Tue Feb 28 09:22:05 2023 -0600 arm64: dts: rockchip: Update compatible for bluetooth Update the compatible for the Realtek RTL8821CS bluetooth node. Signed-off-by: Chris Morgan Signed-off-by: Luiz Augusto von Dentz commit 10c9e0104e3bffa31ddc653619f993d6842955d6 Author: Chris Morgan Date: Tue Feb 28 09:22:04 2023 -0600 Bluetooth: hci_h5: btrtl: Add support for RTL8821CS RTL8821CS is a WiFi + Bluetooth combo chip from Realtek that provides WiFi A/B/G/N/AC over an SDIO interface and Bluetooth 4.2 over a UART interface. Note that the firmware this was tested with was firmware version 0x75b8f098. Signed-off-by: Chris Morgan Signed-off-by: Luiz Augusto von Dentz commit 95ee3a93239e172b592dc4613c403de2410e4a82 Author: Chris Morgan Date: Tue Feb 28 09:22:03 2023 -0600 dt-bindings: net: realtek-bluetooth: Add RTL8821CS Add compatible string for RTL8821CS for existing Realtek Bluetooth driver. Signed-off-by: Chris Morgan Reviewed-by: Krzysztof Kozlowski Reviewed-by: Alistair Francis Signed-off-by: Luiz Augusto von Dentz commit 13209415d0e88396d99d346b184864834d70d68a Author: Meng Tang Date: Tue Feb 28 13:55:17 2023 +0800 Bluetooth: btusb: Add new PID/VID 04ca:3801 for MT7663 This bluetooth device is found in a combo WLAN/BT card for a MediaTek 7663. Tested on Acer Aspire A315-24P Notebook The device information: T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=04ca ProdID=3801 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms Signed-off-by: Meng Tang Signed-off-by: Luiz Augusto von Dentz commit ae051b044ebf5938940741c25a8989e07a5d7e88 Author: Luiz Augusto von Dentz Date: Mon Feb 27 15:50:58 2023 -0800 Bluetooth: hci_sync: Fix smatch warning This fixes the following new warning: net/bluetooth/hci_sync.c:2403 hci_pause_addr_resolution() warn: missing error code? 'err' Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202302251952.xryXOegd-lkp@intel.com/ Signed-off-by: Luiz Augusto von Dentz commit d4b20f0b8491bfb3238ebf7df4b13243189620d2 Author: Luiz Augusto von Dentz Date: Fri Feb 24 15:27:33 2023 -0800 Bluetooth: hci_core: Make hci_conn_hash_add append to the list This makes hci_conn_hash_add append to the tail of the conn_hash so it matches the order they are created, this is required if the controller attempts to match the order of ACL with CIS which uses append logic when programming the CIS ids on the CIG. The result of this change affects Create CIS: Before: < HCI Command: LE Create Connected Isochronous Stream (0x08|0x0064) plen 9 Number of CIS: 2 CIS Handle: 2560 ACL Handle: 3586 CIS Handle: 2561 ACL Handle: 3585 After: < HCI Command: LE Create Connected Isochronous Stream (0x08|0x0064) plen 9 Number of CIS: 2 CIS Handle: 2560 ACL Handle: 3585 CIS Handle: 2561 ACL Handle: 3586 Signed-off-by: Luiz Augusto von Dentz commit fe4b71b59ed5067ae591a33d512947160fd9aa89 Author: Victor Hassan Date: Wed Feb 22 17:47:20 2023 +0800 Bluetooth: btrtl: Add support for RTL8852BS Add the support for RTL8852BS BT controller on UART interface. The necessary firmware file will be submitted to linux-firmware. Signed-off-by: Victor Hassan Signed-off-by: Luiz Augusto von Dentz commit a860c50f7aef5186fcbb73aff224ae6f5e51cecc Author: Stefan Eichenberger Date: Mon Feb 13 13:09:25 2023 +0100 Bluetooth: hci_mrvl: Add serdev support for 88W8997 Add serdev support for the 88W8997 from NXP (previously Marvell). It includes support for changing the baud rate. The command to change the baud rate is taken from the user manual UM11483 Rev. 9 in section 7 (Bring-up of Bluetooth interfaces) from NXP. Signed-off-by: Stefan Eichenberger Signed-off-by: Francesco Dolcini Signed-off-by: Luiz Augusto von Dentz commit 069690a92ffdda399350af072ea62640bcd370df Author: Stefan Eichenberger Date: Mon Feb 13 13:09:24 2023 +0100 Bluetooth: hci_mrvl: use maybe_unused macro for device tree ids Use the maybe_unused macro for the device tree ids instead of #ifdef CONFIG_OF. This makes it easier to add support for new devices. Signed-off-by: Stefan Eichenberger Signed-off-by: Francesco Dolcini Signed-off-by: Luiz Augusto von Dentz commit 552705fd891b6ed6dda340567ce3ffff943f1f3b Author: Stefan Eichenberger Date: Mon Feb 13 13:09:23 2023 +0100 dt-bindings: bluetooth: marvell: add max-speed property The 88W8997 bluetooth module supports setting the max-speed property. Signed-off-by: Stefan Eichenberger Signed-off-by: Francesco Dolcini Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit c43132abfbe9d2f3befdbddfc3097d30905dc3d1 Author: Stefan Eichenberger Date: Mon Feb 13 13:09:22 2023 +0100 dt-bindings: bluetooth: marvell: add 88W8997 Update the documentation with the device tree binding for the Marvell 88W8997 bluetooth device. Signed-off-by: Stefan Eichenberger Acked-by: Krzysztof Kozlowski Signed-off-by: Francesco Dolcini Signed-off-by: Luiz Augusto von Dentz commit c13380a55522bf14e54779a142487c224509db95 Author: Tomasz Moń Date: Tue Feb 7 12:57:41 2023 +0100 Bluetooth: btusb: Do not require hardcoded interface numbers Remove hardcoded interface number check because Bluetooth specification since version 4.0 only recommends and no longer requires specific interface numbers. While earlier Bluetooth versions, i.e. 2.1 + EDR and 3.0 + HS, contain required configuration table in Volume 4 - Host Controller Interface Part B - USB Transport Layer, Bluetooth Core Specification Addendum 2 changes the table from required to recommended configuration. Signed-off-by: Tomasz Moń Signed-off-by: Luiz Augusto von Dentz commit a80d2c545ded86d0350b9a870735565d8b749786 Author: Luiz Augusto von Dentz Date: Mon Feb 13 14:28:55 2023 -0800 Bluetooth: MGMT: Use BIT macro when defining bitfields This makes use of BIT macro when defining bitfields which makes it clearer what bit it is toggling. Signed-off-by: Luiz Augusto von Dentz commit 919e57c3147ce66ed0887168e622c5e7a8f04440 Author: Volker Lendecke Date: Fri Mar 17 11:15:22 2023 +0000 cifs: Avoid a cast in add_lease_context() We have the correctly-typed struct smb2_create_req * available in the caller. Signed-off-by: Volker Lendecke Reviewed-by Ralph Boehme Signed-off-by: Steve French commit d2ec43b51521b4c83313df60d8b03a6640374c20 Author: Volker Lendecke Date: Thu Mar 30 12:04:47 2023 +0000 cifs: Simplify SMB2_open_init() Reduce code duplication by calculating req->CreateContextsLength in one place. This is the last reference to "req" in the add_*_context functions, remove that parameter. Signed-off-by: Volker Lendecke Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit 2a8d1387ed985341364b471ad63e323431ef6c4a Author: Volker Lendecke Date: Thu Mar 30 12:04:46 2023 +0000 cifs: Simplify SMB2_open_init() Reduce code duplication by stitching together create contexts in one place. Signed-off-by: Volker Lendecke Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit 5ec629e037ac5872139ebcac0c6af7d8675bbe6b Author: Volker Lendecke Date: Thu Mar 30 12:04:45 2023 +0000 cifs: Simplify SMB2_open_init() We can point to the create contexts in just one place, we don't have to do this in every add_*_context routine. Signed-off-by: Volker Lendecke Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit 289af45508ca890585f329376d16e08f41f75bd5 Merge: 02a8ae723225a 49953b70e7d38 Author: Dave Airlie Date: Mon Apr 24 10:34:04 2023 +1000 Merge tag 'exynos-drm-next-for-v6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next A patch series for implementing fbdev emulation as in-kernel client. - This patch series refactors fbdev callbacks to DRM client functions and simplifies fbdev emulation initialization including some code cleanups. The changes make fbdev emulation behave like a regular DRM client. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/20230417100624.35229-1-inki.dae@samsung.com commit 02dc51a0a07a379539b4661ecb56eeb5b19b3928 Author: Randy Dunlap Date: Sun Apr 9 18:13:06 2023 -0700 firewire: init_ohci1394_dma: use correct function names in comments Prevent kernel-doc complaints by using the correct function names in kernel-doc comments: drivers/firewire/init_ohci1394_dma.c:258: warning: expecting prototype for debug_init_ohci1394_dma(). Prototype was for init_ohci1394_dma_on_all_controllers() instead drivers/firewire/init_ohci1394_dma.c:289: warning: expecting prototype for setup_init_ohci1394_early(). Prototype was for setup_ohci1394_dma() instead Signed-off-by: Randy Dunlap Cc: Stefan Richter Cc: linux1394-devel@lists.sourceforge.net Cc: Andrew Morton Cc: Takashi Sakamoto Link: https://lore.kernel.org/r/20230410011306.26268-1-rdunlap@infradead.org Signed-off-by: Takashi Sakamoto commit f3948874c340cddb8c6d93d36f35742184d601a7 Author: Takashi Sakamoto Date: Mon Mar 6 12:58:14 2023 +0900 MAINTAINERS: replace maintainer of FireWire subsystem In the last few years, I have reviewed patches for FireWire subsystem and requested sound subsystem maintainer to sent them to mainline, since FireWire subsystem maintainer has been long absent. This situation is not preferable since we have some user of sound hardware in IEEE 1394 bus. I will stand for the maintainer, and work for FireWire core functions and 1394 OHCI driver, as well as sound drivers. This commit replaces the corresponding entry. As you know, IEEE 1394 is enough legacy. I would like to schedule the end of my work in the subsystem. My effort will last next 6 years. In 2026, I will start strong announcement for users to migrate their work load from IEEE 1394 bus (e.g. by purchasing alternative devices in USB and hardening system for them), then in 2029 let me resign the maintainer and close Linux 1394 project. My current work focuses on real time data (sampling data) transmission protocol in packet-oriented communication, thus I would provide less help to implementations for the other type of protocol; i.e. IPv4/IPv6 over IEEE 1394 bus (firewire-net), SCSI transport protocol over IEEE 1394 bus (firewire-sbp2) and iSCSI target (sbp-target). If receiving few objections from developers, I will start my work to send fixes for v6.3 prepatch, and PR for future v6.4 or later. I'm pleased if getting any help until the end. Reference: commit b32744751e75 ("firewire: add to MAINTAINERS") Acked-by: Stefan Richter Acked-by: Takashi Iwai Acked-by: Randy Dunlap Link: https://lore.kernel.org/r/20230306035814.78455-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 02a8ae723225afae25ddf9d2c7ca271b3f856b5a Merge: e82c98f2ca439 2c69679626d5d Author: Dave Airlie Date: Mon Apr 24 09:48:04 2023 +1000 Merge tag 'drm-intel-next-fixes-2023-04-20-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-next Active port PLL MST fix for second stream, CSC plane index fix, null and oob array deref fixes and selftest memory leak fix. Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZEDz9ZedyZVyFXxU@jlahtine-mobl.ger.corp.intel.com commit b5fda08ef213352ac2df7447611eb4d383cce929 Author: Zhihao Cheng Date: Wed Mar 1 20:29:19 2023 +0800 ubifs: Fix memleak when insert_old_idx() failed Following process will cause a memleak for copied up znode: dirty_cow_znode zn = copy_znode(c, znode); err = insert_old_idx(c, zbr->lnum, zbr->offs); if (unlikely(err)) return ERR_PTR(err); // No one refers to zn. Fetch a reproducer in [Link]. Function copy_znode() is split into 2 parts: resource allocation and znode replacement, insert_old_idx() is split in similar way, so resource cleanup could be done in error handling path without corrupting metadata(mem & disk). It's okay that old index inserting is put behind of add_idx_dirt(), old index is used in layout_leb_in_gaps(), so the two processes do not depend on each other. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216705 Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") Cc: stable@vger.kernel.org Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 7d01cb27f6aebc54efbe28d8961a973b8f795b13 Author: Zhihao Cheng Date: Wed Mar 1 20:29:18 2023 +0800 Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" This reverts commit 122deabfe1428 (ubifs: dirty_cow_znode: Fix memleak in error handling path). After commit 122deabfe1428 applied, if insert_old_idx() failed, old index neither exists in TNC nor in old-index tree. Which means that old index node could be overwritten in layout_leb_in_gaps(), then ubifs image will be corrupted in power-cut. Fixes: 122deabfe1428 (ubifs: dirty_cow_znode: Fix memleak ... path) Cc: stable@vger.kernel.org Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit bfe58458fd2557c9a81b89bc0ff10eb03d6c0745 Author: Davidlohr Bueso Date: Mon Mar 6 20:26:55 2023 -0800 cxl/mbox: Update CMD_RC_TABLE As of CXL 3.0 there have some added return codes, update the driver accordingly. Signed-off-by: Davidlohr Bueso Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20230307042655.6714-1-dave@stgolabs.net Signed-off-by: Dan Williams commit ca899f4021c9fc673935a09c17a7323527aefccd Merge: 856ef55e7e1fb c841ecd827715 Author: Dan Williams Date: Sun Apr 23 12:10:13 2023 -0700 Merge branch 'for-6.3/cxl-autodetect-fixes' into for-6.4/cxl Pick up late v6.3 fixes for v6.4. commit 856ef55e7e1fb411cd42b917bac2a7aaf75344ae Merge: 267214a2319b5 30a8a105f0ce9 Author: Dan Williams Date: Sun Apr 23 12:09:56 2023 -0700 Merge branch 'for-6.4/cxl-poison' into for-6.4/cxl Include the poison list and injection infrastructure from Alison for v6.4. commit 30a8a105f0ce9f2c83063b289f76833386d4a120 Author: Alison Schofield Date: Tue Apr 18 20:26:34 2023 -0700 tools/testing/cxl: Require CONFIG_DEBUG_FS The cxl_mem driver uses debugfs to support poison inject and clear. Add debugfs to the list of required symbols so that cxl_test can emulate those poison operations. Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/4f3aab57fbf1cc3ccde2eb887c5d90566c8d0e90.1681874357.git.alison.schofield@intel.com Signed-off-by: Dan Williams commit 98980d76c3fc3d56b34e425eb102b10355ccc743 Author: Alison Schofield Date: Tue Apr 18 20:26:33 2023 -0700 tools/testing/cxl: Add a sysfs attr to test poison inject limits CXL devices may report a maximum number of addresses that a device allows to be poisoned using poison injection. When cxl_test creates mock CXL memory devices, it defaults to MOCK_INJECT_DEV_MAX==88 for all mocked memdevs. Add a sysfs attribute, poison_inject_max to module cxl_mock_mem so that users can set a custom device injection limit. Fail, and return -EBUSY, if the mock poison list is not empty. /sys/bus/platform/drivers/cxl_mock_mem/poison_inject_max A simple usage model is to set the attribute before running a test in order to emulate a device's poison handling. Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/0f25b2862b90013545450222d2199e435c6cc11a.1681874357.git.alison.schofield@intel.com Signed-off-by: Dan Williams commit 8eac7ea72593010726713c5359a4b6aedf29b6fe Author: Alison Schofield Date: Tue Apr 18 20:26:32 2023 -0700 tools/testing/cxl: Use injected poison for get poison list Prior to poison inject support, the mock of 'Get Poison List' returned a poison list containing a single mocked error record. Following the addition of poison inject and clear support to the mock driver, use the mock_poison_list[], rather than faking an error record. Mock_poison_list[] list tracks the actual poison inject and clear requests issued by userspace. Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/0f4242c81821f4982b02cb1009c22783ef66b2f1.1681874357.git.alison.schofield@intel.com Signed-off-by: Dan Williams commit 6ec4b6d23e3a5b653cc8b6a7b09c20c30190cfce Author: Alison Schofield Date: Tue Apr 18 20:26:31 2023 -0700 tools/testing/cxl: Mock the Clear Poison mailbox command Mock the clear of poison by deleting the device:address entry from the mock_poison_list[]. Behave like a real CXL device and do not fail if the address is not in the poison list, but offer a dev_dbg() message. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/ecf19743c6572e60971bbd078f67d520cf5bca5d.1681874357.git.alison.schofield@intel.com Signed-off-by: Dan Williams commit 371c16101ee8a076cbe93ab95bbefdb43927003e Author: Alison Schofield Date: Tue Apr 18 20:26:30 2023 -0700 tools/testing/cxl: Mock the Inject Poison mailbox command Mock the injection of poison by storing the device:address entries in mock_poison_list[]. Enforce a limit of 8 poison injections per memdev device and 128 total entries for the cxl_test mock driver. Introducing the mock_poison[] list here, makes it available for use in the mock of Clear Poison, and the mock of Get Poison List. Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/f6b7f03541eaa8c2260d3eafadd04afe3f0d7962.1681874357.git.alison.schofield@intel.com Signed-off-by: Dan Williams commit 50d527f52cbf0680c87d11a254383ca730c5c19f Author: Alison Schofield Date: Tue Apr 18 20:26:29 2023 -0700 cxl/mem: Add debugfs attributes for poison inject and clear Inject and Clear Poison commands are optionally supported by CXL memdev devices and are intended for use in debug environments only. Add debugfs attributes for user access. Documentation/ABI/testing/debugfs-cxl describes the usage. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/0c9ea8e671b8e58465d18722788b60d325c675c7.1681874357.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit 98b6926562d9ccdbca69de9a0e0bf4f90d7f1326 Author: Alison Schofield Date: Tue Apr 18 20:26:28 2023 -0700 cxl/memdev: Trace inject and clear poison as cxl_poison events The cxl_poison trace event allows users to view the history of poison list reads. With the addition of inject and clear poison capabilities, users will expect similar tracing. Add trace types 'Inject' and 'Clear' to the cxl_poison trace_event and trace successful operations only. If the driver finds that the DPA being injected or cleared of poison is mapped in a region, that region info is included in the cxl_poison trace event. Region reconfigurations can make this extra info useless if the debug operations are not carefully managed. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/e20eb7c3029137b480ece671998c183da0477e2e.1681874357.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit 0a105ab28a4de44eb738ce64e9ac74946aa5133b Author: Alison Schofield Date: Tue Apr 18 20:26:27 2023 -0700 cxl/memdev: Warn of poison inject or clear to a mapped region Inject and clear poison capabilities and intended for debug usage only. In order to be useful in debug environments, the driver needs to allow inject and clear operations on DPAs mapped in regions. dev_warn_once() when either operation occurs. Signed-off-by: Alison Schofield Link: https://lore.kernel.org/r/f911ca5277c9d0f9757b72d7e6842871bfff4fa2.1681874357.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Reviewed-by: Jonathan Cameron Signed-off-by: Dan Williams commit 9690b07748d18ac667036a68442081c4aea33ba7 Author: Alison Schofield Date: Tue Apr 18 20:26:26 2023 -0700 cxl/memdev: Add support for the Clear Poison mailbox command CXL devices optionally support the CLEAR POISON mailbox command. Add memdev driver support for clearing poison. Per the CXL Specification (3.0 8.2.9.8.4.3), after receiving a valid clear poison request, the device removes the address from the device's Poison List and writes 0 (zero) for 64 bytes starting at address. If the device cannot clear poison from the address, it returns a permanent media error and -ENXIO is returned to the user. Additionally, and per the spec also, it is not an error to clear poison of an address that is not poisoned. If the address is not contained in the device's dpa resource, or is not 64 byte aligned, the driver returns -EINVAL without sending the command to the device. Poison clearing is intended for debug only and will be exposed to userspace through debugfs. Restrict compilation to CONFIG_DEBUG_FS. Implementation note: Although the CXL specification defines the clear command to accept 64 bytes of 'write-data', this implementation always uses zeroes as write-data. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/8682c30ec24bd9c45af5feccb04b02be51e58c0a.1681874357.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit d2fbc48658022f48625064ae192baff52057987d Author: Alison Schofield Date: Tue Apr 18 20:26:25 2023 -0700 cxl/memdev: Add support for the Inject Poison mailbox command CXL devices optionally support the INJECT POISON mailbox command. Add memdev driver support for the mailbox command. Per the CXL Specification (3.0 8.2.9.8.4.2), after receiving a valid inject poison request, the device will return poison when the address is accessed through the CXL.mem driver. Injecting poison adds the address to the device's Poison List and the error source is set to Injected. In addition, the device adds a poison creation event to its internal Informational Event log, updates the Event Status register, and if configured, interrupts the host. Also, per the CXL Specification, it is not an error to inject poison into an address that already has poison present and no error is returned from the device. If the address is not contained in the device's dpa resource, or is not 64 byte aligned, return -EINVAL without issuing the mbox command. Poison injection is intended for debug only and will be exposed to userspace through debugfs. Restrict compilation to CONFIG_DEBUG_FS. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/241c64115e6bd2effed9c7a20b08b3908dd7be8f.1681874357.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit f8d22bf50ca56a334ef58bf59ee299ed62940e42 Author: Alison Schofield Date: Tue Apr 18 10:39:09 2023 -0700 tools/testing/cxl: Mock support for Get Poison List Make mock memdevs support the Get Poison List mailbox command. Return a fake poison error record when the get poison list command is issued. This supports testing the kernel tracing and cxl list capabilities for media errors. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/14d661ce3e3a32b7d8e76b8ecc5eb88343b3d09c.1681838292.git.alison.schofield@intel.com Signed-off-by: Dan Williams commit 28a3ae4ff66c622448f5dfb7416bbe753e182eb4 Author: Alison Schofield Date: Tue Apr 18 10:39:08 2023 -0700 cxl/trace: Add an HPA to cxl_poison trace events When a cxl_poison trace event is reported for a region, the poisoned Device Physical Address (DPA) can be translated to a Host Physical Address (HPA) for consumption by user space. Translate and add the resulting HPA to the cxl_poison trace event. Follow the device decode logic as defined in the CXL Spec 3.0 Section 8.2.4.19.13. If no region currently maps the poison, assign ULLONG_MAX to the cxl_poison event hpa field. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/6d3cd726f9042a59902785b0a2cb3ddfb70e0219.1681838292.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit f0832a58639691af575fa28ffaeb657c51f3ca06 Author: Alison Schofield Date: Tue Apr 18 10:39:07 2023 -0700 cxl/region: Provide region info to the cxl_poison trace event User space may need to know which region, if any, maps the poison address(es) logged in a cxl_poison trace event. Since the mapping of DPAs (device physical addresses) to a region can change, the kernel must provide this information at the time the poison list is read. The event informs user space that at event this mapped to this , which is poisoned. The cxl_poison trace event is already wired up to log the region name and uuid if it receives param 'struct cxl_region'. In order to provide that cxl_region, add another method for gathering poison - by committed endpoint decoder mappings. This method is only available with CONFIG_CXL_REGION and is only used if a region actually maps the memdev where poison is being read. After the region driver reads the poison list for all the mapped resources, poison is read for any remaining unmapped resources. The default method remains: read the poison by memdev resource. Signed-off-by: Alison Schofield Tested-by: Jonathan Cameron Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/438b01ccaa70592539e8eda4eb2b1d617ba03160.1681838292.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit 7ff6ad1075885fdc71f6fea94b95109a582dec29 Author: Alison Schofield Date: Tue Apr 18 10:39:06 2023 -0700 cxl/memdev: Add trigger_poison_list sysfs attribute When a boolean 'true' is written to this attribute the memdev driver retrieves the poison list from the device. The list consists of addresses that are poisoned, or would result in poison if accessed, and the source of the poison. This attribute is only visible for devices supporting the capability. The retrieved errors are logged as kernel events when cxl_poison event tracing is enabled. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/1081cfdc8a349dc754779642d584707e56db26ba.1681838291.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit ddf49d57b841e55e1b0aee1224a9f526e50e1bcc Author: Alison Schofield Date: Tue Apr 18 10:39:05 2023 -0700 cxl/trace: Add TRACE support for CXL media-error records CXL devices may support the retrieval of a device poison list. Add a new trace event that the CXL subsystem may use to log the media-error records returned in the poison list. Log each media-error record as a cxl_poison trace event of type 'List'. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/de6196f5269483d886ab1834744f82d27189a666.1681838291.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit ed83f7ca398b3798b82c1d5d1113011c0e5a2198 Author: Alison Schofield Date: Tue Apr 18 10:39:04 2023 -0700 cxl/mbox: Add GET_POISON_LIST mailbox command CXL devices maintain a list of locations that are poisoned or result in poison if the addresses are accessed by the host. Per the spec, (CXL 3.0 8.2.9.8.4.1), the device returns this Poison list as a set of Media Error Records that include the source of the error, the starting device physical address, and length. The length is the number of adjacent DPAs in the record and is in units of 64 bytes. Retrieve the poison list. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/a1f332e817834ef8e89c0ff32e760308fb903346.1681838291.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit d0abf5787adc0341a04667d3b4a23b4d0999af30 Author: Alison Schofield Date: Tue Apr 18 10:39:03 2023 -0700 cxl/mbox: Initialize the poison state Driver reads of the poison list are synchronized to ensure that a reader does not get an incomplete list because their request overlapped (was interrupted or preceded by) another read request of the same DPA range. (CXL Spec 3.0 Section 8.2.9.8.4.1). The driver maintains state information to achieve this goal. To initialize the state, first recognize the poison commands in the CEL (Command Effects Log). If the device supports Get Poison List, allocate a single buffer for the poison list and protect it with a lock. Signed-off-by: Alison Schofield Link: https://lore.kernel.org/r/9078d180769be28a5087288b38cdfc827cae58bf.1681838291.git.alison.schofield@intel.com Reviewed-by: Jonathan Cameron Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit dec441d32a9a1e4a891ccda3356cac61cc1ffe79 Author: Alison Schofield Date: Tue Apr 18 10:39:02 2023 -0700 cxl/mbox: Restrict poison cmds to debugfs cxl_raw_allow_all The Get, Inject, and Clear poison commands are not available for direct user access because they require kernel driver controls to perform safely. Further restrict access to these commands by requiring the selection of the debugfs attribute 'cxl_raw_allow_all' to enable in raw mode. Signed-off-by: Alison Schofield Link: https://lore.kernel.org/r/0e5cb41ffae2bab800957d3b9003eedfd0a2dfd5.1681838291.git.alison.schofield@intel.com Reviewed-by: Jonathan Cameron Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit 3951adc42ac878fff84f10e194ed13c32fa9c971 Merge: fadfc57cc8047 7eb060a51a3ba Author: David S. Miller Date: Sun Apr 23 18:47:09 2023 +0100 Merge branch 'net-sched-parsing-prints' Pedro Tammela says: ==================== net/sched: cleanup parsing prints in htb and qfq These two qdiscs are still using prints on dmesg to report parsing errors. Since the parsing code has access to extack, convert these error messages to extack. QFQ also had the opportunity to remove some redundant code in the parameters parsing by transforming some attributes into parsing policies. v4->v5: Rebased v3->v4: Drop 'BITification' as suggested by Eric v2->v3: Address suggestions by Jakub and Simon v1->v2: Address suggestions by Jakub ==================== Signed-off-by: David S. Miller commit 7eb060a51a3ba44acefafefd242dcbf12dd91fb9 Author: Pedro Tammela Date: Sat Apr 22 12:56:12 2023 -0300 selftests: tc-testing: add more tests for sch_qfq The QFQ qdisc class has parameter bounds that are not being checked for correctness. Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit 25369891fcef373540f8b4e0b3bccf77a04490d5 Author: Pedro Tammela Date: Sat Apr 22 12:56:11 2023 -0300 net/sched: sch_qfq: refactor parsing of netlink parameters Two parameters can be transformed into netlink policies and validated while parsing the netlink message. Reviewed-by: Simon Horman Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit c69a9b023f65b73068a17f2f4eb6a1b6e257f5bf Author: Pedro Tammela Date: Sat Apr 22 12:56:10 2023 -0300 net/sched: sch_qfq: use extack on errors messages Some error messages are still being printed to dmesg. Since extack is available, provide error messages there. Reviewed-by: Simon Horman Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit 807cfded92b0a2e8be9c078c693075790c7c4131 Author: Pedro Tammela Date: Sat Apr 22 12:56:09 2023 -0300 net/sched: sch_htb: use extack on errors messages Some error messages are still being printed to dmesg. Since extack is available, provide error messages there. Reviewed-by: Simon Horman Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit fd84c569f7b8bbf8154c9940b427942ff5bfbc48 Merge: 2f0f9465ad9fa e3c9673e2f6e1 Author: David S. Miller Date: Sun Apr 23 18:35:27 2023 +0100 Merge branch 'act_pedit-minor-improvements' Pedro Tammela says: ==================== net/sched: act_pedit: minor improvements This series aims to improve the code and usability of act_pedit for netlink users. Patches 1-2 improves error reporting for extended keys parsing with extack. Patch 3 checks the static offsets a priori on create/update. Currently, this is done at the datapath for both static and runtime offsets. Patch 4 removes a check from the datapath which is redundant since the netlink parsing validates the key types. Patch 5 changes the 'pr_info()' calls in the datapath to rate limited versions. ==================== Signed-off-by: David S. Miller commit e3c9673e2f6e1b3aa4bb87c570336e10f364c28a Author: Pedro Tammela Date: Fri Apr 21 18:25:17 2023 -0300 net/sched: act_pedit: rate limit datapath messages Unbounded info messages in the pedit datapath can flood the printk ring buffer quite easily depending on the action created. As these messages are informational, usually printing some, not all, is enough to bring attention to the real issue. Reviewed-by: Jamal Hadi Salim Reviewed-by: Simon Horman Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit 577140180ba28d0d37bc898c7bd6702c83aa106f Author: Pedro Tammela Date: Fri Apr 21 18:25:16 2023 -0300 net/sched: act_pedit: remove extra check for key type The netlink parsing already validates the key 'htype'. Remove the datapath check as it's redundant. Reviewed-by: Jamal Hadi Salim Reviewed-by: Simon Horman Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit e1201bc781c28766720e78a5e099ffa568be4d74 Author: Pedro Tammela Date: Fri Apr 21 18:25:15 2023 -0300 net/sched: act_pedit: check static offsets a priori Static key offsets should always be on 32 bit boundaries. Validate them on create/update time for static offsets and move the datapath validation for runtime offsets only. iproute2 already errors out if a given offset and data size cannot be packed to a 32 bit boundary. This change will make sure users which create/update pedit instances directly via netlink also error out, instead of finding out when packets are traversing. Reviewed-by: Jamal Hadi Salim Reviewed-by: Simon Horman Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit 0c83c5210e18763ec54252b990d270748c99b01d Author: Pedro Tammela Date: Fri Apr 21 18:25:14 2023 -0300 net/sched: act_pedit: use extack in 'ex' parsing errors We have extack available when parsing 'ex' keys, so pass it to tcf_pedit_keys_ex_parse and add more detailed error messages. Reviewed-by: Simon Horman Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit 5036034572b79daa6d6600338e8e8229e2a44b09 Author: Pedro Tammela Date: Fri Apr 21 18:25:13 2023 -0300 net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys Transform two checks in the 'ex' key parsing into netlink policies removing extra if checks. Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 7e8472c820f04517ae5d5a27c1aecfa2263a0aa5 Author: Akira Yokosawa Date: Tue Mar 7 10:36:34 2023 +0900 media: Adjust column width for pdfdocs The column width specifiers added in commit 8d0e3fc61abd ("media: Add 2-10-10-10 RGB formats") don't suffice for column 1 and too wide for column 2. Adjust them to get a good looking table. Fixes: 8d0e3fc61abd ("media: Add 2-10-10-10 RGB formats") Cc: Tomi Valkeinen Signed-off-by: Akira Yokosawa Link: https://lore.kernel.org/r/f94e3ada-212c-eef7-9e7b-03760bb29521@gmail.com Signed-off-by: Jonathan Corbet commit fc623d89b4c404f2dea917d00eba2111f3c1bc15 Author: Tomi Valkeinen Date: Tue Mar 7 10:34:28 2023 +0900 media: Fix building pdfdocs Commit 8d0e3fc61abd ("media: Add 2-10-10-10 RGB formats") added documentation for a few new RGB formats. The table has column-width specifiers for 34 columns used in pdfdocs build. However, the new table has a couple of rows with 35 columns which confused Sphinx's latex builder. The resulting .tex file causes an error in a later stage of a pdfdocs build. Remove the trailing empty dash lines to fix the issue. Fixes: 8d0e3fc61abd ("media: Add 2-10-10-10 RGB formats") Reported-by: Akira Yokosawa Link: https://lore.kernel.org/r/12250823-8445-5854-dfb8-b92c0ff0851e@gmail.com/ Signed-off-by: Tomi Valkeinen Tested-by: Akira Yokosawa Reviewed-by: Laurent Pinchart Acked-by: Mauro Carvalho Chehab [akiyks: explain the cause of build error] Signed-off-by: Akira Yokosawa Link: https://lore.kernel.org/r/29380b3e-1daa-3aef-1749-dbd9960ba620@gmail.com Signed-off-by: Jonathan Corbet commit 1c19ac768b8eeb0304c4ed7db66c2bb89c6ad226 Author: Christophe JAILLET Date: Sun Apr 23 10:10:07 2023 +0200 hwmon: lochnagar: Remove the unneeded include This driver does not use i2c, so there is no point in including Remove it. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/df555e724d1b52bd9958c0bd729a774dfe0cf150.1682237387.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck commit 31f735c65d4f4825c57620f39f2fa27aa01ac172 Author: Masahiro Yamada Date: Mon Apr 17 23:25:47 2023 +0900 kbuild: add srcdeb-pkg target This new target builds only the debian source package. Unify the build rules of deb-pkg, srcdeb-pkg, bindeb-pkg to avoid code duplication. --no-check-builddeps is added to srcdeb-pkg so that build dependencies will not be checked. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 2f0f9465ad9fa9c93f30009184c10da0f504f313 Author: Yajun Deng Date: Fri Apr 21 16:26:06 2023 +0800 net: sched: Print msecs when transmit queue time out The kernel will print several warnings in a short period of time when it stalls. Like this: First warning: [ 7100.097547] ------------[ cut here ]------------ [ 7100.097550] NETDEV WATCHDOG: eno2 (xxx): transmit queue 8 timed out [ 7100.097571] WARNING: CPU: 8 PID: 0 at net/sched/sch_generic.c:467 dev_watchdog+0x260/0x270 ... Second warning: [ 7147.756952] rcu: INFO: rcu_preempt self-detected stall on CPU [ 7147.756958] rcu: 24-....: (59999 ticks this GP) idle=546/1/0x400000000000000 softirq=367 3137/3673146 fqs=13844 [ 7147.756960] (t=60001 jiffies g=4322709 q=133381) [ 7147.756962] NMI backtrace for cpu 24 ... We calculate that the transmit queue start stall should occur before 7095s according to watchdog_timeo, the rcu start stall at 7087s. These two times are close together, it is difficult to confirm which happened first. To let users know the exact time the stall started, print msecs when the transmit queue time out. Signed-off-by: Yajun Deng Signed-off-by: David S. Miller commit 00266b365d2b5a7ab4c9fa300784607d5770f8bc Merge: 4d2bd2581c3bc 0bcf2e4aca6c2 Author: David S. Miller Date: Sun Apr 23 14:16:45 2023 +0100 Merge branch 'dsa-skb_mac_header' Vladimir Oltean says: ==================== Remove skb_mac_header() dependency in DSA xmit path Eric started working on removing skb_mac_header() assumptions from the networking xmit path, and I offered to help for DSA: https://lore.kernel.org/netdev/20230321164519.1286357-1-edumazet@google.com/ The majority of this patch set is a straightforward replacement of skb_mac_header() with skb->data (hidden either behind skb_eth_hdr(), or behind skb_vlan_eth_hdr()). The only patch which is more "interesting" is 9/9. Another potential caller of __skb_vlan_pop() on xmit (and therefore also of skb_mac_header()) is tcf_vlan_act(), but I haven't had the time to investigate that (enough to submit changes other than what's here). v1->v2: - 09/09: document the vlan_tci argument of vlan_remove_tag() in the kdoc v1 at: https://lore.kernel.org/netdev/20230322233823.1806736-1-vladimir.oltean@nxp.com/ Cc: Madalin Bucur ==================== Signed-off-by: David S. Miller commit 0bcf2e4aca6c29a07555b713f2fb461dc38d5977 Author: Vladimir Oltean Date: Fri Apr 21 01:56:01 2023 +0300 net: dsa: tag_ocelot: call only the relevant portion of __skb_vlan_pop() on TX ocelot_xmit_get_vlan_info() calls __skb_vlan_pop() as the most appropriate helper I could find which strips away a VLAN header. That's all I need it to do, but __skb_vlan_pop() has more logic, which will become incompatible with the future revert of commit 6d1ccff62780 ("net: reset mac header in dev_start_xmit()"). Namely, it performs a sanity check on skb_mac_header(), which will stop being set after the above revert, so it will return an error instead of removing the VLAN tag. ocelot_xmit_get_vlan_info() gets called in 2 circumstances: (1) the port is under a VLAN-aware bridge and the bridge sends VLAN-tagged packets (2) the port is under a VLAN-aware bridge and somebody else (an 8021q upper) sends VLAN-tagged packets (using a VID that isn't in the bridge vlan tables) In case (1), there is actually no bug to defend against, because br_dev_xmit() calls skb_reset_mac_header() and things continue to work. However, in case (2), illustrated using the commands below, it can be seen that our intervention is needed, since __skb_vlan_pop() complains: $ ip link add br0 type bridge vlan_filtering 1 && ip link set br0 up $ ip link set $eth master br0 && ip link set $eth up $ ip link add link $eth name $eth.100 type vlan id 100 && ip link set $eth.100 up $ ip addr add 192.168.100.1/24 dev $eth.100 I could fend off the checks in __skb_vlan_pop() with some skb_mac_header_was_set() calls, but seeing how few callers of __skb_vlan_pop() there are from TX paths, that seems rather unproductive. As an alternative solution, extract the bare minimum logic to strip a VLAN header, and move it to a new helper named vlan_remove_tag(), close to the definition of vlan_insert_tag(). Document it appropriately and make ocelot_xmit_get_vlan_info() call this smaller helper instead. Seeing that it doesn't appear illegal to test skb->protocol in the TX path, I guess it would be a good for vlan_remove_tag() to also absorb the vlan_set_encap_proto() function call. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit f0a9d563064c3040a2d7b32317b37a6bcb1099b2 Author: Vladimir Oltean Date: Fri Apr 21 01:56:00 2023 +0300 net: dsa: update TX path comments to not mention skb_mac_header() Once commit 6d1ccff62780 ("net: reset mac header in dev_start_xmit()") will be reverted, it will no longer be true that skb->data points at skb_mac_header(skb) - since the skb->mac_header will not be set - so stop saying that, and just say that it points to the MAC header. I've reviewed vlan_insert_tag() and it does not *actually* depend on skb_mac_header(), so reword that to avoid the confusion. Signed-off-by: Vladimir Oltean Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit b5653b157e55a25ec76506e8cd31353e0ed4944c Author: Vladimir Oltean Date: Fri Apr 21 01:55:59 2023 +0300 net: dsa: tag_sja1105: replace skb_mac_header() with vlan_eth_hdr() This is a cosmetic patch which consolidates the code to use the helper function offered by if_vlan.h. Signed-off-by: Vladimir Oltean Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit f9346f00b5af0b32503dcd74072392d9592163ef Author: Vladimir Oltean Date: Fri Apr 21 01:55:58 2023 +0300 net: dsa: tag_sja1105: don't rely on skb_mac_header() in TX paths skb_mac_header() will no longer be available in the TX path when reverting commit 6d1ccff62780 ("net: reset mac header in dev_start_xmit()"). As preparation for that, let's use skb_vlan_eth_hdr() to get to the VLAN header instead, which assumes it's located at skb->data (assumption which holds true here). Signed-off-by: Vladimir Oltean Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 499b2491d550677b824b828ff431e4ef4d1d3b9d Author: Vladimir Oltean Date: Fri Apr 21 01:55:57 2023 +0300 net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths skb_mac_header() will no longer be available in the TX path when reverting commit 6d1ccff62780 ("net: reset mac header in dev_start_xmit()"). As preparation for that, let's use skb_eth_hdr() to get to the Ethernet header's MAC DA instead, helper which assumes this header is located at skb->data (assumption which holds true here). Signed-off-by: Vladimir Oltean Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit eabb1494c9f20362ae53a9991481a1523be4f4b7 Author: Vladimir Oltean Date: Fri Apr 21 01:55:56 2023 +0300 net: dsa: tag_ocelot: do not rely on skb_mac_header() for VLAN xmit skb_mac_header() will no longer be available in the TX path when reverting commit 6d1ccff62780 ("net: reset mac header in dev_start_xmit()"). As preparation for that, let's use skb_vlan_eth_hdr() to get to the VLAN header instead, which assumes it's located at skb->data (assumption which holds true here). Signed-off-by: Vladimir Oltean Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e2fdfd7119128b49d81972a75e74169802aa8ae0 Author: Vladimir Oltean Date: Fri Apr 21 01:55:55 2023 +0300 net: dpaa: avoid one skb_reset_mac_header() in dpaa_enable_tx_csum() It appears that dpaa_enable_tx_csum() only calls skb_reset_mac_header() to get to the VLAN header using skb_mac_header(). We can use skb_vlan_eth_hdr() to get to the VLAN header based on skb->data directly. This avoids spending a few cycles to set skb->mac_header. Signed-off-by: Vladimir Oltean Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Acked-by: Madalin Bucur Signed-off-by: David S. Miller commit 1f5020acb33f926030f62563c86dffca35c7b701 Author: Vladimir Oltean Date: Fri Apr 21 01:55:54 2023 +0300 net: vlan: introduce skb_vlan_eth_hdr() Similar to skb_eth_hdr() introduced in commit 96cc4b69581d ("macvlan: do not assume mac_header is set in macvlan_broadcast()"), let's introduce a skb_vlan_eth_hdr() helper which can be used in TX-only code paths to get to the VLAN header based on skb->data rather than based on the skb_mac_header(skb). We also consolidate the drivers that dereference skb->data to go through this helper. Signed-off-by: Vladimir Oltean Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit f90615ada0b1e21a9d93ff89b04549fd7a92c92b Author: Vladimir Oltean Date: Fri Apr 21 01:55:53 2023 +0300 net: vlan: don't adjust MAC header in __vlan_insert_inner_tag() unless set This is a preparatory change for the deletion of skb_reset_mac_header(skb) from __dev_queue_xmit(). After that deletion, skb_mac_header(skb) will no longer be set in TX paths, from which __vlan_insert_inner_tag() can still be called (perhaps indirectly). If we don't make this change, then an unset MAC header (equal to ~0U) will become set after the adjustment with VLAN_HLEN. Signed-off-by: Vladimir Oltean Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 4d2bd2581c3bc73e9fdf5f82b25c359212567457 Author: Ramón Nordin Rodriguez Date: Fri Apr 21 18:38:54 2023 +0200 drivers/net/phy: add driver for Microchip LAN867x 10BASE-T1S PHY This patch adds support for the Microchip LAN867x 10BASE-T1S family (LAN8670/1/2). The driver supports P2MP with PLCA. Reviewed-by: Andrew Lunn Signed-off-by: Ramón Nordin Rodriguez Signed-off-by: David S. Miller commit fadfc57cc8047080a123b16f288b7138524fb1e2 Author: Marc Dionne Date: Fri Apr 21 17:16:17 2023 +0100 rxrpc: Fix error when reading rxrpc tokens When converting from ASSERTCMP to WARN_ON, the tested condition must be inverted, which was missed for this case. This would cause an EIO error when trying to read an rxrpc token, for instance when trying to display tokens with AuriStor's "tokens" command. Fixes: 84924aac08a4 ("rxrpc: Fix checker warning") Signed-off-by: Marc Dionne Signed-off-by: David Howells cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Signed-off-by: David S. Miller commit b148b9abc8444c9e0579a6bbe47b2da6adf5a150 Author: Wang Zhang Date: Fri Apr 21 23:10:09 2023 +0800 net: ethernet: mediatek: remove return value check of `mtk_wed_hw_add_debugfs` Smatch complains that: mtk_wed_hw_add_debugfs() warn: 'dir' is an error pointer or valid Debugfs checks are generally not supposed to be checked for errors and it is not necessary here. fix it by just deleting the dead code. Signed-off-by: Wang Zhang Reviewed-by: Dongliang Mu Signed-off-by: David S. Miller commit 788352191c85326beb74f518ba761ed38b82f533 Author: Gustavo A. R. Silva Date: Fri Apr 21 14:08:53 2023 +0100 rxrpc: Replace fake flex-array with flexible-array member Zero-length arrays as fake flexible arrays are deprecated and we are moving towards adopting C99 flexible-array members instead. Transform zero-length array into flexible-array member in struct rxrpc_ackpacket. Address the following warnings found with GCC-13 and -fstrict-flex-arrays=3 enabled: net/rxrpc/call_event.c:149:38: warning: array subscript i is outside array bounds of ‘uint8_t[0]’ {aka ‘unsigned char[]’} [-Warray-bounds=] This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. Link: https://github.com/KSPP/linux/issues/21 Link: https://github.com/KSPP/linux/issues/263 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Signed-off-by: David Howells Reviewed-by: Simon Horman Reviewed-by: Kees Cook Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org cc: linux-hardening@vger.kernel.org Link: https://lore.kernel.org/r/ZAZT11n4q5bBttW0@work/ Signed-off-by: David S. Miller commit 6bb218b5a6e3f3c5e2e76faf8fc976f3f6f72496 Merge: 19c60fdee5db8 87eff2ec57b6d Author: David S. Miller Date: Sun Apr 23 13:35:08 2023 +0100 Merge branch 'napi_threaded_poll-enhancements' Eric Dumazet says: ==================== net: give napi_threaded_poll() some love There is interest to revert commit 4cd13c21b207 ("softirq: Let ksoftirqd do its job") and use instead the napi_threaded_poll() mode. https://lore.kernel.org/netdev/140f61e2e1fcb8cf53619709046e312e343b53ca.camel@redhat.com/T/#m8a8f5b09844adba157ad0d22fc1233d97013de50 Before doing so, make sure napi_threaded_poll() benefits from recent core stack improvements, to further reduce softirq triggers. ==================== Signed-off-by: David S. Miller commit 87eff2ec57b6d68d294013d8dd21e839a1175e3a Author: Eric Dumazet Date: Fri Apr 21 09:43:57 2023 +0000 net: optimize napi_threaded_poll() vs RPS/RFS We use napi_threaded_poll() in order to reduce our softirq dependency. We can add a followup of 821eba962d95 ("net: optimize napi_schedule_rps()") to further remove the need of firing NET_RX_SOFTIRQ whenever RPS/RFS are used. Signed-off-by: Eric Dumazet Acked-by: Paolo Abeni Signed-off-by: David S. Miller commit a1aaee7f8f79d1b0595e24f8c3caed24630d6cb6 Author: Eric Dumazet Date: Fri Apr 21 09:43:56 2023 +0000 net: make napi_threaded_poll() aware of sd->defer_list If we call skb_defer_free_flush() from napi_threaded_poll(), we can avoid to raise IPI from skb_attempt_defer_free() when the list becomes too big. This allows napi_threaded_poll() to rely less on softirqs, and lowers latency caused by a too big list. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit e6f50edfef046cf8ad541b4d5972bf38fdcdec39 Author: Eric Dumazet Date: Fri Apr 21 09:43:55 2023 +0000 net: move skb_defer_free_flush() up We plan using skb_defer_free_flush() from napi_threaded_poll() in the following patch. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 931e93bdf8ca71cef1f8759c43bc2c5385392b8b Author: Eric Dumazet Date: Fri Apr 21 09:43:54 2023 +0000 net: do not provide hard irq safety for sd->defer_lock kfree_skb() can be called from hard irq handlers, but skb_attempt_defer_free() is meant to be used from process or BH contexts, and skb_defer_free_flush() is meant to be called from BH contexts. Not having to mask hard irq can save some cycles. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit e8e1ce8454c9cc8ad2e4422bef346428e52455e3 Author: Eric Dumazet Date: Fri Apr 21 09:43:53 2023 +0000 net: add debugging checks in skb_attempt_defer_free() Make sure skbs that are stored in softnet_data.defer_list do not have a dst attached. Also make sure the the skb was orphaned. Link: https://lore.kernel.org/netdev/CANn89iJuEVe72bPmEftyEJHLzzN=QNR2yueFjTxYXCEpS5S8HQ@mail.gmail.com/T/ Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 19c60fdee5db881a99a9c39fb31942a530d20c63 Merge: 4eaeca1fc43a4 b488ae52ef9f7 Author: David S. Miller Date: Sun Apr 23 13:27:36 2023 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== This series lowers the CPU usage of the ice driver when using its provided /dev/gnss*. ==================== Signed-off-by: David S. Miller commit 4eaeca1fc43a4060fa79d7a071572e89181a725e Author: Felix Fietkau Date: Thu Apr 20 22:06:42 2023 +0100 net: mtk_eth_soc: mediatek: fix ppe flow accounting for v1 hardware Older chips (like MT7622) use a different bit in ib2 to enable hardware counter support. Add macros for both and select the appropriate bit. Fixes: 3fbe4d8c0e53 ("net: ethernet: mtk_eth_soc: ppe: add support for flow accounting") Signed-off-by: Felix Fietkau Signed-off-by: Daniel Golle Signed-off-by: David S. Miller commit 8d60d5cabea12cd533e4f216ab3b773390165aac Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:20 2023 +0200 ALSA: emu10k1: use high-level I/O functions also during init ... and also use more pre-defined constants on the way (some of which required adjustment). Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1143967-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 14a2956539b0620d3b7369af75ddc73f18852835 Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:21 2023 +0200 ALSA: emu10k1: fix error handling in snd_audigy_i2c_volume_put() Check all inputs before changing anything, and return the right error code in case of failure. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1144026-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit dad173035ed6b3ba45b5f3923908f09093964900 Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:21 2023 +0200 ALSA: emu10k1: don't stop DSP in _snd_emu10k1_{,audigy_}init_efx() These functions don't actually touch the DSP until they poke the code into it, at which point it's temporarily stopped anyway. And fx8010.dbg is already zero anyway. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1144004-2-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 375052892172c741b93e8e9303ec186cca7169ab Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:20 2023 +0200 ALSA: emu10k1: fix SNDRV_EMU10K1_IOCTL_SINGLE_STEP - Use correct address limit for Audigy - Use the right constant to actually make a step on Audigy - Don't store *_DBG_STEP and the address in emu->fx8010.dbg, as otherwise unrelated operations would make steps, too This is untested. as10k1 was never ported to Audigy anyway. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1144004-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 65243c7eb601fdb1e0f979e7404d87b91f913387 Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:21 2023 +0200 ALSA: emu10k1: skip Sound Blaster-specific hacks for E-MU cards The rev2 cards use CA0108, but the embedded P17V goes entirely unused. Also, A_IOCTL (which is really the GPIO port) is actually the FPGA control port, so messing with it is no good idea. The hacks are actually mutually exclusive, so make that explicit while we're at it. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1143888-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 2696d5a3b0ec9f242b0220999933b6c78502b1b2 Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:20 2023 +0200 ALSA: emu10k1: fixup DSP defines Firstly, fix the distribution between public and private headers. Otherwise, some of the already public macros wouldn't actually work, and the SNDRV_EMU10K1_IOCTL_DBG_READ result for Audigy would be useless. Secondly, add condition code registers for Audigy. These are just aliases for selected constant registers, and thus are generation- specific. At least A_CC_REG_ZERO is actually correct ... Finally, shuffle around some defines to more logical places while at it, and fix up some more comments. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1143903-7-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 145ec1fd00a875d5afc54f52295472e2a898e35c Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:19 2023 +0200 ALSA: emu10k1: pull in some register definitions from kX-project For documentation purposes and later use. Some pre-existing but (mostly) unused definitions were renamed for consistency. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1143903-6-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit ac9219d93a983b0e146878695beb64ea624747d4 Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:18 2023 +0200 ALSA: emu10k1: remove some bogus defines Firstly, remove the FXWC_* defines - the comment on FXWC implies that the relevant defines are the (A_)EXTOUT_* ones. It's unclear where this came from - it was in the initial ALSA import, but neither the driver from Creative nor kX-project have these defines. Secondly, remove A_HR, which made plain no sense (was unused, and clashed with FXRT). Amends commit cbb7d8f9b7b ("emu10k1: Update registers defines for the Audigy 2/emu10k2.5"). Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1143903-5-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit a062b1032adae9ad89afb8dca299ef3ce9aca566 Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:17 2023 +0200 ALSA: emu10k1: eliminate some unused defines One might be mislead to think that these mean anything. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1143903-4-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 6815f5359aa5d02d1a936221812ab46624c39283 Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:16 2023 +0200 ALSA: emu10k1: fix lineup of EMU_HANA_* defines The bit values are supposed to be internally indented by one step relative to the register addresses. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1143903-3-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit a869057cd639ed41a1b16bc072fb20cb1ed1dc51 Author: Oswald Buddenhagen Date: Sat Apr 22 18:10:15 2023 +0200 ALSA: emu10k1: comment updates Move comments to better locations, de-duplicate, fix/remove incorrect/ outdated ones, add new ones, and unify spacing somewhat. While at it, also add testing credits for Jonathan Dowland (SB Live! Platinum) and myself (E-MU 0404b). Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422161021.1143903-2-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 3db166d6cf0ea73dd2c887036aad2e95e0884d9b Author: Dan Williams Date: Tue Apr 18 10:39:01 2023 -0700 cxl/mbox: Deprecate poison commands The CXL subsystem is adding formal mechanisms for managing device poison. Minimize the maintenance burden going forward, and maximize the investment in common tooling by deprecating direct user access to poison commands outside of CXL_MEM_RAW_COMMANDS debug scenarios. A new cxl_deprecated_commands[] list is created for querying which command ids defined in previous kernels are now deprecated. CXL Media and Poison Management commands, opcodes 0x43XX, defined in CXL 3.0 Spec, Table 8-93 are deprecated with one exception: Get Scan Media Capabilities. Keep Get Scan Media Capabilities as it simply provides information and has no impact on the device state. Effectively all of the commands defined in: commit 87815ee9d006 ("cxl/pci: Add media provisioning required commands") ...were defined prematurely and should have waited until the kernel implementation was decided. To my knowledge there are no shipping devices with poison support and no known tools that would regress with this change. Co-developed-by: Alison Schofield Signed-off-by: Alison Schofield Link: https://lore.kernel.org/r/652197e9bc8885e6448d989405b9e50ee9d6b0a6.1681838291.git.alison.schofield@intel.com Tested-by: Jonathan Cameron Signed-off-by: Dan Williams commit f4670a1b30f886e843258ca4a69c442811a90302 Author: Nathan Chancellor Date: Fri Apr 21 09:11:27 2023 -0700 MIPS: Sink body of check_bugs_early() into its only call site If check_bugs_early() is not inlined, which a compiler is free to do after commit ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly"), modpost would warn that check_bugs_early(), a non-init function, refers to check_bugs64_early(), which is marked __init. This would not result in any run time issues, as check_bugs_early() is only called from setup_arch(), which is marked __init. To avoid this potential warning, just sink the body of check_bugs_early() into its single call site in setup_arch(). Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Bogendoerfer commit 95b5baf81001a80a8dd8b35306694db163bcb423 Author: Nathan Chancellor Date: Fri Apr 21 09:11:26 2023 -0700 MIPS: Mark check_bugs() as __init After commit ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly"), a compiler may choose not to inline a function marked with just 'inline'. If check_bugs() is not inlined into start_kernel(), which occurs when building with clang after commit 9ea7e6b62c2b ("init: Mark [arch_call_]rest_init() __noreturn"), modpost complains with: WARNING: modpost: vmlinux.o: section mismatch in reference: check_bugs (section: .text) -> check_bugs32 (section: .init.text) check_bugs() is only called from start_kernel(), which itself is marked __init, so there would not be any issues at run time. Make it obvious to modpost that this call chain is safe by marking check_bugs() as __init, which fixes the warning. Reported-by: Naresh Kamboju Link: https://lore.kernel.org/CA+G9fYt+4e57Gdy6cix=LeNK6XqWoui8du=mZWu=cf8vPYocKw@mail.gmail.com/ Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Bogendoerfer commit 267214a2319b5692bbc9b128a6514960291dcca8 Author: Dan Williams Date: Fri Apr 21 19:51:47 2023 -0700 cxl/port: Fix port to pci device assumptions in read_cdat_data() Not all endpoint CXL ports are associated with PCI devices. The cxl_test infrastructure models 'struct cxl_port' instances hosted by platform devices. Teach read_cdat_data() to be careful about non-pci hosted cxl_memdev instances. Otherwise, cxl_test crashes with this signature: RIP: 0010:xas_start+0x6d/0x290 [..] Call Trace: xas_load+0xa/0x50 xas_find+0x25b/0x2f0 xa_find+0x118/0x1d0 pci_find_doe_mailbox+0x51/0xc0 read_cdat_data+0x45/0x190 [cxl_core] cxl_port_probe+0x10a/0x1e0 [cxl_port] cxl_bus_probe+0x17/0x50 [cxl_core] Some other cleanups are included like removing the single-use @uport variable, and removing the indirection through 'struct cxl_dev_state' to lookup the device that registered the memdev and may be a pci device. Fixes: af0a6c3587dc ("cxl/pci: Use CDAT DOE mailbox created by PCI core") Reviewed-by: Lukas Wunner Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/168213190748.708404.16215095414060364800.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 6fb861bb3caf2ca8e440f7a3fdcca35fcac917b4 Author: Oswald Buddenhagen Date: Sat Apr 22 15:24:30 2023 +0200 ALSA: emu10k1: fix snd_emu1010_fpga_read() input masking for rev2 cards Unlike the Alice2 chips used on 1st generation E-MU cards, the Tina/Tina2 chips used on the 2nd gen cards have only six GPIN pins, which means that we need to use a smaller mask. Failure to do so would falsify the read data if the FPGA tried to raise an IRQ right at that moment. This wasn't a problem so far, as we didn't actually enable FPGA IRQs, but that's going to change soon. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422132430.1057490-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 8b2dd46d9a0370cf092fdd798dd66634abaf03e0 Author: Oswald Buddenhagen Date: Sat Apr 22 15:24:30 2023 +0200 ALSA: emu10k1: remove unused emu->pcm_playback_efx_substream field Amends historic commit 27ae958cf6 ("emu10k1 driver - add multichannel device hw:x,3 [2-8/8]"). Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422132430.1057468-2-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit be250b7c9b2d8b30d923d6ae947c9f8e5fc40948 Author: Oswald Buddenhagen Date: Sat Apr 22 15:24:29 2023 +0200 ALSA: emu10k1: remove unused `resume` parameter from snd_emu10k1_init() This was unnecessarily added in commit 09668b441da ("emu10k1 - Add PM support"). Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422132430.1057468-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit e922da40befdbaa89cd85d3154b4a9cea8880fa0 Author: Oswald Buddenhagen Date: Sat Apr 22 14:15:19 2023 +0200 ALSA: emu10k1: minor optimizations - In snd_emu10k1_look_for_ctl(), evaluate the cheap condition first - In _snd_emu10k1_{audigy_,}init_efx(), don't use expensive bit setting loops to fill arrays - In snd_emu_proc_ptr_reg_read(), remove useless condition - iobase can be only 0 or 0x20 Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230422121519.1052813-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 35150203e30b52d657165e325e3abc3b29c2086d Author: Eduard Zingerman Date: Fri Apr 21 23:45:14 2023 +0300 selftests/bpf: verifier/prevent_map_lookup converted to inline assembly Test verifier/prevent_map_lookup automatically converted to use inline assembly. This was a part of a series [1] but could not be applied becuase another patch from a series had to be witheld. [1] https://lore.kernel.org/bpf/20230421174234.2391278-1-eddyz87@gmail.com/ Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421204514.2450907-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 6d26d985eeda89faedabbcf6607c37454b9691b0 Author: Florian Westphal Date: Sat Apr 22 09:35:44 2023 +0200 bpf: fix link failure with NETFILTER=y INET=n Explicitly check if NETFILTER_BPF_LINK is enabled, else configs that have NETFILTER=y but CONFIG_INET=n fail to link: > kernel/bpf/syscall.o: undefined reference to `netfilter_prog_ops' > kernel/bpf/verifier.o: undefined reference to `netfilter_verifier_ops' Fixes: fd9c663b9ad6 ("bpf: minimal support for programs hooked into netfilter framework") Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304220903.fRZTJtxe-lkp@intel.com/ Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230422073544.17634-1-fw@strlen.de Signed-off-by: Alexei Starovoitov commit e0416e7d33361d2ad0bf9f007428346579ac854a Author: David Howells Date: Fri Apr 21 23:03:46 2023 +0100 rxrpc: Fix potential race in error handling in afs_make_call() If the rxrpc call set up by afs_make_call() receives an error whilst it is transmitting the request, there's the possibility that it may get to the point the rxrpc call is ended (after the error_kill_call label) just as the call is queued for async processing. This could manifest itself as call->rxcall being seen as NULL in afs_deliver_to_call() when it tries to lock the call. Fix this by splitting rxrpc_kernel_end_call() into a function to shut down an rxrpc call and a function to release the caller's reference and calling the latter only when we get to afs_put_call(). Reported-by: Jeffrey Altman Signed-off-by: David Howells Tested-by: kafs-testing+fedora36_64checkkafs-build-306@auristor.com cc: Marc Dionne cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Signed-off-by: David S. Miller commit 66efce1d099a67d9d0bf635a9815ec478bfbc8a2 Author: Srinivas Neeli Date: Thu Apr 20 16:12:28 2023 +0530 MAINTAINERS: Add fragment for Xilinx watchdog driver Added entry for Xilinx xps-timebase watchdog driver. Signed-off-by: Srinivas Neeli Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230420104231.2243079-2-srinivas.neeli@amd.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit bd858e494ceb3aac25bab9c6639f4cd764f534ba Author: Johannes Thumshirn Date: Tue Apr 18 19:25:31 2023 +0200 watchdog: menz069_wdt: fix timeout setting When setting the timeout for the menz069_wdt watchdog driver, we erroneously read from the 'watchdog value register' (WVR) instead of the 'watchdog timer register' (WTR) and then write the value back into WTR. This can potentially lead to wrong timeouts and wrong enable bit settings. Signed-off-by: Johannes Thumshirn Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230418172531.177349-3-jth@kernel.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 87b22656ca6a896d0378e9e60ffccb0c82f48b08 Author: Johannes Thumshirn Date: Tue Apr 18 19:25:30 2023 +0200 watchdog: menz069_wdt: fix watchdog initialisation Doing a 'cat /dev/watchdog0' with menz069_wdt as watchdog0 will result in a NULL pointer dereference. This happens because we're passing the wrong pointer to watchdog_register_device(). Fix this by getting rid of the static watchdog_device structure and use the one embedded into the driver's per-instance private data. Signed-off-by: Johannes Thumshirn Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230418172531.177349-2-jth@kernel.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a23c83a0ae0280632e734aff1dbf299f602a79c4 Author: Om Parikh Date: Tue Apr 18 05:16:10 2023 +0000 dt-bindings: watchdog: alphascale-asm9260: convert to DT schema Makes alphascale-asm9260 dt bindings adhere to the dt json-schema by replacing txt file with yaml file. Signed-off-by: Om Parikh Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230418051446.24288-1-hack3r-0m@proton.me Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2a31bf20808aa3642a942ab9ce421ebb7585eb3a Author: Keguang Zhang Date: Thu Mar 30 19:20:51 2023 +0800 watchdog: loongson1_wdt: Implement restart handler Implement restart handler for the Loongson-1 watchdog driver and define the watchdog registers instead of including the legacy header. Signed-off-by: Keguang Zhang Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230330112051.551648-3-keguang.zhang@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d0ee0e8aa97e6e1d443eaab8c94d580d0a6f5a89 Author: Bhupesh Sharma Date: Tue Mar 14 10:43:51 2023 +0530 dt-bindings: watchdog: Document Qualcomm SM6115 watchdog Add devicetree binding for watchdog present on Qualcomm SM6115 SoC. Acked-by: Krzysztof Kozlowski Signed-off-by: Bhupesh Sharma Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230314051351.1754321-1-bhupesh.sharma@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 495cbe36ee795dc06abccfb251e4384c6a26dc48 Author: Krzysztof Kozlowski Date: Sat Apr 15 11:51:12 2023 +0200 dt-bindings: watchdog: realtek,otto-wdt: simplify requiring interrupt-names Required properties should be listed in "required:" block. Since interrupts are already there, the dependency of interrupt-names on the interrupts can be simplified. Signed-off-by: Krzysztof Kozlowski Acked-by: Sander Vanheule Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230415095112.51257-6-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 20f43c943d06f628f832658238581fdeb29f7f92 Author: Krzysztof Kozlowski Date: Sat Apr 15 11:51:11 2023 +0200 dt-bindings: watchdog: toshiba,visconti-wdt: simplify with unevaluatedProperties Allow generic watchdog properties by using unevaluatedProperties: false. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Acked-by: Nobuhiro Iwamatsu Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230415095112.51257-5-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d5e8f87e365ff944631889ac978a7000a6181b3d Author: Krzysztof Kozlowski Date: Sat Apr 15 11:51:10 2023 +0200 dt-bindings: watchdog: fsl-imx7ulp-wdt: simplify with unevaluatedProperties Allow generic watchdog properties by using unevaluatedProperties: false. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230415095112.51257-4-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f0d6e92ebb06ca9a360683e69932d09bfc70f551 Author: Krzysztof Kozlowski Date: Sat Apr 15 11:51:09 2023 +0200 dt-bindings: watchdog: arm,sp805: drop unneeded minItems There is no need to specify minItems when they are equal to maxItems, because it is implied by maxItems. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230415095112.51257-3-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6c266971d5d700f283c73094caca9e1ebde2d67a Author: Krzysztof Kozlowski Date: Sat Apr 15 11:51:07 2023 +0200 dt-bindings: watchdog: drop duplicated GPIO watchdog bindings Two conversions to DT schema of GPIO watchdog binding happened and came through different trees. Merge them into one: 1. Combine maintainers, 2. Use more descriptive property descriptions and constraints from gpio-wdt.yaml, 3. Switch to unevaluatedProperties:false, to allow generic watchdog properties. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Reviewed-by: Rob Herring Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20230415095112.51257-1-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit edb10ace4dcd05f804d59dfdf2fee9121c92faee Author: Yassine Oudjana Date: Thu Mar 2 15:40:14 2023 +0300 dt-bindings: reset: Add binding for MediaTek MT6735 TOPRGU/WDT Add a DT binding for the MT6735 top reset generation unit/watchdog timer. Signed-off-by: Yassine Oudjana Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230302124015.75546-2-y.oudjana@protonmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit db728ea9c7be137b4f4361295f11e0b56b6286ac Author: Xingyu Wu Date: Tue Mar 14 21:24:36 2023 +0800 drivers: watchdog: Add StarFive Watchdog driver Add watchdog driver for the StarFive JH7100 and JH7110 SoC. Signed-off-by: Xingyu Wu Reviewed-by: Emil Renner Berthing Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230314132437.121534-3-xingyu.wu@starfivetech.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b24e265d6f0a0965ae0d0a19848544300c397a2e Author: Xingyu Wu Date: Tue Mar 14 21:24:35 2023 +0800 dt-bindings: watchdog: Add watchdog for StarFive JH7100 and JH7110 Add bindings to describe the watchdog for the StarFive JH7100/JH7110 SoC. And Use JH7100 as first StarFive SoC with watchdog. Signed-off-by: Xingyu Wu Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230314132437.121534-2-xingyu.wu@starfivetech.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 819d14135da5f8cd0e2104a6def805707e46d99b Author: Krzysztof Kozlowski Date: Sat Apr 15 11:51:08 2023 +0200 dt-bindings: watchdog: indentation, quotes and white-space cleanup Minor cleanup without functional impact: 1. Indent DTS examples to preferred four-spaces (more readable for DTS), 2. Drop unneeded quotes, 3. Add/drop blank lines to make the code readable. Signed-off-by: Krzysztof Kozlowski Acked-by: Sergio Paracuellos Acked-by: Justin Chen Acked-by: Neil Armstrong Acked-by: Nicolas Ferre Reviewed-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230415095112.51257-2-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ab8da07609fc982196df9df8f9b4f9ba4bea4731 Author: William Breathitt Gray Date: Mon Apr 10 11:09:26 2023 -0400 watchdog: ebc-c384_wdt: Mark status as orphaned The current maintainer no longer has access to the device for testing, the original user of this driver indicates that they have moved on to another device, and the manufacturer WINSYSTEMS does not appear interested in taking over support for this code. Signed-off-by: William Breathitt Gray Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230410150926.3354-1-william.gray@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 64543b0d637bd28abed1a3311aa8c9b007ee52d7 Author: Alexandre Mergnat Date: Fri Apr 7 14:59:22 2023 +0200 dt-bindings: watchdog: mediatek,mtk-wdt: add mt8365 Add binding description for mediatek,mt8365-wdt Acked-by: Krzysztof Kozlowski Reviewed-by: Matthias Brugger Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Alexandre Mergnat Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230203-evk-board-support-v5-3-1883c1b405ad@baylibre.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ee0da40588e1eda1323e7abd8e91a2dfe359b87c Author: Konrad Dybcio Date: Tue Mar 14 13:52:56 2023 +0100 dt-bindings: watchdog: qcom-wdt: add QCM2290 Document the QCM2290 KPSS watchdog. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230314-topic-2290_compats-v1-1-47e26c3c0365@linaro.org [groeck: Fixed context conflicts] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2cd55934d9774d23a7c683e415935cb9cd7dedff Author: Kathiravan T Date: Mon Mar 20 16:15:29 2023 +0530 dt-bindings: watchdog: qcom-wdt: add qcom,apss-wdt-ipq5332 compatible Add a compatible for the IPQ5332 platform's APSS watchdog. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kathiravan T Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230320104530.30411-2-quic_kathirav@quicinc.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 92ce288ccb0d472977b24bd0b7240fc2490a6145 Merge: 99e5acae193e3 86ce0d09e4246 Author: David S. Miller Date: Sat Apr 22 14:13:25 2023 +0100 Merge branch 'mtk_eth_soc-firmware' Daniel Golle says: ==================== net: ethernet: mtk_eth_soc: use WO firmware for MT7981 In order to support wireless offloading on MT7981 we need to load the appropriate firmware. Recognize MT7981 by introducing a new DT compatible and load mt7981_wo.bin if it is set. Changes since v1: * retain alphabetic order in dt-bindings ==================== Signed-off-by: David S. Miller commit 86ce0d09e42463816f13766ac286012ec7b71fdc Author: Daniel Golle Date: Thu Apr 20 17:05:05 2023 +0100 net: ethernet: mtk_eth_soc: use WO firmware for MT7981 In order to support wireless offloading on MT7981 we need to load the appropriate firmware. Recognize MT7981 and load mt7981_wo.bin. Signed-off-by: Daniel Golle Signed-off-by: David S. Miller commit cf88231d973909dc8d578138509973e062aba3d7 Author: Daniel Golle Date: Thu Apr 20 17:04:23 2023 +0100 dt-bindings: net: mediatek: add WED RX binding for MT7981 eth driver Add compatible string for mediatek,mt7981-wed as MT7981 also supports RX WED just like MT7986, but needs a different firmware file. Signed-off-by: Daniel Golle Acked-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 99e5acae193e369b71217efe6f1dad42f3f18815 Author: Ziyang Xuan Date: Thu Apr 20 20:40:35 2023 +0800 ipv4: Fix potential uninit variable access bug in __ip_make_skb() Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()"). icmphdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will trigger the uninit variable access bug. Use a local variable icmp_type to carry the correct value in different scenarios. Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)") Reviewed-by: Willem de Bruijn Signed-off-by: Ziyang Xuan Signed-off-by: David S. Miller commit dcd615ee6fd3651ab0357364c4cf65b1148a40be Author: Shreeya Patel Date: Wed Mar 29 02:30:48 2023 +0530 dt-bindings: watchdog: rockchip: Add rockchip,rk3588-wdt string Add rockchip,rk3588-wdt compatible string. Signed-off-by: Shreeya Patel Reviewed-by: Heiko Stuebner Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20230328210048.195124-3-shreeya.patel@collabora.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 33e4945352a2484c92fc1d5a16471b1939d67abb Author: Jakob Koschel Date: Mon Mar 13 14:59:19 2023 +0100 watchdog: avoid usage of iterator after loop If potentially no valid element is found, 'p' would contain an invalid pointer past the iterator loop. To ensure 'p' is valid under any circumstances, the kfree() should be within the loop body. Additionally, Linus proposed to avoid any use of the list iterator variable after the loop, in the attempt to move the list iterator variable declaration into the macro to avoid any potential misuse after the loop [1]. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Signed-off-by: Jakob Koschel Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230301-watchdog-avoid-iter-after-loop-v2-1-8411e3bbe0de@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit fc0c5db58f4c78b948acfbf9558eeaf6b343bf9a Author: Tom Rix Date: Tue Mar 21 14:34:39 2023 -0400 watchdog: s3c2410: remove unused freq_to_wdt and s3c2410wdt_is_running functions clang with W=1 reports drivers/watchdog/s3c2410_wdt.c:311:35: error: unused function 'freq_to_wdt' [-Werror,-Wunused-function] static inline struct s3c2410_wdt *freq_to_wdt(struct notifier_block *nb) ^ drivers/watchdog/s3c2410_wdt.c:446:19: error: unused function 's3c2410wdt_is_running' [-Werror,-Wunused-function] static inline int s3c2410wdt_is_running(struct s3c2410_wdt *wdt) ^ These functions are not used, so remove them. Signed-off-by: Tom Rix Reviewed-by: Andi Shyti Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230321183439.1826823-1-trix@redhat.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit bfeaadbc0b8231e81dacd0616b476520759641ae Author: Krzysztof Kozlowski Date: Fri Mar 10 23:30:12 2023 +0100 watchdog: aspeed: Drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it is not relevant here). drivers/watchdog/aspeed_wdt.c:56:34: error: ‘aspeed_wdt_of_table’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230310223012.315897-1-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 4eda19cc8a29cde3580ed73bf11dc73b4e757697 Author: Gregory Oakes Date: Thu Mar 16 15:13:12 2023 -0500 watchdog: sp5100_tco: Immediately trigger upon starting. The watchdog countdown is supposed to begin when the device file is opened. Instead, it would begin countdown upon the first write to or close of the device file. Now, the ping operation is called within the start operation which ensures the countdown begins. From experimenation, it does not appear possible to do this with a single write including both the start bit and the trigger bit. So, it is done as two distinct writes. Signed-off-by: Gregory Oakes Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230316201312.17538-1-gregory.oakes@amd.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit fe5631bb3a4bf62208ed52600c21dd3d1787f412 Author: Sergio Paracuellos Date: Thu Mar 2 09:59:14 2023 +0100 dt-bindings: watchdog: migrate rt2880 text bindings to YAML Ralink RT2880 Watchdog bindings used text format, so migrate them to YAML. There are some additions to the binding that were not in the original txt file. This binding is used in RT2880, RT3050, RT3352, RT3883, RT5350, and MT7620 SoCs. To properly align binding with driver code we need to add to the schema 'clocks' and 'resets' properties. Signed-off-by: Sergio Paracuellos Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230302085914.2858645-1-sergio.paracuellos@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit af3ac8e41786440a5ca0fa37628685f8f514f0a6 Author: Sergio Paracuellos Date: Wed Mar 1 07:55:10 2023 +0100 watchdog: rt2880-wdt: prefer unsigned int over unsigned Instead of declare 'reg' variable in read and write operations as a bare 'unsigned' type prefer to declate it as 'unsigned int'. Signed-off-by: Sergio Paracuellos Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230301065510.2818425-2-sergio.paracuellos@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 76ad36bf0ea620b14d32a332108a248412886d54 Author: Sergio Paracuellos Date: Wed Mar 1 07:55:09 2023 +0100 watchdog: rt2880-wdt: avoid static global declarations Instead of using static global definitions in driver code, refactor code introducing a new watchdog driver data structure and use it along the code. Signed-off-by: Sergio Paracuellos Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230301065510.2818425-1-sergio.paracuellos@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 07d41160b3b65c621f9352196c3791fdc7d2380d Author: Christophe JAILLET Date: Sat Dec 31 12:14:30 2022 +0100 watchdog: loongson1: Use devm_clk_get_enabled() helper The devm_clk_get_enabled() helper: - calls devm_clk_get() - calls clk_prepare_enable() and registers what is needed in order to call clk_disable_unprepare() when needed, as a managed resource. This simplifies the code and avoids the need of a dedicated function used with devm_add_action_or_reset(). Signed-off-by: Christophe JAILLET Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/624106aa86ef7e49f16b11b229528eabd63de8f7.1672485257.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8fd15ace76a4aeb3648cf078541b5e6cfc91d5a2 Author: Christophe JAILLET Date: Sat Dec 31 12:07:27 2022 +0100 watchdog: ixp4xx: Use devm_clk_get_enabled() helper The devm_clk_get_enabled() helper: - calls devm_clk_get() - calls clk_prepare_enable() and registers what is needed in order to call clk_disable_unprepare() when needed, as a managed resource. This simplifies the code and avoids the need of a dedicated function used with devm_add_action_or_reset(). Signed-off-by: Christophe JAILLET Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/5d04e453a4da5cfafb56695a17157fa3ea296511.1672484831.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e0e0ee02e616269451dd00ff56be0328d5625a92 Author: Uwe Kleine-König Date: Tue Mar 7 07:56:03 2023 +0100 watchdog: s3c2410_wdt: Simplify using dev_err_probe() Make use of dev_err_probe() also for error paths that don't have to handle -EPROBE_DEFER. While the code handing -EPROBE_DEFER isn't used for these error paths, it still simpler as it cares for pretty printing the error code and usually needs one code line less as it combines message emitting and error returning. This also unifies the format of the error messages. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230307065603.2253054-3-u.kleine-koenig@pengutronix.de [groeck: Split long line to avoid checkpatch warning] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 16d477a1dba9f214d1229d0a122d6d3a9636aa79 Author: Uwe Kleine-König Date: Tue Mar 7 07:56:02 2023 +0100 watchdog: s3c2410: Make s3c2410_get_wdt_drv_data() return an int This is a preparation for making more use of dev_err_probe(). The idea is that s3c2410_get_wdt_drv_data() (as it's called only by .probe()) can make effective use of dev_err_probe() only if it returns an int. For that the assignment to wdt->drv_data has to happen in the function. The caller can then just pass on the return value in the error case. This seems to be nicer for the compiler: bloatometer reports for an ARCH=arm s3c6400_defconfig build: add/remove: 1/1 grow/shrink: 0/1 up/down: 4/-64 (-60) Function old new delta __initcall__kmod_s3c2410_wdt__209_821_s3c2410wdt_driver_init6 - 4 +4 __initcall__kmod_s3c2410_wdt__209_819_s3c2410wdt_driver_init6 4 - -4 s3c2410wdt_probe 1332 1272 -60 There is no semantical change. (Just one minor difference: Before this patch wdt->drv_data was always assigned, now that only happens in the non-error case. That doesn't matter however as *wdt is freed in the error case.) Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230307065603.2253054-2-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0e89b2c9a2a6984af43d09de9d1bb44da9822ba2 Author: Uwe Kleine-König Date: Tue Mar 7 08:04:04 2023 +0100 watchdog: wm8350: Simplify using devm_watchdog_register_device() This allows to drop the .remove() function as it only exists to unregister the watchdog device which is now done in a callback registered by devm_watchdog_register_device(). Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20230307070404.2256308-4-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 4095b94d3af8b05805b0fde192475b5578c73a48 Author: Uwe Kleine-König Date: Tue Mar 7 08:04:03 2023 +0100 watchdog: rn5t618: Simplify using devm_watchdog_register_device() This allows to drop the .remove() function as it only exists to unregister the watchdog device which is now done in a callback registered by devm_watchdog_register_device(). Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230307070404.2256308-3-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 16da6fbb55532c375cee0a7f33817225ae27a49f Author: Uwe Kleine-König Date: Tue Mar 7 08:04:02 2023 +0100 watchdog: bcm47xx: Simplify using devm_watchdog_register_device() This allows to drop the .remove() function as it only exists to unregister the watchdog device which is now done in a callback registered by devm_watchdog_register_device(). Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230307070404.2256308-2-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 74d6c68c74fac3e6bdc28fba69889ed7ef05a7f8 Author: Wang Wensheng Date: Wed Mar 1 11:37:02 2023 +0000 watchdog: sbsa: Test WDOG_HW_RUNNING bit in suspend and resume If the sbsa_gwdt is enabled by BIOS, the kernel set WDOG_HW_RUNNING bit and keep it alive before anyone else would open it. When system suspend, the sbsa_gwdt would not be disabled because WDOG_ACTIVE is not set. Then the sbsa_gwdt would reach timeout since no one touch it during system suspend. To solve this, just test WDOG_HW_RUNNING bit in suspend and disable the sbsa_gwdt if the bit is set, then reopen it accordingly in resume process. Signed-off-by: Wang Wensheng Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230301113702.76437-1-wangwensheng4@huawei.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 96c6e56d3ed46840d575102b7b76a760b28de55b Author: Uwe Kleine-König Date: Fri Mar 3 22:37:15 2023 +0100 watchdog: stmp3xxx_rtc: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-34-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e7a84d457d13775e864864703e88ae3ff4b5d36b Author: Uwe Kleine-König Date: Fri Mar 3 22:37:14 2023 +0100 watchdog: st_lpc: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-33-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 70b5b2b2feb00be6ed479557269438d505f86642 Author: Uwe Kleine-König Date: Fri Mar 3 22:37:13 2023 +0100 watchdog: shwdt: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-32-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f80e31b3abdbbdb82ee85d7d206229d20001f2d6 Author: Uwe Kleine-König Date: Fri Mar 3 22:37:12 2023 +0100 watchdog: sch311x: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-31-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 4dca58a8cb7c65a5ab7385837acf60ff09c67e46 Author: Uwe Kleine-König Date: Fri Mar 3 22:37:11 2023 +0100 watchdog: sa1100: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-30-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 4ead88bf860a6fb13056e964985ab0a2e78f3a9c Author: Uwe Kleine-König Date: Fri Mar 3 22:37:09 2023 +0100 watchdog: rti: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-28-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 3628149f6eef811e1422ff407e28fd74e6bfdf83 Author: Uwe Kleine-König Date: Fri Mar 3 22:37:07 2023 +0100 watchdog: riowd: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-26-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b481d57bb1a29b50086130e46e83b0a8ad61604e Author: Uwe Kleine-König Date: Fri Mar 3 22:37:06 2023 +0100 watchdog: renesas: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-25-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6645579b7081753e4f94946a2c98f5d4aeed9c9c Author: Uwe Kleine-König Date: Fri Mar 3 22:37:05 2023 +0100 watchdog: rdc321x: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-24-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c550440918fff34f5098f8165ffb227afde6bf33 Author: Uwe Kleine-König Date: Fri Mar 3 22:37:04 2023 +0100 watchdog: rc32434: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-23-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e47f2a3b58e5dba92df861f905895b420a7db9ce Author: Uwe Kleine-König Date: Fri Mar 3 22:37:03 2023 +0100 watchdog: orion: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-22-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 412cec3b5e4cd2652ff6dbf0ce69d7f75e49673d Author: Uwe Kleine-König Date: Fri Mar 3 22:37:02 2023 +0100 watchdog: omap: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-21-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 3a9731099f7141265471ba1e4ed4ee97dc32f200 Author: Uwe Kleine-König Date: Fri Mar 3 22:37:01 2023 +0100 watchdog: nv_tco: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-20-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 55b0fb45375eddf89d8e9f06f22de5bac0285efa Author: Uwe Kleine-König Date: Fri Mar 3 22:37:00 2023 +0100 watchdog: nic7018: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-19-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 62b6a8507c1cdcb375549481f02177e80d51c7f1 Author: Uwe Kleine-König Date: Fri Mar 3 22:36:59 2023 +0100 watchdog: mtx-1: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-18-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit fb22b9e95af8d2f668c95f8b51bed11646720948 Author: Uwe Kleine-König Date: Fri Mar 3 22:36:58 2023 +0100 watchdog: lpc18xx: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-17-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e395a471591392820ccfc7cec1b1581042c461ae Author: Uwe Kleine-König Date: Fri Mar 3 22:36:57 2023 +0100 watchdog: ie6xx: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-16-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 40529e7ed5c98b4bfbaec62b8e13e1e647d46df8 Author: Uwe Kleine-König Date: Fri Mar 3 22:36:56 2023 +0100 watchdog: ib700wdt: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-15-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 5216a0a95d4fa65e26a67c00b739fdbd2c3a1b1f Author: Uwe Kleine-König Date: Fri Mar 3 22:36:55 2023 +0100 watchdog: geodewdt: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-14-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b5f2e366b148f84d98da2cabd1bbd863fc2d6487 Author: Uwe Kleine-König Date: Fri Mar 3 22:36:54 2023 +0100 watchdog: gef: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-13-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 3a063f9bc4a1490ba913427a8b53ea973c55b043 Author: Uwe Kleine-König Date: Fri Mar 3 22:36:53 2023 +0100 watchdog: dw: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-12-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 5caafac4bb5873fea2b237d32dfcffda24dacd94 Author: Uwe Kleine-König Date: Fri Mar 3 22:36:52 2023 +0100 watchdog: cpwd: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-11-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0eddace4629996b24e4f028286802c33c8ea0621 Author: Uwe Kleine-König Date: Fri Mar 3 22:36:51 2023 +0100 watchdog: bcm_kona: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Florian Fainelli Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-10-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7ca823d5fa4574bef4636d2ae7946078dec6328b Author: Uwe Kleine-König Date: Fri Mar 3 22:36:49 2023 +0100 watchdog: bcm2835: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Florian Fainelli Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-8-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ec6de663274d886a32b4e22a6fb3cf4b2e99cfab Author: Uwe Kleine-König Date: Fri Mar 3 22:36:48 2023 +0100 watchdog: ath79: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-7-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c1e335c8d1b3ff8f818efcec0f250d91cd75af0b Author: Uwe Kleine-König Date: Fri Mar 3 22:36:47 2023 +0100 watchdog: at91rm9200: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230303213716.2123717-6-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e676c92e9a3a987a496733df1be50b8cea872822 Author: Uwe Kleine-König Date: Fri Mar 3 22:36:46 2023 +0100 watchdog: ar7: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-5-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8960d8ada73518ed9ea4d695347bbe0b3142142e Author: Uwe Kleine-König Date: Fri Mar 3 22:36:45 2023 +0100 watchdog: advantechwdt: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-4-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 88d2c181ee9f87b53e1a49cdeb1413e6e45a340e Author: Uwe Kleine-König Date: Fri Mar 3 22:36:44 2023 +0100 watchdog: acquirewdt: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230303213716.2123717-3-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 89baf2522ba3a82b7aa61dba023a8092b8ff1d5b Author: Guenter Roeck Date: Sat Mar 4 08:56:53 2023 -0800 watchdog: s3c2410_wdt: Use devm_add_action_or_reset() to disable watchdog Use devm_add_action_or_reset() to disable the watchdog when the driver is removed to simplify the code. With this in place, we can use devm_watchdog_register_device() to register the watchdog, and the removal function is no longer necessary. Cc: Uwe Kleine-König Signed-off-by: Guenter Roeck Acked-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230304165653.2179835-2-linux@roeck-us.net Signed-off-by: Wim Van Sebroeck commit 9b31b1ea125ca2e734ae89badc0c3073b4445842 Author: Guenter Roeck Date: Sat Mar 4 08:56:52 2023 -0800 watchdog: s3c2410_wdt: Use devm_clk_get[_optional]_enabled() helpers The devm_clk_get[_optional]_enabled() helpers: - call devm_clk_get[_optional]() - call clk_prepare_enable() and register what is needed in order to call clk_disable_unprepare() when needed, as a managed resource. This simplifies the code and avoids the calls to clk_disable_unprepare(). While at it, use dev_err_probe consistently, and use its return value to return the error code. Cc: Uwe Kleine-König Signed-off-by: Guenter Roeck Reviewed-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230304165653.2179835-1-linux@roeck-us.net Signed-off-by: Wim Van Sebroeck commit 12cee6efb7b94918747d09ba7488dd5cb1bbe2be Author: Guenter Roeck Date: Sat Mar 4 08:16:07 2023 -0800 watchdog: core: Always set WDOG_HW_RUNNING when starting watchdog The use of WDOG_HW_RUNNING is currently inconsistent: If set by the driver, it will remain set until the watchdog device is opened and then closed. If set by the watchdog core, it is only set if the watchdog can not be stopped when closed. Subsequenty it is always only set while the watchdog is closed and the hardware watchdog is running. This is both misleading and inconsistent: The API states that watchdog_hw_running() indicates that the hardware watchdog is running. This is currently not always the case. Set WDOG_HW_RUNNING whenever a watchdog is successfully started for consistent behavior and to accurately report its status. This means that we no longer have to check for both watchdog_active() and watchdog_hw_running() to check if the watchdog is running because watchdog_hw_running() now implies watchdog_active(). Simplify the code accordingly where warranted. Cc: Wang Wensheng Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20230304161607.1418952-1-linux@roeck-us.net Signed-off-by: Wim Van Sebroeck commit 0ea0a825192efdd44af4c016faaab1a3d2073c78 Author: Guenter Roeck Date: Tue Feb 28 07:16:48 2023 -0800 watchdog: imx2_wdg: Declare local symbols static 0-day complains: drivers/watchdog/imx2_wdt.c:442:22: sparse: symbol 'imx_wdt' was not declared. Should it be static? drivers/watchdog/imx2_wdt.c:446:22: sparse: symbol 'imx_wdt_legacy' was not declared. Should it be static? Declare as static variables. Fixes: e42c73f1ef0d ("watchdog: imx2_wdg: suspend watchdog in WAIT mode") Cc: Andrej Picej Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20230228151648.4087637-1-linux@roeck-us.net Signed-off-by: Wim Van Sebroeck commit 335927b125af7937c0dd566ecd62a80f9f55c923 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:06 2023 +0200 ALSA: emu10k1: remove remaining cruft from snd_emu10k1_emu1010_init() Various redundant FPGA writes which were presumably also cargo-culted from the Windows driver. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005539-7-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 1cbad9a50a28da5ecacb1789f4ed7fe612ba4ac8 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:05 2023 +0200 ALSA: emu10k1: remove apparently pointless EMU_HANA_OPTION_CARDS reads These seem to be another instance of cargo-culting from the Windows driver. It presumably queries the register to decide about the followup actions, but we don't do that. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005539-6-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 462d972d47a8a367c4c8ee28115778fae45d1992 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:04 2023 +0200 ALSA: emu10k1: remove apparently pointless FPGA reads These seem to be simply cargo-culted from the Windows driver's behavior. However, the original reason were presumably read-modify-write cycles, which we don't do. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005539-5-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 384e396f15be33ddd5c4eb9017ffc0d6016e27a9 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:03 2023 +0200 ALSA: emu10k1: stop doing weird things with HCFG in snd_emu10k1_emu1010_init() This doesn't do anything snd_emu10k1_init() wouldn't do later, and none of the things it does seem relevant for the function itself (which is pretty much about setting up the FPGA). It was probably a Windows driver behavior cargo-culting artifact. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005539-4-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit a1c87c0b27059b4155c7aba6b34810c889e8b6a9 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:01 2023 +0200 ALSA: emu10k1: fix access to Audigy GPIO port As the register definition clearly states, this is a 16-bit register, yet we did all accesses as 32-bit. The writes in particular would have the potential to clear the TIMER register (depending on how the bus/card actually handles the too long writes). This commit also introduces a separate define A_GPIO which aliases A_IOCFG, which better reflects the distinct usage on E-MU cards. This is done in the same commit to keep the churn down, as we're touching all involved lines anyway. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005539-2-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 10f212bd7a693e379154891cc16959bc4884668a Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:00 2023 +0200 ALSA: emu10k1: properly assert E-MU FPGA access constaints Assert the validity of the registers and values, as them being out of range would indicate an error in the driver. Consequently, don't bother returning error codes; they were ignored everywhere anyway. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005539-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 02a0d9c281401d4e1eb0f83ed337c8c6a70194d2 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:06 2023 +0200 ALSA: emu10k1: clean up P16V part somewhat Detach it better from the main PCM driver, which it really doesn't have much in common with. In particular, this moves the interrupt handler implementation into p16v.c, and makes it access the substream runtime status more directly, so it doesn't need to abuse structs snd_emu10k1_pcm and snd_emu10k1_voice any more. We don't need private pcm runtime data at all, as the only thing it was used for (except the back-link to the substream) was the `running` flag. So store that directly in runtime->private_data. This somewhat radical strip-down shows that this driver contains some complexity that was never actually utilized. I suppose the right way to fully utilize the hardware in a simple way would be introducing more substreams. This wouldn't require any of the removed code. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005452-7-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 14a5c5a44b61953b3f84a01152fe1d40838f5d91 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:04 2023 +0200 ALSA: emu10k1: remove unused snd_emu10k1_voice.emu field It was written, but never read from. Its value is available via the epcm field. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005452-5-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit d4af7ca20173e61b77584e4f2025387b7b76ef75 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:02 2023 +0200 ALSA: emu10k1: remove obsolete card type variable and defines The use of the variable was removed in commit 2b637da5a1b ("clean up card features"). That commit also broke user space (the ioctl structure), at which point the defines became meaningless, so I don't think purging them is a problem. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005452-3-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit b9468c4106d49f6ec84c409470d7aaaefdfff2ba Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:01 2023 +0200 ALSA: emu10k1: drop redundant snd_emu10k1_efx_playback_pointer() It's just an (outdated) copy of snd_emu10k1_playback_pointer(). Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005452-2-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 798524389a7822a487ac0245d177f9d3bf33a22d Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:00 2023 +0200 ALSA: emu10k1: drop redundant snd_emu10k1_efx_playback_hw_free() Or actually, replace snd_emu10k1_playback_hw_free() with it, as that is a subset. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005452-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit fbc1449d385d65be49a8d164dfd3772f2cb049ae Merge: 9a82cdc28f47f f9c895a72a390 Author: Jakub Kicinski Date: Fri Apr 21 20:47:04 2023 -0700 Merge tag 'mlx5-updates-2023-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2023-04-20 1) Dragos Improves RX page pool, and provides some fixes to his previous series: 1.1) Fix releasing page_pool for striding RQ and legacy RQ nonlinear case 1.2) Hook NAPIs to page pools to gain more performance. 2) From Roi, Some cleanups to TC and eswitch modules. 3) Maher migrates vnic diagnostic counters reporting from debugfs to a dedicated devlink health reporter Maher Says: =========== net/mlx5: Expose vnic diagnostic counters using devlink Currently, vnic diagnostic counters are exposed through the following debugfs: $ ls /sys/kernel/debug/mlx5/0000:08:00.0/esw/vf_0/vnic_diag/ cq_overrun quota_exceeded_command total_q_under_processor_handle invalid_command send_queue_priority_update_flow nic_receive_steering_discard The current design does not allow the hypervisor to view the diagnostic counters of its VFs, in case the VFs get bound to a VM. In other words, the counters are not exposed for representor interfaces. Furthermore, the debugfs design is inconvenient future-wise, in case more counters need to be reported by the driver in the future. As these counters pertain to vNIC health, it is more appropriate to utilize the devlink health reporter to expose them. Thus, this patchest includes the following changes: * Drop the current vnic diagnostic counters debugfs interface. * Add a vnic devlink health reporter for PFs/VFs core devices, which when diagnosed will dump vnic diagnostic counter values that are queried from FW. * Add a vnic devlink health reporter for the representor interface, which serves the same purpose listed in the previous point, in addition to allowing the hypervisor to view its VFs diagnostic counters, even when the VFs are bounded to external VMs. Example of devlink health reporter usage is: $devlink health diagnose pci/0000:08:00.0 reporter vnic vNIC env counters: total_error_queues: 0 send_queue_priority_update_flow: 0 comp_eq_overrun: 0 async_eq_overrun: 0 cq_overrun: 0 invalid_command: 0 quota_exceeded_command: 0 nic_receive_steering_discard: 0 =========== 4) SW steering fixes and improvements Yevgeny Kliteynik Says: ======================= These short patch series are just small fixes / improvements for SW steering: - Patch 1: Fix dumping of legacy modify_hdr in debug dump to align to what is expected by parser - Patch 2: Have separate threshold for ICM sync per ICM type - Patch 3: Add more info to the steering debug dump - Linux version and device name - Patch 4: Keep track of number of buddies that are currently in use per domain per buddy type ======================= * tag 'mlx5-updates-2023-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Update op_mode to op_mod for port selection net/mlx5: E-Switch, Remove unused mlx5_esw_offloads_vport_metadata_set() net/mlx5: E-Switch, Remove redundant dev arg from mlx5_esw_vport_alloc() net/mlx5: Include linux/pci.h for pci_msix_can_alloc_dyn() net/mlx5e: RX, Hook NAPIs to page pools net/mlx5e: RX, Fix XDP_TX page release for legacy rq nonlinear case net/mlx5e: RX, Fix releasing page_pool pages twice for striding RQ net/mlx5e: Add vnic devlink health reporter to representors net/mlx5: Add vnic devlink health reporter to PFs/VFs Revert "net/mlx5: Expose vnic diagnostic counters for eswitch managed vports" Revert "net/mlx5: Expose steering dropped packets counter" net/mlx5: DR, Add memory statistics for domain object net/mlx5: DR, Add more info in domain dbg dump net/mlx5: DR, Calculate sync threshold of each pool according to its type net/mlx5: DR, Fix dumping of legacy modify_hdr in debug dump ==================== Link: https://lore.kernel.org/r/20230421013850.349646-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 6e79bd28ab0abd7e82d020d6d1728c3ca543450f Merge: 7ecebee211c62 081abcacaf0a9 Author: Jakub Kicinski Date: Fri Apr 21 20:40:57 2023 -0700 Merge tag 'mlx5-fixes-2023-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-04-19 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: Revert "net/mlx5e: Don't use termination table when redundant" net/mlx5e: Nullify table pointer when failing to create net/mlx5: Use recovery timeout on sync reset flow Revert "net/mlx5: Remove "recovery" arg from mlx5_load_one() function" net/mlx5e: Fix error flow in representor failing to add vport rx rule net/mlx5: Release tunnel device after tc update skb net/mlx5: E-switch, Don't destroy indirect table in split rule net/mlx5: E-switch, Create per vport table based on devlink encap mode net/mlx5e: Release the label when replacing existing ct entry net/mlx5e: Don't clone flow post action attributes second time ==================== Link: https://lore.kernel.org/r/20230421015057.355468-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 9a82cdc28f47f5e70f657a25c6e5bf16cf306848 Merge: 418a73074da91 4db10a8243df6 Author: Jakub Kicinski Date: Fri Apr 21 20:32:36 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2023-04-21 We've added 71 non-merge commits during the last 8 day(s) which contain a total of 116 files changed, 13397 insertions(+), 8896 deletions(-). The main changes are: 1) Add a new BPF netfilter program type and minimal support to hook BPF programs to netfilter hooks such as prerouting or forward, from Florian Westphal. 2) Fix race between btf_put and btf_idr walk which caused a deadlock, from Alexei Starovoitov. 3) Second big batch to migrate test_verifier unit tests into test_progs for ease of readability and debugging, from Eduard Zingerman. 4) Add support for refcounted local kptrs to the verifier for allowing shared ownership, useful for adding a node to both the BPF list and rbtree, from Dave Marchevsky. 5) Migrate bpf_for(), bpf_for_each() and bpf_repeat() macros from BPF selftests into libbpf-provided bpf_helpers.h header and improve kfunc handling, from Andrii Nakryiko. 6) Support 64-bit pointers to kfuncs needed for archs like s390x, from Ilya Leoshkevich. 7) Support BPF progs under getsockopt with a NULL optval, from Stanislav Fomichev. 8) Improve verifier u32 scalar equality checking in order to enable LLVM transformations which earlier had to be disabled specifically for BPF backend, from Yonghong Song. 9) Extend bpftool's struct_ops object loading to support links, from Kui-Feng Lee. 10) Add xsk selftest follow-up fixes for hugepage allocated umem, from Magnus Karlsson. 11) Support BPF redirects from tc BPF to ifb devices, from Daniel Borkmann. 12) Add BPF support for integer type when accessing variable length arrays, from Feng Zhou. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (71 commits) selftests/bpf: verifier/value_ptr_arith converted to inline assembly selftests/bpf: verifier/value_illegal_alu converted to inline assembly selftests/bpf: verifier/unpriv converted to inline assembly selftests/bpf: verifier/subreg converted to inline assembly selftests/bpf: verifier/spin_lock converted to inline assembly selftests/bpf: verifier/sock converted to inline assembly selftests/bpf: verifier/search_pruning converted to inline assembly selftests/bpf: verifier/runtime_jit converted to inline assembly selftests/bpf: verifier/regalloc converted to inline assembly selftests/bpf: verifier/ref_tracking converted to inline assembly selftests/bpf: verifier/map_ptr_mixing converted to inline assembly selftests/bpf: verifier/map_in_map converted to inline assembly selftests/bpf: verifier/lwt converted to inline assembly selftests/bpf: verifier/loops1 converted to inline assembly selftests/bpf: verifier/jeq_infer_not_null converted to inline assembly selftests/bpf: verifier/direct_packet_access converted to inline assembly selftests/bpf: verifier/d_path converted to inline assembly selftests/bpf: verifier/ctx converted to inline assembly selftests/bpf: verifier/btf_ctx_access converted to inline assembly selftests/bpf: verifier/bpf_get_stack converted to inline assembly ... ==================== Link: https://lore.kernel.org/r/20230421211035.9111-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 7ecebee211c624bb61a7efe0420e759697e4a594 Merge: 2cc8a008d62f3 e85d3d55875f7 Author: Jakub Kicinski Date: Fri Apr 21 20:30:32 2023 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== ixgbe: Multiple RSS bugfixes Joe Damato says: This series fixes two bugs I stumbled on with ixgbe: 1. The flow hash cannot be set manually with ethool at all. Patch 1/2 addresses this by fixing what appears to be a small bug in set_rxfh in ixgbe. See the commit message for more details. 2. Once the above patch is applied and the flow hash can be set, resetting the flow hash to default fails if the number of queues is greater than the number of queues supported by RSS. Other drivers (like i40e) will reset the flowhash to use the maximum number of queues supported by RSS even if the queue count configured is larger. In other words: some queues will not have packets distributed to them by the RSS hash if the queue count is too large. Patch 2/2 allows the user to reset ixgbe to default and the flowhash is set correctly to either the maximum number of queues supported by RSS or the configured queue count, whichever is smaller. I believe this is correct and it mimics the behavior of i40e; `ethtool -X $iface default` should probably always succeed even if all the queues cannot be utilized. See the commit message for more details and examples. I tested these on an ixgbe system I have access to and they appear to work as intended, but I would appreciate a review by the experts on this list :) * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ixgbe: Enable setting RSS table to default values ixgbe: Allow flow hash to be set via ethtool ==================== Link: https://lore.kernel.org/r/20230420235000.2971509-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 418a73074da9182f571e467eaded03ea501f3281 Author: Maxime Bizon Date: Thu Apr 20 20:25:08 2023 +0200 net: dst: fix missing initialization of rt_uncached xfrm_alloc_dst() followed by xfrm4_dst_destroy(), without a xfrm4_fill_dst() call in between, causes the following BUG: BUG: spinlock bad magic on CPU#0, fbxhostapd/732 lock: 0x890b7668, .magic: 890b7668, .owner: /-1, .owner_cpu: 0 CPU: 0 PID: 732 Comm: fbxhostapd Not tainted 6.3.0-rc6-next-20230414-00613-ge8de66369925-dirty #9 Hardware name: Marvell Kirkwood (Flattened Device Tree) unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x28/0x30 dump_stack_lvl from do_raw_spin_lock+0x20/0x80 do_raw_spin_lock from rt_del_uncached_list+0x30/0x64 rt_del_uncached_list from xfrm4_dst_destroy+0x3c/0xbc xfrm4_dst_destroy from dst_destroy+0x5c/0xb0 dst_destroy from rcu_process_callbacks+0xc4/0xec rcu_process_callbacks from __do_softirq+0xb4/0x22c __do_softirq from call_with_stack+0x1c/0x24 call_with_stack from do_softirq+0x60/0x6c do_softirq from __local_bh_enable_ip+0xa0/0xcc Patch "net: dst: Prevent false sharing vs. dst_entry:: __refcnt" moved rt_uncached and rt_uncached_list fields from rtable struct to dst struct, so they are more zeroed by memset_after(xdst, 0, u.dst) in xfrm_alloc_dst(). Note that rt_uncached (list_head) was never properly initialized at alloc time, but xfrm[46]_dst_destroy() is written in such a way that it was not an issue thanks to the memset: if (xdst->u.rt.dst.rt_uncached_list) rt_del_uncached_list(&xdst->u.rt); The route code does it the other way around: rt_uncached_list is assumed to be valid IIF rt_uncached list_head is not empty: void rt_del_uncached_list(struct rtable *rt) { if (!list_empty(&rt->dst.rt_uncached)) { struct uncached_list *ul = rt->dst.rt_uncached_list; spin_lock_bh(&ul->lock); list_del_init(&rt->dst.rt_uncached); spin_unlock_bh(&ul->lock); } } This patch adds mandatory rt_uncached list_head initialization in generic dst_init(), and adapt xfrm[46]_dst_destroy logic to match the rest of the code. Fixes: d288a162dd1c ("net: dst: Prevent false sharing vs. dst_entry:: __refcnt") Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202304162125.18b7bcdd-oliver.sang@intel.com Reviewed-by: David Ahern Reviewed-by: Eric Dumazet CC: Leon Romanovsky Signed-off-by: Maxime Bizon Link: https://lore.kernel.org/r/20230420182508.2417582-1-mbizon@freebox.fr Signed-off-by: Jakub Kicinski commit 33c1af8e2c75ab601524e25efeeed0173d703ce7 Author: Arnd Bergmann Date: Thu Apr 20 23:36:31 2023 +0200 net: dsa: qca8k: fix LEDS_CLASS dependency With LEDS_CLASS=m, a built-in qca8k driver fails to link: arm-linux-gnueabi-ld: drivers/net/dsa/qca/qca8k-leds.o: in function `qca8k_setup_led_ctrl': qca8k-leds.c:(.text+0x1ea): undefined reference to `devm_led_classdev_register_ext' Change the dependency to avoid the broken configuration. Fixes: 1e264f9d2918 ("net: dsa: qca8k: add LEDs basic support") Signed-off-by: Arnd Bergmann Reviewed-by: Christian Marangi Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230420213639.2243388-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 2cc8a008d62f3c04eeb7ec6fe59e542802bb8df3 Author: Ivan Vecera Date: Thu Apr 20 20:36:33 2023 +0200 net/sched: cls_api: Initialize miss_cookie_node when action miss is not used Function tcf_exts_init_ex() sets exts->miss_cookie_node ptr only when use_action_miss is true so it assumes in other case that the field is set to NULL by the caller. If not then the field contains garbage and subsequent tcf_exts_destroy() call results in a crash. Ensure that the field .miss_cookie_node pointer is NULL when use_action_miss parameter is false to avoid this potential scenario. Fixes: 80cd22c35c90 ("net/sched: cls_api: Support hardware miss to tc action") Signed-off-by: Ivan Vecera Reviewed-by: Pedro Tammela Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230420183634.1139391-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 6aa445e39693bff9c98b12f960e66b4e18c7378b Author: Geert Uytterhoeven Date: Thu Apr 20 19:37:23 2023 +0200 net/handshake: Fix section mismatch in handshake_exit If CONFIG_NET_NS=n (e.g. m68k/defconfig): WARNING: modpost: vmlinux.o: section mismatch in reference: handshake_exit (section: .exit.text) -> handshake_genl_net_ops (section: .init.data) ERROR: modpost: Section mismatches detected. Fix this by dropping the __net_initdata tag from handshake_genl_net_ops. Fixes: 3b3009ea8abb713b ("net/handshake: Create a NETLINK service for handling handshake requests") Reported-by: noreply@ellerman.id.au Closes: http://kisskb.ellerman.id.au/kisskb/buildresult/14912987 Signed-off-by: Geert Uytterhoeven Reviewed-by: Chuck Lever Link: https://lore.kernel.org/r/20230420173723.3773434-1-geert@linux-m68k.org Signed-off-by: Jakub Kicinski commit 7041101ff6c3073fd8f2e99920f535b111c929cb Author: Davide Caratti Date: Thu Apr 20 16:59:46 2023 +0200 net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "initial quantum" having values greater than INT_MAX, the first assignment of "credit" does signed integer overflow to a very negative value. In this situation, the syzkaller script provided by Cristoph triggers the CPU soft-lockup warning even with few sockets. It's not an infinite loop, but "credit" wasn't probably meant to be minus 2Gb for each new flow. Capping "initial quantum" to INT_MAX proved to fix the issue. v2: validation of "initial quantum" is done in fq_policy, instead of open coding in fq_change() _ suggested by Jakub Kicinski Reported-by: Christoph Paasch Link: https://github.com/multipath-tcp/mptcp_net-next/issues/377 Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler") Reviewed-by: Eric Dumazet Signed-off-by: Davide Caratti Link: https://lore.kernel.org/r/7b3a3c7e36d03068707a021760a194a8eb5ad41a.1682002300.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 63cfd210034c772fad047afa13dd5a4664b0a72e Author: Huanhuan Wang Date: Thu Apr 20 16:01:25 2023 +0200 nfp: fix incorrect pointer deference when offloading IPsec with bonding There are two pointers in struct xfrm_dev_offload, *dev, *real_dev. The *dev points whether bonding interface or real interface, if bonding IPsec offload is used, it points bonding interface; if not, it points real interface. And *real_dev always points real interface. So nfp should always use real_dev instead of dev. Prior to this change the system becomes unresponsive when offloading IPsec for a device which is a lower device to a bonding device. Fixes: 859a497fe80c ("nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer") CC: stable@vger.kernel.org Signed-off-by: Huanhuan Wang Acked-by: Simon Horman Signed-off-by: Louis Peens Link: https://lore.kernel.org/r/20230420140125.38521-1-louis.peens@corigine.com Signed-off-by: Jakub Kicinski commit 461bb5b97049a149278f2c27a3aa12af16da6a2e Author: Dan Carpenter Date: Thu Apr 20 15:36:07 2023 +0300 net: dpaa: Fix uninitialized variable in dpaa_stop() The return value is not initialized on the success path. Fixes: 901bdff2f529 ("net: fman: Change return type of disable to void") Signed-off-by: Dan Carpenter Acked-by: Madalin Bucur Reviewed-by: Sean Anderson Link: https://lore.kernel.org/r/8c9dc377-8495-495f-a4e5-4d2d0ee12f0c@kili.mountain Signed-off-by: Jakub Kicinski commit f3b766d981310989d524b076065a93b8f11bcab2 Author: Vladimir Oltean Date: Tue Apr 18 22:01:41 2023 +0300 net: phy: add basic driver for NXP CBTX PHY The CBTX PHY is a Fast Ethernet PHY integrated into the SJA1110 A/B/C automotive Ethernet switches. It was hoped it would work with the Generic PHY driver, but alas, it doesn't. The most important reason why is that the PHY is powered down by default, and it needs a vendor register to power it on. It has a linear memory map that is accessed over SPI by the SJA1110 switch driver, which exposes a fake MDIO controller. It has the following (and only the following) standard clause 22 registers: 0x0: MII_BMCR 0x1: MII_BMSR 0x2: MII_PHYSID1 0x3: MII_PHYSID2 0x4: MII_ADVERTISE 0x5: MII_LPA 0x6: MII_EXPANSION 0x7: the missing MII_NPAGE for Next Page Transmit Register Every other register is vendor-defined. The register map expands the standard clause 22 5-bit address space of 0x20 registers, however the driver does not need to access the extra registers for now (and hopefully never). If it ever needs to do that, it is possible to implement a fake (software) page switching mechanism between the PHY driver and the SJA1110 MDIO controller driver. Also, Auto-MDIX is turned off by default in hardware, the driver turns it on by default and reports the current status. I've tested this with a VSC8514 link partner and a crossover cable, by forcing the mode on the link partner, and seeing that the CBTX PHY always sees the reverse of the mode forced on the VSC8514 (and that traffic works). The link doesn't come up (as expected) if MDI modes are forced on both ends in the same way (with the cross-over cable, that is). Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230418190141.1040562-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit ea76e08f4d901a450619831a255e9e0a4c0ed162 Author: Asahi Lina Date: Mon Apr 3 18:33:53 2023 +0900 rust: ioctl: Add ioctl number manipulation functions Add simple 1:1 wrappers of the C ioctl number manipulation functions. Since these are macros we cannot bindgen them directly, and since they should be usable in const context we cannot use helper wrappers, so we'll have to reimplement them in Rust. Thankfully, the C headers do declare defines for the relevant bitfield positions, so we don't need to duplicate that. Signed-off-by: Asahi Lina Link: https://lore.kernel.org/r/20230329-rust-uapi-v2-2-bca5fb4d4a12@asahilina.net [ Moved the `#![allow(non_snake_case)]` to the usual place. ] Signed-off-by: Miguel Ojeda commit 4e1746656839ab1e88d76eec4d2fa0b41d585604 Author: Asahi Lina Date: Mon Apr 3 18:33:52 2023 +0900 rust: uapi: Add UAPI crate This crate mirrors the `bindings` crate, but will contain only UAPI bindings. Unlike the bindings crate, drivers may directly use this crate if they have to interface with userspace. Initially, just bind the generic ioctl stuff. In the future, we would also like to add additional checks to ensure that all types exposed by this crate satisfy UAPI-safety guarantees (that is, they are safely castable to/from a "bag of bits"). [ Miguel: added support for the `rustdoc` and `rusttest` targets, since otherwise they fail, and we want to keep them working. ] Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Asahi Lina Link: https://lore.kernel.org/r/20230329-rust-uapi-v2-1-bca5fb4d4a12@asahilina.net Signed-off-by: Miguel Ojeda commit 19096bce815716cf93fc1ef3965629c3affa26f1 Author: Wedson Almeida Filho Date: Sun Mar 26 00:57:38 2023 -0300 rust: sync: introduce `CondVar` This is the traditional condition variable or monitor synchronisation primitive. It is implemented with C's `wait_queue_head_t`. It allows users to release a lock and go to sleep while guaranteeing that notifications won't be missed. This is achieved by enqueuing a wait entry before releasing the lock. Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Will Deacon Cc: Waiman Long Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Wedson Almeida Filho Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20230411054543.21278-12-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda commit e32cca32c3d452a277884502b9155f3325caf80e Author: Wedson Almeida Filho Date: Mon Mar 27 15:43:08 2023 -0300 rust: lock: add `Guard::do_unlocked` It releases the lock, executes some function provided by the caller, then reacquires the lock. This is preparation for the implementation of condvars, which will sleep after between unlocking and relocking. We need an explicit `relock` method for primitives like `SpinLock` that have an irqsave variant: we use the guard state to determine if the lock was originally acquired with the regular `lock` function or `lock_irqsave`. Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Wedson Almeida Filho Link: https://lore.kernel.org/rust-for-linux/20230412121431.41627-1-wedsonaf@gmail.com/ [ Removed the irqsave bits as discussed. ] Signed-off-by: Miguel Ojeda commit 207296f1a03bfead0110ffc4f192f242100ce4ff Author: Pablo Neira Ayuso Date: Fri Apr 21 00:34:33 2023 +0200 netfilter: nf_tables: allow to create netdev chain without device Relax netdev chain creation to allow for loading the ruleset, then adding/deleting devices at a later stage. Hardware offload does not support for this feature yet. Signed-off-by: Pablo Neira Ayuso commit 7d937b107108f918906fc867ea070cc3d0cbcd32 Author: Pablo Neira Ayuso Date: Fri Apr 21 00:34:32 2023 +0200 netfilter: nf_tables: support for deleting devices in an existing netdev chain This patch allows for deleting devices in an existing netdev chain. Signed-off-by: Pablo Neira Ayuso commit b9703ed44ffbfba85c103b9de01886a225e14b38 Author: Pablo Neira Ayuso Date: Fri Apr 21 00:34:31 2023 +0200 netfilter: nf_tables: support for adding new devices to an existing netdev chain This patch allows users to add devices to an existing netdev chain. Signed-off-by: Pablo Neira Ayuso commit cdc32546632354305afdcf399a5431138a31c9e0 Author: Pablo Neira Ayuso Date: Fri Apr 21 00:34:30 2023 +0200 netfilter: nf_tables: rename function to destroy hook list Rename nft_flowtable_hooks_destroy() by nft_hooks_destroy() to prepare for netdev chain device updates. Signed-off-by: Pablo Neira Ayuso commit 28339b21a365a8cb9edc6956cbfd679f569daa81 Author: Pablo Neira Ayuso Date: Fri Apr 21 00:34:29 2023 +0200 netfilter: nf_tables: do not send complete notification of deletions In most cases, table, name and handle is sufficient for userspace to identify an object that has been deleted. Skipping unneeded fields in the netlink attributes in the message saves bandwidth (ie. less chances of hitting ENOBUFS). Rules are an exception: the existing userspace monitor code relies on the rule definition. This exception can be removed by implementing a rule cache in userspace, this is already supported by the tracing infrastructure. Regarding flowtables, incremental deletion of devices is possible. Skipping a full notification allows userspace to differentiate between flowtable removal and incremental removal of devices. Signed-off-by: Pablo Neira Ayuso commit c3c060adc0249355411a93e61888051e6902b8a1 Author: Pablo Neira Ayuso Date: Fri Apr 21 00:34:28 2023 +0200 netfilter: nf_tables: extended netlink error reporting for netdevice Flowtable and netdev chains are bound to one or several netdevice, extend netlink error reporting to specify the the netdevice that triggers the error. Signed-off-by: Pablo Neira Ayuso commit c7d15aaa105a9484b5385e5c391ea5203347d6b0 Author: Simon Horman Date: Mon Apr 17 17:10:48 2023 +0200 ipvs: Correct spelling in comments Correct some spelling errors flagged by codespell and found by inspection. Signed-off-by: Simon Horman Reviewed-by: Horatiu Vultur Signed-off-by: Pablo Neira Ayuso commit 210ffe4a74caead4d6790747d32b63c6152c70b7 Author: Simon Horman Date: Mon Apr 17 17:10:47 2023 +0200 ipvs: Remove {Enter,Leave}Function Remove EnterFunction and LeaveFunction. These debugging macros seem well past their use-by date. And seem to have little value these days. Removing them allows some trivial cleanup of some exit paths for some functions. These are also included in this patch. There is likely scope for further cleanup of both debugging and unwind paths. But let's leave that for another day. Only intended to change debug output, and only when CONFIG_IP_VS_DEBUG is enabled. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Horatiu Vultur Signed-off-by: Pablo Neira Ayuso commit 280654932e341bf2860503af49bd5cb8e2b78522 Author: Simon Horman Date: Mon Apr 17 17:10:46 2023 +0200 ipvs: Consistently use array_size() in ip_vs_conn_init() Consistently use array_size() to calculate the size of ip_vs_conn_tab in bytes. Flagged by Coccinelle: WARNING: array_size is already used (line 1498) to compute the same size No functional change intended. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Horatiu Vultur Signed-off-by: Pablo Neira Ayuso commit e3478c68f6704638d08f437cbc552ca5970c151a Author: Simon Horman Date: Mon Apr 17 17:10:45 2023 +0200 ipvs: Update width of source for ip_vs_sync_conn_options In ip_vs_sync_conn_v0() copy is made to struct ip_vs_sync_conn_options. That structure looks like this: struct ip_vs_sync_conn_options { struct ip_vs_seq in_seq; struct ip_vs_seq out_seq; }; The source of the copy is the in_seq field of struct ip_vs_conn. Whose type is struct ip_vs_seq. Thus we can see that the source - is not as wide as the amount of data copied, which is the width of struct ip_vs_sync_conn_option. The copy is safe because the next field in is another struct ip_vs_seq. Make use of struct_group() to annotate this. Flagged by gcc-13 as: In file included from ./include/linux/string.h:254, from ./include/linux/bitmap.h:11, from ./include/linux/cpumask.h:12, from ./arch/x86/include/asm/paravirt.h:17, from ./arch/x86/include/asm/cpuid.h:62, from ./arch/x86/include/asm/processor.h:19, from ./arch/x86/include/asm/timex.h:5, from ./include/linux/timex.h:67, from ./include/linux/time32.h:13, from ./include/linux/time.h:60, from ./include/linux/stat.h:19, from ./include/linux/module.h:13, from net/netfilter/ipvs/ip_vs_sync.c:38: In function 'fortify_memcpy_chk', inlined from 'ip_vs_sync_conn_v0' at net/netfilter/ipvs/ip_vs_sync.c:606:3: ./include/linux/fortify-string.h:529:25: error: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning] 529 | __read_overflow2_field(q_size_field, size); | Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Horatiu Vultur Signed-off-by: Pablo Neira Ayuso commit 46df417544f4f7fa3438caada0dc0e534a694343 Author: Florian Westphal Date: Fri Apr 14 15:01:34 2023 +0200 netfilter: nf_tables: do not store rule in traceinfo structure pass it as argument instead. This reduces size of traceinfo to 16 bytes. Total stack usage: nf_tables_core.c:252 nft_do_chain 304 static While its possible to also pass basechain as argument, doing so increases nft_do_chaininfo function size. Unlike pktinfo/verdict/rule the basechain info isn't used in the expression evaluation path. gcc places it on the stack, which results in extra push/pop when it gets passed to the trace helpers as argument rather than as part of the traceinfo structure. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 0a202145d5f9277dd24474aca8245731d030f29e Author: Florian Westphal Date: Fri Apr 14 15:01:33 2023 +0200 netfilter: nf_tables: do not store verdict in traceinfo structure Just pass it as argument to nft_trace_notify. Stack is reduced by 8 bytes: nf_tables_core.c:256 nft_do_chain 312 static Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 698bb828a6c20c86e30b307175be1827c071ce23 Author: Florian Westphal Date: Fri Apr 14 15:01:32 2023 +0200 netfilter: nf_tables: do not store pktinfo in traceinfo structure pass it as argument. No change in object size. stack usage decreases by 8 byte: nf_tables_core.c:254 nft_do_chain 320 static Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 2a1d6abd7ebeafc45f2fb5fabfd53b8b3beaa170 Author: Florian Westphal Date: Fri Apr 14 15:01:31 2023 +0200 netfilter: nf_tables: remove unneeded conditional This helper is inlined, so keep it as small as possible. If the static key is true, there is only a very small chance that info->trace is false: 1. tracing was enabled at this very moment, the static key was updated to active right after nft_do_table was called. 2. tracing was disabled at this very moment. trace->info is already false, the static key is about to be patched to false soon. In both cases, no event will be sent because info->trace is false (checked in noinline slowpath). info->nf_trace is irrelevant. The nf_trace update is redunant in this case, but this will only happen for short duration, when static key flips. text data bss dec hex filename old: 2980 192 32 3204 c84 nf_tables_core.o new: 2964 192 32 3188 c74i nf_tables_core.o Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 00c320f9b75560628e840bef027a27c746706759 Author: Florian Westphal Date: Thu Apr 13 17:13:20 2023 +0200 netfilter: nf_tables: make validation state per table We only need to validate tables that saw changes in the current transaction. The existing code revalidates all tables, but this isn't needed as cross-table jumps are not allowed (chains have table scope). Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 Author: Florian Westphal Date: Thu Apr 13 17:13:19 2023 +0200 netfilter: nf_tables: don't write table validation state without mutex The ->cleanup callback needs to be removed, this doesn't work anymore as the transaction mutex is already released in the ->abort function. Just do it after a successful validation pass, this either happens from commit or abort phases where transaction mutex is held. Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 63e9bbbcca60333490e13744ae736d8f988e4950 Author: Florian Westphal Date: Tue Apr 11 16:29:47 2023 +0200 netfilter: nf_tables: don't store chain address on jump Now that the rule trailer/end marker and the rcu head reside in the same structure, we no longer need to save/restore the chain pointer when performing/returning from a jump. We can simply let the trace infra walk the evaluated rule until it hits the end marker and then fetch the chain pointer from there. When the rule is NULL (policy tracing), then chain and basechain pointers were already identical, so just use the basechain. This cuts size of jumpstack in half, from 256 to 128 bytes in 64bit, scripts/stackusage says: nf_tables_core.c:251 nft_do_chain 328 static Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d4d89e6546e0d1ac09cb9dd353f0cb31c8a8deb1 Author: Florian Westphal Date: Tue Apr 11 16:29:46 2023 +0200 netfilter: nf_tables: don't store address of last rule on jump Walk the rule headers until the trailer one (last_bit flag set) instead of stopping at last_rule address. This avoids the need to store the address when jumping to another chain. This cuts size of jumpstack array by one third, on 64bit from 384 to 256 bytes. Still, stack usage is still quite large: scripts/stackusage: nf_tables_core.c:258 nft_do_chain 496 static Next patch will also remove chain pointer. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit e38fbfa972eb0944ce4387caf23d166c1df4b114 Author: Florian Westphal Date: Tue Apr 11 16:29:45 2023 +0200 netfilter: nf_tables: merge nft_rules_old structure and end of ruleblob marker In order to free the rules in a chain via call_rcu, the rule array used to stash a rcu_head and space for a pointer at the end of the rule array. When the current nft_rule_dp blob format got added in 2c865a8a28a1 ("netfilter: nf_tables: add rule blob layout"), this results in a double-trailer: size (unsigned long) struct nft_rule_dp struct nft_expr ... struct nft_rule_dp struct nft_expr ... struct nft_rule_dp (is_last=1) // Trailer The trailer, struct nft_rule_dp (is_last=1), is not accounted for in size, so it can be located via start_addr + size. Because the rcu_head is stored after 'start+size' as well this means the is_last trailer is *aliased* to the rcu_head (struct nft_rules_old). This is harmless, because at this time the nft_do_chain function never evaluates/accesses the trailer, it only checks the address boundary: for (; rule < last_rule; rule = nft_rule_next(rule)) { ... But this way the last_rule address has to be stashed in the jump structure to restore it after returning from a chain. nft_do_chain stack usage has become way too big, so put it on a diet. Without this patch is impossible to use for (; !rule->is_last; rule = nft_rule_next(rule)) { ... because on free, the needed update of the rcu_head will clobber the nft_rule_dp is_last bit. Furthermore, also stash the chain pointer in the trailer, this allows to recover the original chain structure from nf_tables_trace infra without a need to place them in the jump struct. After this patch it is trivial to diet the jump stack structure, done in the next two patches. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 7b1f55e3a984aaed0121f90f9f8580f18b7b561e Author: Wedson Almeida Filho Date: Tue Apr 11 02:45:43 2023 -0300 rust: sync: introduce `LockedBy` This allows us to have data protected by a lock despite not being wrapped by it. Access is granted by providing evidence that the lock is held by the caller. Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Wedson Almeida Filho Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20230411054543.21278-13-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda commit 8da7a2b7432e8f043f04515895687f72cdb3e0a8 Author: Wedson Almeida Filho Date: Tue Apr 11 02:45:40 2023 -0300 rust: introduce `current` This allows Rust code to get a reference to the current task without having to increment the refcount, but still guaranteeing memory safety. Cc: Ingo Molnar Cc: Peter Zijlstra Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Wedson Almeida Filho Link: https://lore.kernel.org/r/20230411054543.21278-10-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda commit 313c4281bc9dfa98d76a71b16a684af1c52e7751 Author: Wedson Almeida Filho Date: Tue Apr 11 02:45:39 2023 -0300 rust: add basic `Task` It is an abstraction for C's `struct task_struct`. It implements `AlwaysRefCounted`, so the refcount of the wrapped object is managed safely on the Rust side. Cc: Ingo Molnar Cc: Peter Zijlstra Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Wedson Almeida Filho Link: https://lore.kernel.org/r/20230411054543.21278-9-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda commit f1fbd6a864d417443cdacd6bfdb7fd626993da7e Author: Wedson Almeida Filho Date: Tue Apr 11 02:45:38 2023 -0300 rust: introduce `ARef` This is an owned reference to an object that is always ref-counted. This is meant to be used in wrappers for C types that have their own ref counting functions, for example, tasks, files, inodes, dentries, etc. Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Wedson Almeida Filho Reviewed-by: Gary Guo Link: https://lore.kernel.org/r/20230411054543.21278-8-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda commit c6d917a498bfef603f41bfc4d31e9699bb2909fc Author: Wedson Almeida Filho Date: Wed Apr 19 14:44:26 2023 -0300 rust: lock: introduce `SpinLock` This is the `spinlock_t` lock backend and allows Rust code to use the kernel spinlock idiomatically. Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Will Deacon Cc: Waiman Long Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Wedson Almeida Filho Link: https://lore.kernel.org/r/20230419174426.132207-1-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda commit 6d20d629c6d8575be98eeebe49a16fb2d7b32350 Author: Wedson Almeida Filho Date: Tue Apr 11 02:45:33 2023 -0300 rust: lock: introduce `Mutex` This is the `struct mutex` lock backend and allows Rust code to use the kernel mutex idiomatically. Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Will Deacon Cc: Waiman Long Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Wedson Almeida Filho Link: https://lore.kernel.org/r/20230411054543.21278-3-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda commit 76d4bd591e1101df69c44c819041e374c63f1194 Author: Wedson Almeida Filho Date: Tue Apr 11 02:45:32 2023 -0300 rust: sync: introduce `Lock` and `Guard` They are generic Rust implementations of a lock and a lock guard that contain code that is common to all locks. Different backends will be introduced in subsequent commits. Reviewed-by: Martin Rodriguez Reboredo Suggested-by: Gary Guo Signed-off-by: Wedson Almeida Filho Link: https://lore.kernel.org/r/20230411054543.21278-2-wedsonaf@gmail.com [ Fixed typo. ] Signed-off-by: Miguel Ojeda commit 531094dc7164718d28ebb581d729807d7e846363 Author: Yonatan Nachum Date: Tue Apr 4 15:43:13 2023 +0000 RDMA/efa: Add rdma write capability to device caps Add rdma write capability that is propagated from the device to rdma-core. Enable MR creation with remote write permissions according to this device capability. Link: https://lore.kernel.org/r/20230404154313.35194-1-ynachum@amazon.com Reviewed-by: Firas Jahjah Reviewed-by: Michael Margolin Signed-off-by: Yonatan Nachum Signed-off-by: Jason Gunthorpe commit 22ba509dd4dad053ad88fc387b5a74c2a9296a01 Author: Oleksandr Natalenko Date: Wed Apr 19 15:47:34 2023 +0200 mailmap: add entry for Oleksandr Map my corporate email to my personal one. Link: https://lkml.kernel.org/r/20230419134734.454630-1-oleksandr@natalenko.name Signed-off-by: Oleksandr Natalenko Cc: Jakub Kicinski Cc: Konrad Dybcio Signed-off-by: Andrew Morton commit 09d49eb90fc8d03e1dab62dd7060389040f1d32b Author: Arnd Bergmann Date: Mon Apr 17 22:56:24 2023 +0200 ocfs2: reduce ioctl stack usage On 32-bit architectures with KASAN_STACK enabled, the total stack usage of the ocfs2_ioctl function grows beyond the warning limit: fs/ocfs2/ioctl.c: In function 'ocfs2_ioctl': fs/ocfs2/ioctl.c:934:1: error: the frame size of 1448 bytes is larger than 1400 bytes [-Werror=frame-larger-than=] Move each of the variables into a basic block, and mark ocfs2_info_handle() as noinline_for_stack, in order to have the variable share stack slots. Link: https://lkml.kernel.org/r/20230417205631.1956027-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Joseph Qi Reviewed-by: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton commit 522dc4e5f51e3d51c4ff55ad1c725d12176b71ea Author: Chunguang Wu Date: Sun Apr 16 13:24:04 2023 +0800 fs/proc: add Kthread flag to /proc/$pid/status The command `ps -ef ` and `top -c` mark kernel thread by '[' and ']', but sometimes the result is not correct. The task->flags in /proc/$pid/stat is good, but we need remember the value of PF_KTHREAD is 0x00200000 and convert dec to hex. If we have no binary program and shell script which read /proc/$pid/stat, we can know it directly by `cat /proc/$pid/status`. Link: https://lkml.kernel.org/r/20230416052404.2920-1-fullspring2018@gmail.com Signed-off-by: Chunguang Wu Reviewed-by: Randy Dunlap Cc: Alexey Dobriyan Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 3647ebcfbfca384840231fe13fae665453238a61 Author: Hugh Dickins Date: Sun Apr 16 22:17:05 2023 -0700 ia64: fix an addr to taddr in huge_pte_offset() I know nothing of ia64 htlbpage_to_page(), but guess that the p4d line should be using taddr rather than addr, like everywhere else. Link: https://lkml.kernel.org/r/732eae88-3beb-246-2c72-281de786740@google.com Fixes: c03ab9e32a2c ("ia64: add support for folded p4d page tables") Signed-off-by: Hugh Dickins Acked-by: Mike Rapoport (IBM) Cc: Ard Biesheuvel Cc: Signed-off-by: Andrew Morton commit f0ca8c25256dd22737db5780e33e2809ce297625 Author: Li zeming Date: Sat Apr 22 05:47:33 2023 +0800 sparse: remove unnecessary 0 values from rc rc is assigned first, so it does not need to initialize the assignment. Link: https://lkml.kernel.org/r/20230421214733.2909-1-zeming@nfschina.com Signed-off-by: Li zeming Signed-off-by: Andrew Morton commit 6b008640db7355d8de6ac18f74cedd7ccc92684f Author: Linus Torvalds Date: Tue Apr 18 17:40:09 2023 -0400 mm: move 'mmap_min_addr' logic from callers into vm_unmapped_area() Instead of having callers care about the mmap_min_addr logic for the lowest valid mapping address (and some of them getting it wrong), just move the logic into vm_unmapped_area() itself. One less thing for various architecture cases (and generic helpers) to worry about. We should really try to make much more of this be common code, but baby steps.. Without this, vm_unmapped_area() could return an address below mmap_min_addr (because some caller forgot about that). That then causes the mmap machinery to think it has found a workable address, but then later security_mmap_addr(addr) is unhappy about it and the mmap() returns with a nonsensical error (EPERM). The proper action is to either return ENOMEM (if the virtual address space is exhausted), or try to find another address (ie do a bottom-up search for free addresses after the top-down one failed). See commit 2afc745f3e30 ("mm: ensure get_unmapped_area() returns higher address than mmap_min_addr"), which fixed this for one call site (the generic arch_get_unmapped_area_topdown() fallback) but left other cases alone. Link: https://lkml.kernel.org/r/20230418214009.1142926-1-Liam.Howlett@oracle.com Signed-off-by: Linus Torvalds Signed-off-by: Liam R. Howlett Cc: Russell King Cc: Liam Howlett Signed-off-by: Andrew Morton commit f724392415b3e1ae844d2766669c0d955fe9a17b Author: Hugh Dickins Date: Tue Apr 18 22:22:02 2023 -0700 hugetlb: pte_alloc_huge() to replace huge pte_alloc_map() Some architectures can have their hugetlb pages down at the lowest PTE level: their huge_pte_alloc() using pte_alloc_map(), but without any following pte_unmap(). Since none of these arches uses CONFIG_HIGHPTE, this is not seen as a problem at present; but would become a problem if forthcoming changes were to add an rcu_read_lock() into pte_offset_map(), with the rcu_read_unlock() expected in pte_unmap(). Similarly in their huge_pte_offset(): pte_offset_kernel() is good enough for that, but it's probably less confusing if we define pte_offset_huge() along with pte_alloc_huge(). Only define them without CONFIG_HIGHPTE: so there would be a build error to signal if ever more work is needed. For ease of development, define these now for 6.4-rc1, ahead of any use: then architectures can integrate patches using them, independent from mm. Link: https://lkml.kernel.org/r/ae9e7d98-8a3a-cfd9-4762-bcddffdf96cf@google.com Signed-off-by: Hugh Dickins Reviewed-by: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit 29ad6bb313487370f9dfe5441fc8982593b6384e Author: Peng Zhang Date: Wed Apr 19 17:36:25 2023 +0800 maple_tree: fix allocation in mas_sparse_area() In the case of reverse allocation, mas->index and mas->last do not point to the correct allocation range, which will cause users to get incorrect allocation results, so fix it. If the user does not use it in a specific way, this bug will not be triggered. This is a bug, but only VMA uses it now, the way VMA is used now will not trigger it. There is a possibility that a user will trigger it in the future. Also re-check whether the size is still satisfied after the lower bound was increased, which is a corner case and is incorrect in previous versions. Link: https://lkml.kernel.org/r/20230419093625.99201-1-zhangpeng.00@bytedance.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang Cc: Liam R. Howlett Signed-off-by: Andrew Morton commit 53156443a30368c0759c22e54a8d5cacc1b543cc Author: Suren Baghdasaryan Date: Wed Apr 19 10:58:36 2023 -0700 mm: do not increment pgfault stats when page fault handler retries If the page fault handler requests a retry, we will count the fault multiple times. This is a relatively harmless problem as the retry paths are not often requested, and the only user-visible problem is that the fault counter will be slightly higher than it should be. Nevertheless, userspace only took one fault, and should not see the fact that the kernel had to retry the fault multiple times. Move page fault accounting into mm_account_fault() and skip incomplete faults which will be accounted upon completion. Link: https://lkml.kernel.org/r/20230419175836.3857458-1-surenb@google.com Fixes: d065bd810b6d ("mm: retry page fault when blocking on disk transfer") Signed-off-by: Suren Baghdasaryan Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Peter Xu Cc: Davidlohr Bueso Cc: Jan Kara Cc: Johannes Weiner Cc: Josef Bacik Cc: Laurent Dufour Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Michel Lespinasse Cc: Minchan Kim Cc: Punit Agrawal Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d2658f2052c7db6ec0a79977205f8cf1cb9effc2 Author: Sergey Senozhatsky Date: Tue Apr 18 16:46:39 2023 +0900 zsmalloc: allow only one active pool compaction context zsmalloc pool can be compacted concurrently by many contexts, e.g. cc1 handle_mm_fault() do_anonymous_page() __alloc_pages_slowpath() try_to_free_pages() do_try_to_free_pages( lru_gen_shrink_node() shrink_slab() do_shrink_slab() zs_shrinker_scan() zs_compact() Pool compaction is currently (basically) single-threaded as it is performed under pool->lock. Having multiple compaction threads results in unnecessary contention, as each thread competes for pool->lock. This, in turn, affects all zsmalloc operations such as zs_malloc(), zs_map_object(), zs_free(), etc. Introduce the pool->compaction_in_progress atomic variable, which ensures that only one compaction context can run at a time. This reduces overall pool->lock contention in (corner) cases when many contexts attempt to shrink zspool simultaneously. Link: https://lkml.kernel.org/r/20230418074639.1903197-1-senozhatsky@chromium.org Fixes: c0547d0b6a4b ("zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks") Signed-off-by: Sergey Senozhatsky Reviewed-by: Yosry Ahmed Cc: Minchan Kim Signed-off-by: Andrew Morton commit 07115fcc15b4aa5c268fb80b82ad15868a82a285 Author: Stefan Roesch Date: Mon Apr 17 22:13:42 2023 -0700 selftests/mm: add new selftests for KSM This adds three new tests to the selftests for KSM. These tests use the new prctl API's to enable and disable KSM. 1) add new prctl flags to prctl header file in tools dir This adds the new prctl flags to the include file prct.h in the tools directory. This makes sure they are available for testing. 2) add KSM prctl merge test to ksm_tests This adds the -t option to the ksm_tests program. The -t flag allows to specify if it should use madvise or prctl ksm merging. 3) add two functions for debugging merge outcome for ksm_tests This adds two functions to report the metrics in /proc/self/ksm_stat and /sys/kernel/debug/mm/ksm. The debug output is enabled with the -d option. 4) add KSM prctl test to ksm_functional_tests This adds a test to the ksm_functional_test that verifies that the prctl system call to enable / disable KSM works. 5) add KSM fork test to ksm_functional_test Add fork test to verify that the MMF_VM_MERGE_ANY flag is inherited by the child process. Link: https://lkml.kernel.org/r/20230418051342.1919757-4-shr@devkernel.io Signed-off-by: Stefan Roesch Acked-by: David Hildenbrand Cc: Bagas Sanjaya Cc: David Hildenbrand Cc: Johannes Weiner Cc: Michal Hocko Cc: Rik van Riel Signed-off-by: Andrew Morton commit d21077fbc2fc987c2e593c34dc3b4d84e546dc9f Author: Stefan Roesch Date: Mon Apr 17 22:13:41 2023 -0700 mm: add new KSM process and sysfs knobs This adds the general_profit KSM sysfs knob and the process profit metric knobs to ksm_stat. 1) expose general_profit metric The documentation mentions a general profit metric, however this metric is not calculated. In addition the formula depends on the size of internal structures, which makes it more difficult for an administrator to make the calculation. Adding the metric for a better user experience. 2) document general_profit sysfs knob 3) calculate ksm process profit metric The ksm documentation mentions the process profit metric and how to calculate it. This adds the calculation of the metric. 4) mm: expose ksm process profit metric in ksm_stat This exposes the ksm process profit metric in /proc//ksm_stat. The documentation mentions the formula for the ksm process profit metric, however it does not calculate it. In addition the formula depends on the size of internal structures. So it makes sense to expose it. 5) document new procfs ksm knobs Link: https://lkml.kernel.org/r/20230418051342.1919757-3-shr@devkernel.io Signed-off-by: Stefan Roesch Reviewed-by: Bagas Sanjaya Acked-by: David Hildenbrand Cc: David Hildenbrand Cc: Johannes Weiner Cc: Michal Hocko Cc: Rik van Riel Signed-off-by: Andrew Morton commit d7597f59d1d33e9efbffa7060deb9ee5bd119e62 Author: Stefan Roesch Date: Mon Apr 17 22:13:40 2023 -0700 mm: add new api to enable ksm per process Patch series "mm: process/cgroup ksm support", v9. So far KSM can only be enabled by calling madvise for memory regions. To be able to use KSM for more workloads, KSM needs to have the ability to be enabled / disabled at the process / cgroup level. Use case 1: The madvise call is not available in the programming language. An example for this are programs with forked workloads using a garbage collected language without pointers. In such a language madvise cannot be made available. In addition the addresses of objects get moved around as they are garbage collected. KSM sharing needs to be enabled "from the outside" for these type of workloads. Use case 2: The same interpreter can also be used for workloads where KSM brings no benefit or even has overhead. We'd like to be able to enable KSM on a workload by workload basis. Use case 3: With the madvise call sharing opportunities are only enabled for the current process: it is a workload-local decision. A considerable number of sharing opportunities may exist across multiple workloads or jobs (if they are part of the same security domain). Only a higler level entity like a job scheduler or container can know for certain if its running one or more instances of a job. That job scheduler however doesn't have the necessary internal workload knowledge to make targeted madvise calls. Security concerns: In previous discussions security concerns have been brought up. The problem is that an individual workload does not have the knowledge about what else is running on a machine. Therefore it has to be very conservative in what memory areas can be shared or not. However, if the system is dedicated to running multiple jobs within the same security domain, its the job scheduler that has the knowledge that sharing can be safely enabled and is even desirable. Performance: Experiments with using UKSM have shown a capacity increase of around 20%. Here are the metrics from an instagram workload (taken from a machine with 64GB main memory): full_scans: 445 general_profit: 20158298048 max_page_sharing: 256 merge_across_nodes: 1 pages_shared: 129547 pages_sharing: 5119146 pages_to_scan: 4000 pages_unshared: 1760924 pages_volatile: 10761341 run: 1 sleep_millisecs: 20 stable_node_chains: 167 stable_node_chains_prune_millisecs: 2000 stable_node_dups: 2751 use_zero_pages: 0 zero_pages_sharing: 0 After the service is running for 30 minutes to an hour, 4 to 5 million shared pages are common for this workload when using KSM. Detailed changes: 1. New options for prctl system command This patch series adds two new options to the prctl system call. The first one allows to enable KSM at the process level and the second one to query the setting. The setting will be inherited by child processes. With the above setting, KSM can be enabled for the seed process of a cgroup and all processes in the cgroup will inherit the setting. 2. Changes to KSM processing When KSM is enabled at the process level, the KSM code will iterate over all the VMA's and enable KSM for the eligible VMA's. When forking a process that has KSM enabled, the setting will be inherited by the new child process. 3. Add general_profit metric The general_profit metric of KSM is specified in the documentation, but not calculated. This adds the general profit metric to /sys/kernel/debug/mm/ksm. 4. Add more metrics to ksm_stat This adds the process profit metric to /proc//ksm_stat. 5. Add more tests to ksm_tests and ksm_functional_tests This adds an option to specify the merge type to the ksm_tests. This allows to test madvise and prctl KSM. It also adds a two new tests to ksm_functional_tests: one to test the new prctl options and the other one is a fork test to verify that the KSM process setting is inherited by client processes. This patch (of 3): So far KSM can only be enabled by calling madvise for memory regions. To be able to use KSM for more workloads, KSM needs to have the ability to be enabled / disabled at the process / cgroup level. 1. New options for prctl system command This patch series adds two new options to the prctl system call. The first one allows to enable KSM at the process level and the second one to query the setting. The setting will be inherited by child processes. With the above setting, KSM can be enabled for the seed process of a cgroup and all processes in the cgroup will inherit the setting. 2. Changes to KSM processing When KSM is enabled at the process level, the KSM code will iterate over all the VMA's and enable KSM for the eligible VMA's. When forking a process that has KSM enabled, the setting will be inherited by the new child process. 1) Introduce new MMF_VM_MERGE_ANY flag This introduces the new flag MMF_VM_MERGE_ANY flag. When this flag is set, kernel samepage merging (ksm) gets enabled for all vma's of a process. 2) Setting VM_MERGEABLE on VMA creation When a VMA is created, if the MMF_VM_MERGE_ANY flag is set, the VM_MERGEABLE flag will be set for this VMA. 3) support disabling of ksm for a process This adds the ability to disable ksm for a process if ksm has been enabled for the process with prctl. 4) add new prctl option to get and set ksm for a process This adds two new options to the prctl system call - enable ksm for all vmas of a process (if the vmas support it). - query if ksm has been enabled for a process. 3. Disabling MMF_VM_MERGE_ANY for storage keys in s390 In the s390 architecture when storage keys are used, the MMF_VM_MERGE_ANY will be disabled. Link: https://lkml.kernel.org/r/20230418051342.1919757-1-shr@devkernel.io Link: https://lkml.kernel.org/r/20230418051342.1919757-2-shr@devkernel.io Signed-off-by: Stefan Roesch Acked-by: David Hildenbrand Cc: David Hildenbrand Cc: Johannes Weiner Cc: Michal Hocko Cc: Rik van Riel Cc: Bagas Sanjaya Signed-off-by: Andrew Morton commit 2124f79de6a909630d1a62b01ecc32db9f967181 Author: John Keeping Date: Tue Apr 18 11:19:05 2023 +0100 mm: shrinkers: fix debugfs file permissions The permissions for the files here are swapped as "count" is read-only and "scan" is write-only. While this doesn't really matter as these permissions don't stop the files being opened for reading/writing as appropriate, they are shown by "ls -l" and are confusing. Link: https://lkml.kernel.org/r/20230418101906.3131303-1-john@metanate.com Signed-off-by: John Keeping Signed-off-by: Andrew Morton commit f3ebdf042df4e08bab1d5f8bf1c4b959d8741c10 Author: David Hildenbrand Date: Tue Apr 18 16:21:13 2023 +0200 mm: don't check VMA write permissions if the PTE/PMD indicates write permissions Staring at the comment "Recheck VMA as permissions can change since migration started" in remove_migration_pte() can result in confusion, because if the source PTE/PMD indicates write permissions, then there should be no need to check VMA write permissions when restoring migration entries or PTE-mapping a PMD. Commit d3cb8bf6081b ("mm: migrate: Close race between migration completion and mprotect") introduced the maybe_mkwrite() handling in remove_migration_pte() in 2014, stating that a race between mprotect() and migration finishing would be possible, and that we could end up with a writable PTE that should be readable. However, mprotect() code first updates vma->vm_flags / vma->vm_page_prot and then walks the page tables to (a) set all present writable PTEs to read-only and (b) convert all writable migration entries to readable migration entries. While walking the page tables and modifying the entries, migration code has to grab the PT locks to synchronize against concurrent page table modifications. Assuming migration would find a writable migration entry (while holding the PT lock) and replace it with a writable present PTE, surely mprotect() code didn't stumble over the writable migration entry yet (converting it into a readable migration entry) and would instead wait for the PT lock to convert the now present writable PTE into a read-only PTE. As mprotect() didn't finish yet, the behavior is just like migration didn't happen: a writable PTE will be converted to a read-only PTE. So it's fine to rely on the writability information in the source PTE/PMD and not recheck against the VMA as long as we're holding the PT lock to synchronize with anyone who concurrently wants to downgrade write permissions (like mprotect()) by first adjusting vma->vm_flags / vma->vm_page_prot to then walk over the page tables to adjust the page table entries. Running test cases that should reveal such races -- mprotect(PROT_READ) racing with page migration or THP splitting -- for multiple hours did not reveal an issue with this cleanup. Link: https://lkml.kernel.org/r/20230418142113.439494-1-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Kirill A. Shutemov Reviewed-by: Alistair Popple Cc: Mel Gorman Cc: Peter Xu Signed-off-by: Andrew Morton commit 851ae6424697d1c4f085cb878c88168923ebcad1 Author: Huang Ying Date: Mon Apr 17 07:59:29 2023 +0800 migrate_pages_batch: fix statistics for longterm pin retry In commit fd4a7ac32918 ("mm: migrate: try again if THP split is failed due to page refcnt"), if the THP splitting fails due to page reference count, we will retry to improve migration successful rate. But the failed splitting is counted as migration failure and migration retry, which will cause duplicated failure counting. So, in this patch, this is fixed via undoing the failure counting if we decide to retry. The patch is tested via failure injection. Link: https://lkml.kernel.org/r/20230416235929.1040194-1-ying.huang@intel.com Fixes: fd4a7ac32918 ("mm: migrate: try again if THP split is failed due to page refcnt") Signed-off-by: "Huang, Ying" Reviewed-by: Baolin Wang Cc: Alistair Popple Cc: David Hildenbrand Cc: Yang Shi Cc: Zi Yan Signed-off-by: Andrew Morton commit 686ea6e61da61e46ae7068f73167ca26e0c67efb Author: ZhangPeng Date: Mon Apr 17 08:39:19 2023 +0800 userfaultfd: use helper function range_in_vma() We can use range_in_vma() to check if dst_start, dst_start + len are within the dst_vma range. Minor readability improvement. Link: https://lkml.kernel.org/r/20230417003919.930515-1-zhangpeng362@huawei.com Signed-off-by: ZhangPeng Reviewed-by: David Hildenbrand Cc: Kefeng Wang Cc: Mike Kravetz Cc: Nanyong Sun Signed-off-by: Andrew Morton commit 13215e8a4bb336dac2af561d4f5c34a071810ee4 Author: Yajun Deng Date: Mon Apr 17 11:52:26 2023 +0800 lib/show_mem.c: use for_each_populated_zone() simplify code __show_mem() needs to iterate over all zones that have memory, we can simplify the code by using for_each_populated_zone(). Link: https://lkml.kernel.org/r/20230417035226.4013584-1-yajun.deng@linux.dev Signed-off-by: Yajun Deng Acked-by: Vlastimil Babka Acked-by: Michal Hocko Cc: Johannes Weiner Signed-off-by: Andrew Morton commit 4bf4f155bfbc77a12ad2c9e12d9f57718adb9a5c Author: Kefeng Wang Date: Mon Apr 17 19:48:07 2023 +0800 mm: correct arg in reclaim_pages()/reclaim_clean_pages_from_list() Both of them change the arg from page_list to folio_list when convert them to use a folio, but not the declaration, let's correct it, also move the reclaim_pages() from swap.h to internal.h as it only used in mm. Link: https://lkml.kernel.org/r/20230417114807.186786-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviwed-by: Matthew Wilcox (Oracle) Reviewed-by: SeongJae Park Reviewed-by: David Hildenbrand Cc: Hugh Dickins Signed-off-by: Andrew Morton commit c6c8c3e7b47d7d20952202e7568389a5e3b043dd Author: Pankaj Raghav Date: Mon Apr 17 14:36:18 2023 +0200 fs/buffer: convert create_page_buffers to folio_create_buffers fs/buffer do not support large folios as there are many assumptions on the folio size to be the host page size. This conversion is one step towards removing that assumption. Also this conversion will reduce calls to compound_head() if folio_create_buffers() calls folio_create_empty_buffers(). Link: https://lkml.kernel.org/r/20230417123618.22094-5-p.raghav@samsung.com Signed-off-by: Pankaj Raghav Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Hannes Reinecke Cc: Alexander Viro Cc: Christian Brauner Cc: Luis Chamberlain Signed-off-by: Andrew Morton commit 8e2e17560bed73c2a73c94cbe378719f6cf850ee Author: Pankaj Raghav Date: Mon Apr 17 14:36:17 2023 +0200 fs/buffer: add folio_create_empty_buffers helper Folio version of create_empty_buffers(). This is required to convert create_page_buffers() to folio_create_buffers() later in the series. It removes several calls to compound_head() as it works directly on folio compared to create_empty_buffers(). Hence, create_empty_buffers() has been modified to call folio_create_empty_buffers(). Link: https://lkml.kernel.org/r/20230417123618.22094-4-p.raghav@samsung.com Signed-off-by: Pankaj Raghav Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Hannes Reinecke Cc: Alexander Viro Cc: Christian Brauner Cc: Luis Chamberlain Signed-off-by: Andrew Morton commit c71124a8afa441af203d2001a92c91f114446687 Author: Pankaj Raghav Date: Mon Apr 17 14:36:16 2023 +0200 buffer: add folio_alloc_buffers() helper Folio version of alloc_page_buffers() helper. This is required to convert create_page_buffers() to folio_create_buffers() later in the series. alloc_page_buffers() has been modified to call folio_alloc_buffers() which adds one call to compound_head() but folio_alloc_buffers() removes one call to compound_head() compared to the existing alloc_page_buffers() implementation. Link: https://lkml.kernel.org/r/20230417123618.22094-3-p.raghav@samsung.com Signed-off-by: Pankaj Raghav Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Hannes Reinecke Cc: Alexander Viro Cc: Christian Brauner Cc: Luis Chamberlain Signed-off-by: Andrew Morton commit 465e5e6a1698f3325f5d2262d2875779b06b50c7 Author: Pankaj Raghav Date: Mon Apr 17 14:36:15 2023 +0200 fs/buffer: add folio_set_bh helper Patch series "convert create_page_buffers to folio_create_buffers". One of the first kernel panic we hit when we try to increase the block size > 4k is inside create_page_buffers()[1]. Even though buffer.c function do not support large folios (folios > PAGE_SIZE) at the moment, these changes are required when we want to remove that constraint. This patch (of 4): The folio version of set_bh_page(). This is required to convert create_page_buffers() to folio_create_buffers() later in the series. Link: https://lkml.kernel.org/r/20230417123618.22094-1-p.raghav@samsung.com Link: https://lkml.kernel.org/r/20230417123618.22094-2-p.raghav@samsung.com Signed-off-by: Pankaj Raghav Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Hannes Reinecke Cc: Alexander Viro Cc: Christian Brauner Cc: Luis Chamberlain Signed-off-by: Andrew Morton commit 760aee0b71e34b4b9535e237347ff31b93961cbf Author: Peter Xu Date: Mon Apr 17 15:53:17 2023 -0400 selftests/mm: add tests for RO pinning vs fork() Add a test suite (with 10 more sub-tests) to cover RO pinning against fork() over uffd-wp. It covers both: (1) Early CoW test in fork() when page pinned, (2) page unshare due to RO longterm pin. They are: Testing wp-fork-pin on anon... done Testing wp-fork-pin on shmem... done Testing wp-fork-pin on shmem-private... done Testing wp-fork-pin on hugetlb... done Testing wp-fork-pin on hugetlb-private... done Testing wp-fork-pin-with-event on anon... done Testing wp-fork-pin-with-event on shmem... done Testing wp-fork-pin-with-event on shmem-private... done Testing wp-fork-pin-with-event on hugetlb... done Testing wp-fork-pin-with-event on hugetlb-private... done CONFIG_GUP_TEST needed or they'll be skipped. Testing wp-fork-pin on anon... skipped [reason: Possibly CONFIG_GUP_TEST missing or unprivileged] Note that the major test goal is on private memory, but no hurt to also run all of them over shared because shared memory should work the same. Link: https://lkml.kernel.org/r/20230417195317.898696-7-peterx@redhat.com Signed-off-by: Peter Xu Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Mika Penttilä Cc: Mike Kravetz Cc: Nadav Amit Signed-off-by: Andrew Morton commit 71fc41eb98357d147fd26d3eb130ca9daf7a9bf3 Author: Peter Xu Date: Mon Apr 17 15:53:16 2023 -0400 selftests/mm: rename COW_EXTRA_LIBS to IOURING_EXTRA_LIBS The macro and facility can be reused in other tests too. Make it general. Link: https://lkml.kernel.org/r/20230417195317.898696-6-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Mika Penttilä Cc: Mike Kravetz Cc: Nadav Amit Signed-off-by: Andrew Morton commit cff294582798dce6ca2b2d08051f563c0f7a09c8 Author: Peter Xu Date: Mon Apr 17 15:53:15 2023 -0400 selftests/mm: extend and rename uffd pagemap test Extend it to all types of mem, meanwhile add one parallel test when EVENT_FORK is enabled, where uffd-wp bits should be persisted rather than dropped. Since at it, rename the test to "wp-fork" to better show what it means. Making the new test called "wp-fork-with-event". Before: Testing pagemap on anon... done After: Testing wp-fork on anon... done Testing wp-fork on shmem... done Testing wp-fork on shmem-private... done Testing wp-fork on hugetlb... done Testing wp-fork on hugetlb-private... done Testing wp-fork-with-event on anon... done Testing wp-fork-with-event on shmem... done Testing wp-fork-with-event on shmem-private... done Testing wp-fork-with-event on hugetlb... done Testing wp-fork-with-event on hugetlb-private... done Link: https://lkml.kernel.org/r/20230417195317.898696-5-peterx@redhat.com Signed-off-by: Peter Xu Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Mika Penttilä Cc: Mike Kravetz Cc: Nadav Amit Signed-off-by: Andrew Morton commit 21337f2af16cb36782ff5031f2553f9cf2f7c787 Author: Peter Xu Date: Mon Apr 17 15:53:14 2023 -0400 selftests/mm: add a few options for uffd-unit-test Namely: "-f": add a wildcard filter for tests to run "-l": list tests rather than running any "-h": help msg Link: https://lkml.kernel.org/r/20230417195317.898696-4-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Mika Penttilä Cc: Mike Kravetz Cc: Nadav Amit Signed-off-by: Andrew Morton commit 0f230bc24b6e1399b86b95642704a962d8aa40e6 Author: Peter Xu Date: Mon Apr 17 15:53:13 2023 -0400 mm/hugetlb: fix uffd-wp bit lost when unsharing happens When we try to unshare a pinned page for a private hugetlb, uffd-wp bit can get lost during unsharing. When above condition met, one can lose uffd-wp bit on the privately mapped hugetlb page. It allows the page to be writable even if it should still be wr-protected. I assume it can mean data loss. This should be very rare, only if an unsharing happened on a private hugetlb page with uffd-wp protected (e.g. in a child which shares the same page with parent with UFFD_FEATURE_EVENT_FORK enabled). When I wrote the reproducer (provided in the last patch) I needed to use the newest gup_test cmd introduced by David to trigger it because I don't even know another way to do a proper RO longerm pin. Besides that, it needs a bunch of other conditions all met: (1) hugetlb being mapped privately, (2) userfaultfd registered with WP and EVENT_FORK, (3) the user app fork()s, then, (4) RO longterm pin onto a wr-protected anonymous page. If it's not impossible to hit in production I'd say extremely rare. Link: https://lkml.kernel.org/r/20230417195317.898696-3-peterx@redhat.com Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection") Signed-off-by: Peter Xu Reported-by: Mike Kravetz Reviewed-by: David Hildenbrand Reviewed-by: Mike Kravetz Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Mika Penttilä Cc: Nadav Amit Signed-off-by: Andrew Morton commit 5a2f8d22ace4c8ac8798fab836dca7350fa710b1 Author: Peter Xu Date: Mon Apr 17 15:53:12 2023 -0400 mm/hugetlb: fix uffd-wp during fork() Patch series "mm/hugetlb: More fixes around uffd-wp vs fork() / RO pins", v2. This patch (of 6): There're a bunch of things that were wrong: - Reading uffd-wp bit from a swap entry should use pte_swp_uffd_wp() rather than huge_pte_uffd_wp(). - When copying over a pte, we should drop uffd-wp bit when !EVENT_FORK (aka, when !userfaultfd_wp(dst_vma)). - When doing early CoW for private hugetlb (e.g. when the parent page was pinned), uffd-wp bit should be properly carried over if necessary. No bug reported probably because most people do not even care about these corner cases, but they are still bugs and can be exposed by the recent unit tests introduced, so fix all of them in one shot. Link: https://lkml.kernel.org/r/20230417195317.898696-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20230417195317.898696-2-peterx@redhat.com Fixes: bc70fbf269fd ("mm/hugetlb: handle uffd-wp during fork()") Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Mika Penttilä Cc: Mike Kravetz Cc: Nadav Amit Cc: Signed-off-by: Andrew Morton commit be41d814c6c7bbf3ffa66faeefa01f6cea8e3c98 Author: Zqiang Date: Mon Mar 27 20:00:19 2023 +0800 kasan: fix lockdep report invalid wait context For kernels built with the following options and booting CONFIG_SLUB=y CONFIG_DEBUG_LOCKDEP=y CONFIG_PROVE_LOCKING=y CONFIG_PROVE_RAW_LOCK_NESTING=y [ 0.523115] [ BUG: Invalid wait context ] [ 0.523315] 6.3.0-rc1-yocto-standard+ #739 Not tainted [ 0.523649] ----------------------------- [ 0.523663] swapper/0/0 is trying to lock: [ 0.523663] ffff888035611360 (&c->lock){....}-{3:3}, at: put_cpu_partial+0x2e/0x1e0 [ 0.523663] other info that might help us debug this: [ 0.523663] context-{2:2} [ 0.523663] no locks held by swapper/0/0. [ 0.523663] stack backtrace: [ 0.523663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.3.0-rc1-yocto-standard+ #739 [ 0.523663] Call Trace: [ 0.523663] [ 0.523663] dump_stack_lvl+0x64/0xb0 [ 0.523663] dump_stack+0x10/0x20 [ 0.523663] __lock_acquire+0x6c4/0x3c10 [ 0.523663] lock_acquire+0x188/0x460 [ 0.523663] put_cpu_partial+0x5a/0x1e0 [ 0.523663] __slab_free+0x39a/0x520 [ 0.523663] ___cache_free+0xa9/0xc0 [ 0.523663] qlist_free_all+0x7a/0x160 [ 0.523663] per_cpu_remove_cache+0x5c/0x70 [ 0.523663] __flush_smp_call_function_queue+0xfc/0x330 [ 0.523663] generic_smp_call_function_single_interrupt+0x13/0x20 [ 0.523663] __sysvec_call_function+0x86/0x2e0 [ 0.523663] sysvec_call_function+0x73/0x90 [ 0.523663] [ 0.523663] [ 0.523663] asm_sysvec_call_function+0x1b/0x20 [ 0.523663] RIP: 0010:default_idle+0x13/0x20 [ 0.523663] RSP: 0000:ffffffff83e07dc0 EFLAGS: 00000246 [ 0.523663] RAX: 0000000000000000 RBX: ffffffff83e1e200 RCX: ffffffff82a83293 [ 0.523663] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8119a6b1 [ 0.523663] RBP: ffffffff83e07dc8 R08: 0000000000000001 R09: ffffed1006ac0d66 [ 0.523663] R10: ffff888035606b2b R11: ffffed1006ac0d65 R12: 0000000000000000 [ 0.523663] R13: ffffffff83e1e200 R14: ffffffff84a7d980 R15: 0000000000000000 [ 0.523663] default_idle_call+0x6c/0xa0 [ 0.523663] do_idle+0x2e1/0x330 [ 0.523663] cpu_startup_entry+0x20/0x30 [ 0.523663] rest_init+0x152/0x240 [ 0.523663] arch_call_rest_init+0x13/0x40 [ 0.523663] start_kernel+0x331/0x470 [ 0.523663] x86_64_start_reservations+0x18/0x40 [ 0.523663] x86_64_start_kernel+0xbb/0x120 [ 0.523663] secondary_startup_64_no_verify+0xe0/0xeb [ 0.523663] The local_lock_irqsave() is invoked in put_cpu_partial() and happens in IPI context, due to the CONFIG_PROVE_RAW_LOCK_NESTING=y (the LD_WAIT_CONFIG not equal to LD_WAIT_SPIN), so acquire local_lock in IPI context will trigger above calltrace. This commit therefore moves qlist_free_all() from hard-irq context to task context. Link: https://lkml.kernel.org/r/20230327120019.1027640-1-qiang1.zhang@intel.com Signed-off-by: Zqiang Acked-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton commit a494aef23dfc732945cb42e22246a5c31174e4a5 Author: Dexuan Cui Date: Thu Apr 20 18:30:25 2023 -0700 PCI: hv: Replace retarget_msi_interrupt_params with hyperv_pcpu_input_arg 4 commits are involved here: A (2016): commit 0de8ce3ee8e3 ("PCI: hv: Allocate physically contiguous hypercall params buffer") B (2017): commit be66b6736591 ("PCI: hv: Use page allocation for hbus structure") C (2019): commit 877b911a5ba0 ("PCI: hv: Avoid a kmemleak false positive caused by the hbus buffer") D (2018): commit 68bb7bfb7985 ("X86/Hyper-V: Enable IPI enlightenments") Patch D introduced the per-CPU hypercall input page "hyperv_pcpu_input_arg" in 2018. With patch D, we no longer need the per-Hyper-V-PCI-bus hypercall input page "hbus->retarget_msi_interrupt_params" that was added in patch A, and the issue addressed by patch B is no longer an issue, and we can also get rid of patch C. The change here is required for PCI device assignment to work for Confidential VMs (CVMs) running without a paravisor, because otherwise we would have to call set_memory_decrypted() for "hbus->retarget_msi_interrupt_params" before calling the hypercall HVCALL_RETARGET_INTERRUPT. Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Acked-by: Lorenzo Pieralisi Link: https://lore.kernel.org/r/20230421013025.17152-1-decui@microsoft.com Signed-off-by: Wei Liu commit e025f0a73f6acb920d86549b2177a5883535421d Author: Benjamin Coddington Date: Thu Apr 20 12:17:35 2023 -0400 NFS: Cleanup unused rpc_clnt variable The root rpc_clnt is not used here, clean it up. Fixes: 4dc73c679114 ("NFSv4: keep state manager thread active if swap is enabled") Signed-off-by: Benjamin Coddington Reviewed-by: NeilBrown Signed-off-by: Anna Schumaker commit 3a36d20e012903f45714df2731261fdefac900cb Author: Mårten Lindahl Date: Thu Mar 30 16:40:59 2023 +0200 ubifs: Fix memory leak in do_rename If renaming a file in an encrypted directory, function fscrypt_setup_filename allocates memory for a file name. This name is never used, and before returning to the caller the memory for it is not freed. When running kmemleak on it we see that it is registered as a leak. The report below is triggered by a simple program 'rename' that renames a file in an encrypted directory: unreferenced object 0xffff888101502840 (size 32): comm "rename", pid 9404, jiffies 4302582475 (age 435.735s) backtrace: __kmem_cache_alloc_node __kmalloc fscrypt_setup_filename do_rename ubifs_rename vfs_rename do_renameat2 To fix this we can remove the call to fscrypt_setup_filename as it's not needed. Fixes: 278d9a243635f26 ("ubifs: Rename whiteout atomically") Reported-by: Zhihao Cheng Signed-off-by: Mårten Lindahl Reviewed-by: Zhihao Cheng Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger commit 1fb815b38bb31d6af9bd0540b8652a0d6fe6cfd3 Author: Mårten Lindahl Date: Thu Mar 30 11:32:14 2023 +0200 ubifs: Free memory for tmpfile name When opening a ubifs tmpfile on an encrypted directory, function fscrypt_setup_filename allocates memory for the name that is to be stored in the directory entry, but after the name has been copied to the directory entry inode, the memory is not freed. When running kmemleak on it we see that it is registered as a leak. The report below is triggered by a simple program 'tmpfile' just opening a tmpfile: unreferenced object 0xffff88810178f380 (size 32): comm "tmpfile", pid 509, jiffies 4294934744 (age 1524.742s) backtrace: __kmem_cache_alloc_node __kmalloc fscrypt_setup_filename ubifs_tmpfile vfs_tmpfile path_openat Free this memory after it has been copied to the inode. Signed-off-by: Mårten Lindahl Reviewed-by: Zhihao Cheng Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger commit c5733ae6dc895fa45032df0342c98dedc7051c2d Author: Tom Rix Date: Thu Apr 20 21:01:32 2023 -0400 NFS: set varaiable nfs_netfs_debug_id storage-class-specifier to static smatch reports fs/nfs/fscache.c:260:10: warning: symbol 'nfs_netfs_debug_id' was not declared. Should it be static? This variable is only used in its defining file, so it should be static Signed-off-by: Tom Rix Signed-off-by: Anna Schumaker commit 31a149d5c13c4cbcf97de3435817263a2d8c9d6e Author: Wang YanQing Date: Tue Mar 28 23:35:34 2023 +0800 ubi: Fix return value overwrite issue in try_write_vid_and_data() The commit 2d78aee426d8 ("UBI: simplify LEB write and atomic LEB change code") adds helper function, try_write_vid_and_data(), to simplify the code, but this helper function has bug, it will return 0 (success) when ubi_io_write_vid_hdr() or the ubi_io_write_data() return error number (-EIO, etc), because the return value of ubi_wl_put_peb() will overwrite the original return value. This issue will cause unexpected data loss issue, because the caller of this function and UBIFS willn't know the data is lost. Fixes: 2d78aee426d8 ("UBI: simplify LEB write and atomic LEB change code") Cc: stable@vger.kernel.org Signed-off-by: Wang YanQing Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit c477d83c26b7acd526a30a32be7e9c0bab5da285 Author: Yangtao Li Date: Tue Mar 21 15:11:36 2023 +0800 ubifs: Remove return in compr_exit() It's redundant, let's remove it. Signed-off-by: Yangtao Li Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 705b004ee377b789e39ae237519bab714297ac83 Author: Yi Liu Date: Thu Apr 20 22:36:11 2023 -0700 docs: kvm: vfio: Suggest KVM_DEV_VFIO_GROUP_ADD vs VFIO_GROUP_GET_DEVICE_FD ordering as some vfio_device's open_device op requires kvm pointer and kvm pointer set is part of GROUP_ADD. Reviewed-by: Kevin Tian Signed-off-by: Yi Liu Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20230421053611.55839-1-yi.l.liu@intel.com Signed-off-by: Alex Williamson commit ef5031137b90c5338792f7073ba3bf38d14c8cf1 Author: Yang Li Date: Wed Feb 15 09:21:17 2023 +0800 ubi: Simplify bool conversion ./drivers/mtd/ubi/build.c:1261:33-38: WARNING: conversion to bool not needed here Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4061 Signed-off-by: Yang Li Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 4db10a8243df665ced10b027c2d4862173a7a3ec Author: Eduard Zingerman Date: Fri Apr 21 20:42:34 2023 +0300 selftests/bpf: verifier/value_ptr_arith converted to inline assembly Test verifier/value_ptr_arith automatically converted to use inline assembly. Test cases "sanitation: alu with different scalars 2" and "sanitation: alu with different scalars 3" are updated to avoid -ENOENT as return value, as __retval() annotation only supports numeric literals. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-25-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit efe25a330b106f39e5d27760cc57def3e8c5a3f9 Author: Eduard Zingerman Date: Fri Apr 21 20:42:33 2023 +0300 selftests/bpf: verifier/value_illegal_alu converted to inline assembly Test verifier/value_illegal_alu automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-24-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 82887c2568e4f78d5cfcb85bf3cdc056dfd97c85 Author: Eduard Zingerman Date: Fri Apr 21 20:42:32 2023 +0300 selftests/bpf: verifier/unpriv converted to inline assembly Test verifier/unpriv semi-automatically converted to use inline assembly. The verifier/unpriv.c had to be split in two parts: - the bulk of the tests is in the progs/verifier_unpriv.c; - the single test that needs `struct bpf_perf_event_data` definition is in the progs/verifier_unpriv_perf.c. The tests above can't be in a single file because: - first requires inclusion of the filter.h header (to get access to BPF_ST_MEM macro, inline assembler does not support this isntruction); - the second requires vmlinux.h, which contains definitions conflicting with filter.h. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-23-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 81d1d6dd4037755b98bf9b9f9d0dbd715b1734e5 Author: Eduard Zingerman Date: Fri Apr 21 20:42:31 2023 +0300 selftests/bpf: verifier/subreg converted to inline assembly Test verifier/subreg automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-22-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit f323a81806bd79adafa6e88607b388166e92a1b0 Author: Eduard Zingerman Date: Fri Apr 21 20:42:30 2023 +0300 selftests/bpf: verifier/spin_lock converted to inline assembly Test verifier/spin_lock automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-21-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 426fc0e3fce272c92e804b2d844a41641f9b888e Author: Eduard Zingerman Date: Fri Apr 21 20:42:29 2023 +0300 selftests/bpf: verifier/sock converted to inline assembly Test verifier/sock automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-20-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 034d9ad25db3569bee306850c6a276bca0d1e12d Author: Eduard Zingerman Date: Fri Apr 21 20:42:28 2023 +0300 selftests/bpf: verifier/search_pruning converted to inline assembly Test verifier/search_pruning automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-19-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 65222842ca04be5df505592f9f845acce0463f8b Author: Eduard Zingerman Date: Fri Apr 21 20:42:27 2023 +0300 selftests/bpf: verifier/runtime_jit converted to inline assembly Test verifier/runtime_jit automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-18-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 16a42573c253ad490a66cd0ca990f07297c0e221 Author: Eduard Zingerman Date: Fri Apr 21 20:42:26 2023 +0300 selftests/bpf: verifier/regalloc converted to inline assembly Test verifier/regalloc automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-17-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 8be632795996c198a26b6f39727d9c92007bb6a5 Author: Eduard Zingerman Date: Fri Apr 21 20:42:25 2023 +0300 selftests/bpf: verifier/ref_tracking converted to inline assembly Test verifier/ref_tracking automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-16-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit aee1779f0deca501e904fbf007ccb7232972e518 Author: Eduard Zingerman Date: Fri Apr 21 20:42:22 2023 +0300 selftests/bpf: verifier/map_ptr_mixing converted to inline assembly Test verifier/map_ptr_mixing automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-13-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 4a400ef9ba416494944db52f95d0f16ea04adfdf Author: Eduard Zingerman Date: Fri Apr 21 20:42:21 2023 +0300 selftests/bpf: verifier/map_in_map converted to inline assembly Test verifier/map_in_map automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-12-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit b427ca576f83d6853fc323639c5f4608e876527f Author: Eduard Zingerman Date: Fri Apr 21 20:42:20 2023 +0300 selftests/bpf: verifier/lwt converted to inline assembly Test verifier/lwt automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-11-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit a6fc14dc5e8d43871eebe5455719de6d7578a3bc Author: Eduard Zingerman Date: Fri Apr 21 20:42:19 2023 +0300 selftests/bpf: verifier/loops1 converted to inline assembly Test verifier/loops1 automatically converted to use inline assembly. There are a few modifications for the converted tests. "tracepoint" programs do not support test execution, change program type to "xdp" (which supports test execution) for the following tests that have __retval tags: - bounded loop, count to 4 - bonded loop containing forward jump Also, remove the __retval tag for test: - bounded loop, count from positive unknown to 4 As it's return value is a random number. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-10-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit a5828e3154d17d9fec53910a1aa161d028339ada Author: Eduard Zingerman Date: Fri Apr 21 20:42:18 2023 +0300 selftests/bpf: verifier/jeq_infer_not_null converted to inline assembly Test verifier/jeq_infer_not_null automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-9-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 0a372c9c0812ec5de4a740781fbf183ee523bf4a Author: Eduard Zingerman Date: Fri Apr 21 20:42:17 2023 +0300 selftests/bpf: verifier/direct_packet_access converted to inline assembly Test verifier/direct_packet_access automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-8-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 6080280243846f3c5b3715af4334260522bf11f0 Author: Eduard Zingerman Date: Fri Apr 21 20:42:16 2023 +0300 selftests/bpf: verifier/d_path converted to inline assembly Test verifier/d_path automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-7-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit fcd36964f22bbe571a07b3cdb3040ec31642ba44 Author: Eduard Zingerman Date: Fri Apr 21 20:42:15 2023 +0300 selftests/bpf: verifier/ctx converted to inline assembly Test verifier/ctx automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-6-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 37467c79e16a7b569fe5c1197e2ed507f72d2ab7 Author: Eduard Zingerman Date: Fri Apr 21 20:42:14 2023 +0300 selftests/bpf: verifier/btf_ctx_access converted to inline assembly Test verifier/btf_ctx_access automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-5-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 965a3f913e723e2da9c0ec21b9825b583b0777e1 Author: Eduard Zingerman Date: Fri Apr 21 20:42:13 2023 +0300 selftests/bpf: verifier/bpf_get_stack converted to inline assembly Test verifier/bpf_get_stack automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-4-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit c92336559ac0127250cb3ffa9e6f69f9d7e81779 Author: Eduard Zingerman Date: Fri Apr 21 20:42:12 2023 +0300 selftests/bpf: verifier/bounds converted to inline assembly Test verifier/bounds automatically converted to use inline assembly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 63bb645b9da373c29ba4b5bea14e80c49e676694 Author: Eduard Zingerman Date: Fri Apr 21 20:42:11 2023 +0300 selftests/bpf: Add notion of auxiliary programs for test_loader In order to express test cases that use bpf_tail_call() intrinsic it is necessary to have several programs to be loaded at a time. This commit adds __auxiliary annotation to the set of annotations supported by test_loader.c. Programs marked as auxiliary are always loaded but are not treated as a separate test. For example: void dummy_prog1(void); struct { __uint(type, BPF_MAP_TYPE_PROG_ARRAY); __uint(max_entries, 4); __uint(key_size, sizeof(int)); __array(values, void (void)); } prog_map SEC(".maps") = { .values = { [0] = (void *) &dummy_prog1, }, }; SEC("tc") __auxiliary __naked void dummy_prog1(void) { asm volatile ("r0 = 42; exit;"); } SEC("tc") __description("reference tracking: check reference or tail call") __success __retval(0) __naked void check_reference_or_tail_call(void) { asm volatile ( "r2 = %[prog_map] ll;" "r3 = 0;" "call %[bpf_tail_call];" "r0 = 0;" "exit;" :: __imm(bpf_tail_call), : __clobber_all); } Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230421174234.2391278-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit d7a799ec782b6ae9158f8d587c9f49cf34a6c5f4 Merge: 45cea721ea36d 006c0e44ed924 Author: Alexei Starovoitov Date: Fri Apr 21 11:35:51 2023 -0700 Merge branch 'bpf: add netfilter program type' Florian Westphal says: ==================== Changes since last version: - rework test case in last patch wrt. ctx->skb dereference etc (Alexei) - pacify bpf ci tests, netfilter program type missed string translation in libbpf helper. This still uses runtime btf walk rather than extending the btf trace array as Alexei suggested, I would do this later (or someone else can). v1 cover letter: Add minimal support to hook bpf programs to netfilter hooks, e.g. PREROUTING or FORWARD. For this the most relevant parts for registering a netfilter hook via the in-kernel api are exposed to userspace via bpf_link. The new program type is 'tracing style', i.e. there is no context access rewrite done by verifier, the function argument (struct bpf_nf_ctx) isn't stable. There is no support for direct packet access, dynptr api should be used instead. With this its possible to build a small test program such as: #include "vmlinux.h" extern int bpf_dynptr_from_skb(struct __sk_buff *skb, __u64 flags, struct bpf_dynptr *ptr__uninit) __ksym; extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, uint32_t offset, void *buffer, uint32_t buffer__sz) __ksym; SEC("netfilter") int nf_test(struct bpf_nf_ctx *ctx) { struct nf_hook_state *state = ctx->state; struct sk_buff *skb = ctx->skb; const struct iphdr *iph, _iph; const struct tcphdr *th, _th; struct bpf_dynptr ptr; if (bpf_dynptr_from_skb(skb, 0, &ptr)) return NF_DROP; iph = bpf_dynptr_slice(&ptr, 0, &_iph, sizeof(_iph)); if (!iph) return NF_DROP; th = bpf_dynptr_slice(&ptr, iph->ihl << 2, &_th, sizeof(_th)); if (!th) return NF_DROP; bpf_printk("accept %x:%d->%x:%d, hook %d ifin %d\n", iph->saddr, bpf_ntohs(th->source), iph->daddr, bpf_ntohs(th->dest), state->hook, state->in->ifindex); return NF_ACCEPT; } Then, tail /sys/kernel/tracing/trace_pipe. Changes since v3: - uapi: remove 'reserved' struct member, s/prio/priority (Alexei) - add ctx access test cases (Alexei, see last patch) - some arm32 can only handle cmpxchg on u32 (build bot) - Fix kdoc annotations (Simon Horman) - bpftool: prefer p_err, not fprintf (Quentin) - add test cases in separate patch Changes since v2: 1. don't WARN when user calls 'bpftool loink detach' twice restrict attachment to ip+ip6 families, lets relax this later in case arp/bridge/netdev are needed too. 2. show netfilter links in 'bpftool net' output as well. Changes since v1: 1. Don't fail to link when CONFIG_NETFILTER=n (build bot) 2. Use test_progs instead of test_verifier (Alexei) Changes since last RFC version: 1. extend 'bpftool link show' to print prio/hooknum etc 2. extend 'nft list hooks' so it can print the bpf program id 3. Add an extra patch to artificially restrict bpf progs with same priority. Its fine from a technical pov but it will cause ordering issues (most recent one comes first). Can be removed later. 4. Add test_run support for netfilter prog type and a small extension to verifier tests to make sure we can't return verdicts like NF_STOLEN. 5. Alter the netfilter part of the bpf_link uapi struct: - add flags/reserved members. Not used here except returning errors when they are nonzero. Plan is to allow the bpf_link users to enable netfilter defrag or conntrack engine by setting feature flags at link create time in the future. ==================== Signed-off-by: Alexei Starovoitov commit 006c0e44ed924140d44bc756e6ea36301fcea68d Author: Florian Westphal Date: Fri Apr 21 19:03:00 2023 +0200 selftests/bpf: add missing netfilter return value and ctx access tests Extend prog_tests with two test cases: # ./test_progs --allow=verifier_netfilter_retcode #278/1 verifier_netfilter_retcode/bpf_exit with invalid return code. test1:OK #278/2 verifier_netfilter_retcode/bpf_exit with valid return code. test2:OK #278/3 verifier_netfilter_retcode/bpf_exit with valid return code. test3:OK #278/4 verifier_netfilter_retcode/bpf_exit with invalid return code. test4:OK #278 verifier_netfilter_retcode:OK This checks that only accept and drop (0,1) are permitted. NF_QUEUE could be implemented later if we can guarantee that attachment of such programs can be rejected if they get attached to a pf/hook that doesn't support async reinjection. NF_STOLEN could be implemented via trusted helpers that can guarantee that the skb will eventually be free'd. v4: test case for bpf_nf_ctx access checks, requested by Alexei Starovoitov. v5: also check ctx->{state,skb} can be dereferenced (Alexei). # ./test_progs --allow=verifier_netfilter_ctx #281/1 verifier_netfilter_ctx/netfilter invalid context access, size too short:OK #281/2 verifier_netfilter_ctx/netfilter invalid context access, size too short:OK #281/3 verifier_netfilter_ctx/netfilter invalid context access, past end of ctx:OK #281/4 verifier_netfilter_ctx/netfilter invalid context, write:OK #281/5 verifier_netfilter_ctx/netfilter valid context read and invalid write:OK #281/6 verifier_netfilter_ctx/netfilter test prog with skb and state read access:OK #281/7 verifier_netfilter_ctx/netfilter test prog with skb and state read access @unpriv:OK #281 verifier_netfilter_ctx:OK Summary: 1/7 PASSED, 0 SKIPPED, 0 FAILED This checks: 1/2: partial reads of ctx->{skb,state} are rejected 3. read access past sizeof(ctx) is rejected 4. write to ctx content, e.g. 'ctx->skb = NULL;' is rejected 5. ctx->state content cannot be altered 6. ctx->state and ctx->skb can be dereferenced 7. ... same program fails for unpriv (CAP_NET_ADMIN needed). Link: https://lore.kernel.org/bpf/20230419021152.sjq4gttphzzy6b5f@dhcp-172-26-102-232.dhcp.thefacebook.com/ Link: https://lore.kernel.org/bpf/20230420201655.77kkgi3dh7fesoll@MacBook-Pro-6.local/ Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-8-fw@strlen.de Signed-off-by: Alexei Starovoitov commit 2b99ef22e0d237e08bfc437e7d051f78f352aeb2 Author: Florian Westphal Date: Fri Apr 21 19:02:59 2023 +0200 bpf: add test_run support for netfilter program type add glue code so a bpf program can be run using userspace-provided netfilter state and packet/skb. Default is to use ipv4:output hook point, but this can be overridden by userspace. Userspace provided netfilter state is restricted, only hook and protocol families can be overridden and only to ipv4/ipv6. Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-7-fw@strlen.de Signed-off-by: Alexei Starovoitov commit d0fe92fb5e3df6991c640fb9205d880b68603259 Author: Florian Westphal Date: Fri Apr 21 19:02:58 2023 +0200 tools: bpftool: print netfilter link info Dump protocol family, hook and priority value: $ bpftool link 2: netfilter prog 14 ip input prio -128 pids install(3264) 5: netfilter prog 14 ip6 forward prio 21 pids a.out(3387) 9: netfilter prog 14 ip prerouting prio 123 pids a.out(5700) 10: netfilter prog 14 ip input prio 21 pids test2(5701) v2: Quentin Monnet suggested to also add 'bpftool net' support: $ bpftool net xdp: tc: flow_dissector: netfilter: ip prerouting prio 21 prog_id 14 ip input prio -128 prog_id 14 ip input prio 21 prog_id 14 ip forward prio 21 prog_id 14 ip output prio 21 prog_id 14 ip postrouting prio 21 prog_id 14 'bpftool net' only dumps netfilter link type, links are sorted by protocol family, hook and priority. v5: fix bpf ci failure: libbpf needs small update to prog_type_name[] and probe_prog_load helper. v4: don't fail with -EOPNOTSUPP in libbpf probe_prog_load, update prog_type_name[] with "netfilter" entry (bpf ci) v3: fix bpf.h copy, 'reserved' member was removed (Alexei) use p_err, not fprintf (Quentin) Suggested-by: Quentin Monnet Link: https://lore.kernel.org/bpf/eeeaac99-9053-90c2-aa33-cc1ecb1ae9ca@isovalent.com/ Reviewed-by: Quentin Monnet Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-6-fw@strlen.de Signed-off-by: Alexei Starovoitov commit 0bdc6da88f5bac0f3f272cb6f545c2cc70e8c66a Author: Florian Westphal Date: Fri Apr 21 19:02:57 2023 +0200 netfilter: disallow bpf hook attachment at same priority This is just to avoid ordering issues between multiple bpf programs, this could be removed later in case it turns out to be too cautious. bpf prog could still be shared with non-bpf hook, otherwise we'd have to make conntrack hook registration fail just because a bpf program has same priority. Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-5-fw@strlen.de Signed-off-by: Alexei Starovoitov commit 506a74db7e019a277e987fa65654bdd953859d5b Author: Florian Westphal Date: Fri Apr 21 19:02:56 2023 +0200 netfilter: nfnetlink hook: dump bpf prog id This allows userspace ("nft list hooks") to show which bpf program is attached to which hook. Without this, user only knows bpf prog is attached at prio x, y, z at INPUT and FORWARD, but can't tell which program is where. v4: kdoc fixups (Simon Horman) Link: https://lore.kernel.org/bpf/ZEELzpNCnYJuZyod@corigine.com/ Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-4-fw@strlen.de Signed-off-by: Alexei Starovoitov commit fd9c663b9ad67dedfc9a3fd3429ddd3e83782b4d Author: Florian Westphal Date: Fri Apr 21 19:02:55 2023 +0200 bpf: minimal support for programs hooked into netfilter framework This adds minimal support for BPF_PROG_TYPE_NETFILTER bpf programs that will be invoked via the NF_HOOK() points in the ip stack. Invocation incurs an indirect call. This is not a necessity: Its possible to add 'DEFINE_BPF_DISPATCHER(nf_progs)' and handle the program invocation with the same method already done for xdp progs. This isn't done here to keep the size of this chunk down. Verifier restricts verdicts to either DROP or ACCEPT. Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-3-fw@strlen.de Signed-off-by: Alexei Starovoitov commit 84601d6ee68ae820dec97450934797046d62db4b Author: Florian Westphal Date: Fri Apr 21 19:02:54 2023 +0200 bpf: add bpf_link support for BPF_NETFILTER programs Add bpf_link support skeleton. To keep this reviewable, no bpf program can be invoked yet, if a program is attached only a c-stub is called and not the actual bpf program. Defaults to 'y' if both netfilter and bpf syscall are enabled in kconfig. Uapi example usage: union bpf_attr attr = { }; attr.link_create.prog_fd = progfd; attr.link_create.attach_type = 0; /* unused */ attr.link_create.netfilter.pf = PF_INET; attr.link_create.netfilter.hooknum = NF_INET_LOCAL_IN; attr.link_create.netfilter.priority = -128; err = bpf(BPF_LINK_CREATE, &attr, sizeof(attr)); ... this would attach progfd to ipv4:input hook. Such hook gets removed automatically if the calling program exits. BPF_NETFILTER program invocation is added in followup change. NF_HOOK_OP_BPF enum will eventually be read from nfnetlink_hook, it allows to tell userspace which program is attached at the given hook when user runs 'nft hook list' command rather than just the priority and not-very-helpful 'this hook runs a bpf prog but I can't tell which one'. Will also be used to disallow registration of two bpf programs with same priority in a followup patch. v4: arm32 cmpxchg only supports 32bit operand s/prio/priority/ v3: restrict prog attachment to ip/ip6 for now, lets lift restrictions if more use cases pop up (arptables, ebtables, netdev ingress/egress etc). Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230421170300.24115-2-fw@strlen.de Signed-off-by: Alexei Starovoitov commit 45cea721ea36d83969473d2abd29bcc2321cacdd Author: Kui-Feng Lee Date: Wed Apr 19 17:28:22 2023 -0700 bpftool: Update doc to explain struct_ops register subcommand. The "struct_ops register" subcommand now allows for an optional *LINK_DIR* to be included. This specifies the directory path where bpftool will pin struct_ops links with the same name as their corresponding map names. Signed-off-by: Kui-Feng Lee Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/r/20230420002822.345222-2-kuifeng@meta.com Signed-off-by: Alexei Starovoitov commit 0232b788978652571c4f4e57dc26ff8e4837926a Author: Kui-Feng Lee Date: Wed Apr 19 17:28:21 2023 -0700 bpftool: Register struct_ops with a link. You can include an optional path after specifying the object name for the 'struct_ops register' subcommand. Since the commit 226bc6ae6405 ("Merge branch 'Transit between BPF TCP congestion controls.'") has been accepted, it is now possible to create a link for a struct_ops. This can be done by defining a struct_ops in SEC(".struct_ops.link") to make libbpf returns a real link. If we don't pin the links before leaving bpftool, they will disappear. To instruct bpftool to pin the links in a directory with the names of the maps, we need to provide the path of that directory. Signed-off-by: Kui-Feng Lee Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/r/20230420002822.345222-1-kuifeng@meta.com Signed-off-by: Alexei Starovoitov commit 7a40f1f18a88c6d43c8725d7f45146480a79fde1 Author: Alexander Aring Date: Fri Apr 21 11:55:52 2023 -0400 fs: dlm: stop unnecessarily filling zero ms_extra bytes Commit 7175e131ebba ("fs: dlm: fix invalid derefence of sb_lvbptr") fixes an issue when the lkb->lkb_lvbptr set to an dangled pointer and an followed memcpy() would fail. It was fixed by an additional check of DLM_LKF_VALBLK flag. The mentioned commit forgot to add an additional check if DLM_LKF_VALBLK is set for the additional amount of LVB data allocated in a dlm message. This patch is changing the message allocation to check additionally if DLM_LKF_VALBLK is set otherwise a dangled lkb->lkb_lvbptr pointer would allocated zero LVB message data which not gets filled with actual data. This patch is however only a cleanup to reduce the amount of zero bytes transmitted over network as receive_lvb() will only evaluates message LVB data if DLM_LKF_VALBLK is set. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 3fd41721cd5c30af37c860e6201c98db0a568fd2 Author: Ritesh Harjani (IBM) Date: Fri Apr 21 08:52:43 2023 -0700 iomap: Add DIO tracepoints Add trace_iomap_dio_rw_begin, trace_iomap_dio_rw_queued and trace_iomap_dio_complete tracepoint. trace_iomap_dio_rw_queued is mostly only to know that the request was queued and -EIOCBQUEUED was returned. It is mostly trace_iomap_dio_rw_begin & trace_iomap_dio_complete which has all the details. a.out-2073 [006] 134.225717: iomap_dio_rw_begin: dev 7:7 ino 0xe size 0x0 offset 0x0 length 0x1000 done_before 0x0 flags DIRECT|WRITE dio_flags DIO_FORCE_WAIT aio 1 a.out-2073 [006] 134.226234: iomap_dio_complete: dev 7:7 ino 0xe size 0x1000 offset 0x1000 flags DIRECT|WRITE aio 1 error 0 ret 4096 a.out-2074 [006] 136.225975: iomap_dio_rw_begin: dev 7:7 ino 0xe size 0x1000 offset 0x0 length 0x1000 done_before 0x0 flags DIRECT dio_flags aio 1 a.out-2074 [006] 136.226173: iomap_dio_rw_queued: dev 7:7 ino 0xe size 0x1000 offset 0x1000 length 0x0 ksoftirqd/3-31 [003] 136.226389: iomap_dio_complete: dev 7:7 ino 0xe size 0x1000 offset 0x1000 flags DIRECT aio 1 error 0 ret 4096 a.out-2075 [003] 141.674969: iomap_dio_rw_begin: dev 7:7 ino 0xe size 0x1000 offset 0x0 length 0x1000 done_before 0x0 flags DIRECT|WRITE dio_flags aio 1 a.out-2075 [003] 141.676085: iomap_dio_rw_queued: dev 7:7 ino 0xe size 0x1000 offset 0x1000 length 0x0 kworker/2:0-27 [002] 141.676432: iomap_dio_complete: dev 7:7 ino 0xe size 0x1000 offset 0x1000 flags DIRECT|WRITE aio 1 error 0 ret 4096 a.out-2077 [006] 143.443746: iomap_dio_rw_begin: dev 7:7 ino 0xe size 0x1000 offset 0x0 length 0x1000 done_before 0x0 flags DIRECT dio_flags aio 1 a.out-2077 [006] 143.443866: iomap_dio_rw_queued: dev 7:7 ino 0xe size 0x1000 offset 0x1000 length 0x0 ksoftirqd/5-41 [005] 143.444134: iomap_dio_complete: dev 7:7 ino 0xe size 0x1000 offset 0x1000 flags DIRECT aio 1 error 0 ret 4096 a.out-2078 [007] 146.716833: iomap_dio_rw_begin: dev 7:7 ino 0xe size 0x1000 offset 0x0 length 0x1000 done_before 0x0 flags DIRECT dio_flags aio 0 a.out-2078 [007] 146.717639: iomap_dio_complete: dev 7:7 ino 0xe size 0x1000 offset 0x1000 flags DIRECT aio 0 error 0 ret 4096 a.out-2079 [006] 148.972605: iomap_dio_rw_begin: dev 7:7 ino 0xe size 0x1000 offset 0x0 length 0x1000 done_before 0x0 flags DIRECT dio_flags aio 0 a.out-2079 [006] 148.973099: iomap_dio_complete: dev 7:7 ino 0xe size 0x1000 offset 0x1000 flags DIRECT aio 0 error 0 ret 4096 Reviewed-by: Christoph Hellwig Signed-off-by: Ritesh Harjani (IBM) Reviewed-by: Darrick J. Wong [djwong: line up strings all prettylike] Signed-off-by: Darrick J. Wong commit d3bff1fc50d4fcaccddbd63917dd94172e80c40e Author: Ritesh Harjani (IBM) Date: Fri Apr 21 08:52:43 2023 -0700 iomap: Remove IOMAP_DIO_NOSYNC unused dio flag IOMAP_DIO_NOSYNC earlier was added for use in btrfs. But it seems for aio dsync writes this is not useful anyway. For aio dsync case, we we queue the request and return -EIOCBQUEUED. Now, since IOMAP_DIO_NOSYNC doesn't let iomap_dio_complete() to call generic_write_sync(), hence we may lose the sync write. Hence kill this flag as it is not in use by any FS now. Tested-by: Disha Goel Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Darrick J. Wong commit f6c73a11133ef991284311387ca707b48bf53912 Author: Ritesh Harjani (IBM) Date: Fri Apr 21 08:52:42 2023 -0700 fs.h: Add TRACE_IOCB_STRINGS for use in trace points Add TRACE_IOCB_STRINGS macro which can be used in the trace point patch to print different flag values with meaningful string output. Tested-by: Disha Goel Reviewed-by: Christoph Hellwig Signed-off-by: Ritesh Harjani (IBM) Reviewed-by: Darrick J. Wong [djwong: line up strings all prettylike] Signed-off-by: Darrick J. Wong commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 Author: Mark Zhang Date: Thu Apr 20 04:39:06 2023 +0300 RDMA/mlx5: Use correct device num_ports when modify DC Just like other QP types, when modify DC, the port_num should be compared with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port vHCA on DC may not work. Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP") Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com Signed-off-by: Mark Zhang Reviewed-by: Maor Gottlieb Signed-off-by: Jason Gunthorpe commit 109205b40afbddd01baff796c627c5be3d804ef9 Author: Tejun Heo Date: Thu Apr 20 09:48:08 2023 -1000 RDMA/irdma: Drop spurious WQ_UNBOUND from alloc_ordered_workqueue() call Workqueue is in the process of cleaning up the distinction between unbound workqueues w/ @nr_active==1 and ordered workqueues. Explicit WQ_UNBOUND isn't needed for alloc_ordered_workqueue() and will trigger a warning in the future. Let's remove it. This doesn't cause any functional changes. Link: https://lore.kernel.org/r/ZEGW-IcFReR1juVM@slm.duckdns.org Signed-off-by: Tejun Heo Acked-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit 10af303192bc5490bb39b29541ecb0ead2eff1ce Author: Daisuke Matsuda Date: Tue Apr 18 18:06:42 2023 +0900 RDMA/rxe: Fix spinlock recursion deadlock on requester The following deadlock is observed: Call Trace: _raw_spin_lock_bh+0x29/0x30 check_type_state.constprop.0+0x4e/0xc0 [rdma_rxe] rxe_rcv+0x173/0x3d0 [rdma_rxe] rxe_udp_encap_recv+0x69/0xd0 [rdma_rxe] ? __pfx_rxe_udp_encap_recv+0x10/0x10 [rdma_rxe] udp_queue_rcv_one_skb+0x258/0x520 udp_unicast_rcv_skb+0x75/0x90 __udp4_lib_rcv+0x364/0x5c0 ip_protocol_deliver_rcu+0xa7/0x160 ip_local_deliver_finish+0x73/0xa0 ip_sublist_rcv_finish+0x80/0x90 ip_sublist_rcv+0x191/0x220 ip_list_rcv+0x132/0x160 __netif_receive_skb_list_core+0x297/0x2c0 netif_receive_skb_list_internal+0x1c5/0x300 napi_complete_done+0x6f/0x1b0 virtnet_poll+0x1f4/0x2d0 [virtio_net] __napi_poll+0x2c/0x1b0 net_rx_action+0x293/0x350 ? __napi_schedule+0x79/0x90 __do_softirq+0xcb/0x2ab __irq_exit_rcu+0xb9/0xf0 common_interrupt+0x80/0xa0 asm_common_interrupt+0x22/0x40 RIP: 0010:_raw_spin_lock+0x17/0x30 rxe_requester+0xe4/0x8f0 [rdma_rxe] ? xas_load+0x9/0xa0 ? xa_load+0x70/0xb0 do_task+0x64/0x1f0 [rdma_rxe] rxe_post_send+0x54/0x110 [rdma_rxe] ib_uverbs_post_send+0x5f8/0x680 [ib_uverbs] ? netif_receive_skb_list_internal+0x1e3/0x300 ib_uverbs_write+0x3c8/0x500 [ib_uverbs] vfs_write+0xc5/0x3b0 ksys_write+0xab/0xe0 ? syscall_trace_enter.constprop.0+0x126/0x1a0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The deadlock is easily reproducible with perftest. Fix it by disabling softirq when acquiring the lock in process context. Fixes: f605f26ea196 ("RDMA/rxe: Protect QP state with qp->state_lock") Link: https://lore.kernel.org/r/20230418090642.1849358-1-matsuda-daisuke@fujitsu.com Signed-off-by: Daisuke Matsuda Acked-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe commit f37202aa6e5d6d39a48f744d962fd2bf3a8a452b Merge: 803235982b8c0 2ff1b0839ddd5 Author: Thomas Gleixner Date: Fri Apr 21 17:30:57 2023 +0200 Merge tag 'irqchip-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip changes from Marc Zyngier: - Large RISC-V IPI rework to make way for a new interrupt architecture - More Loongarch fixes from Lianmin Lv, fixing issues in the so called "dual-bridge" systems. - Workaround for the nvidia T241 chip that gets confused in 3 and 4 socket configurations, leading to the GIC malfunctionning in some contexts - Drop support for non-firmware driven GIC configurarations now that the old ARM11MP Cavium board is gone - Workaround for the Rockchip 3588 chip that doesn't correctly deal with the shareability attributes. - Replace uses of of_find_property() with the more appropriate of_property_read_bool() - Make bcm-6345-l1 request its MMIO region - Add suspend support to the SiFive PLIC - Drop support for stih415, stih416 and stid127 platforms Link: https://lore.kernel.org/lkml/20230421132104.3021536-1-maz@kernel.org commit 833d67ecdc5f35f1ebf59d0fccc1ce771434be9c Author: Stanislav Fomichev Date: Tue Apr 18 15:53:39 2023 -0700 selftests/bpf: Verify optval=NULL case Make sure we get optlen exported instead of getting EFAULT. Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230418225343.553806-3-sdf@google.com commit 00e74ae0863827d944e36e56a4ce1e77e50edb91 Author: Stanislav Fomichev Date: Tue Apr 18 15:53:38 2023 -0700 bpf: Don't EFAULT for getsockopt with optval=NULL Some socket options do getsockopt with optval=NULL to estimate the size of the final buffer (which is returned via optlen). This breaks BPF getsockopt assumptions about permitted optval buffer size. Let's enforce these assumptions only when non-NULL optval is provided. Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") Reported-by: Martin KaFai Lau Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/ZD7Js4fj5YyI2oLd@google.com/T/#mb68daf700f87a9244a15d01d00c3f0e5b08f49f7 Link: https://lore.kernel.org/bpf/20230418225343.553806-2-sdf@google.com commit e81995a81e25e8fab286db6539198dd97b140807 Author: Oswald Buddenhagen Date: Fri Apr 21 16:10:06 2023 +0200 ALSA: emu10k1: clarify various fx8010.*_mask fields extin_mask and extout_mask are used only by the SbLive! microcode, so they have no effect on Audigy. Eliminate fxbus_mask entirely, as it wasn't actually used for anything. As a drive-by, remove the pointless pad1 field from struct snd_emu10k1_fx8010 - it is not visible to user space, so it has no binary compatibility constraints. Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421141006.1005509-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 2db2be5607c4508c37705d604437b43a99b4791f Author: Chris Down Date: Fri Apr 21 15:38:41 2023 +0100 ALSA: usb-audio: Rate limit usb_set_interface error reporting When an error occurs during USB disconnection sometimes things can go wrong as endpoint_set_interface may end up being called repeatedly. For example: % dmesg --notime | grep 'usb 3-7.1.4' | sort | uniq -c | head -2 3069 usb 3-7.1.4: 1:1: usb_set_interface failed (-19) 908 usb 3-7.1.4: 1:1: usb_set_interface failed (-71) In my case, there sometimes are hundreds of these usb_set_interface failure messages a second when I disconnect the hub that has my USB audio device. These messages can take a huge amount of the kmsg ringbuffer and don't provide any extra information over the previous ones, so ratelimit them. Signed-off-by: Chris Down Link: https://lore.kernel.org/r/ZEKf8UYBYa1h4JWR@chrisdown.name Signed-off-by: Takashi Iwai commit f9bcdcec3bf0063a010d123a9977cb7a8e240f95 Merge: e375b503943f5 73db1b8f2bb67 Author: Jakub Kicinski Date: Fri Apr 21 07:55:40 2023 -0700 Merge tag 'nf-23-04-21' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Set on IPS_CONFIRMED before change_status() otherwise EBUSY is bogusly hit. This bug was introduced in the 6.3 release cycle. 2) Fix nfnetlink_queue conntrack support: Set/dump timeout accordingly for unconfirmed conntrack entries. Make sure this is done after IPS_CONFIRMED is set on. This is an old bug, it happens since the introduction of this feature. * tag 'nf-23-04-21' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: conntrack: fix wrong ct->timeout value netfilter: conntrack: restore IPS_CONFIRMED out of nf_conntrack_hash_check_insert() ==================== Link: https://lore.kernel.org/r/20230421105700.325438-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 4d421eebe1465d94b95867dd025385dc3d661f9b Author: Oswald Buddenhagen Date: Fri Apr 21 13:27:51 2023 +0200 ALSA: docs: writing-an-alsa-driver.rst: polishing - Update some outdated info - Language fixes - Whitespace/formatting fixes - Prefer attached over stand-alone '::' [ dropped a trailing white space in the patch -- tiwai ] Signed-off-by: Oswald Buddenhagen Link: https://lore.kernel.org/r/20230421112751.990244-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit ca288965801572fe41386560d4e6c5cc0e5cc56d Merge: dfc39d4026fb2 3288ee5844b74 Author: Jakub Kicinski Date: Fri Apr 21 07:35:51 2023 -0700 Merge tag 'wireless-next-2023-04-21' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Kalle Valo says: ==================== wireless-next patches for v6.4 Most likely the last -next pull request for v6.4. We have changes all over. rtw88 now supports SDIO bus and iwlwifi continues to work on Wi-Fi 7 support. Not much stack changes this time. Major changes: cfg80211/mac80211 - fix some Fine Time Measurement (FTM) frames not being bufferable - flush frames before key removal to avoid potential unencrypted transmission depending on the hardware design iwlwifi - preparation for Wi-Fi 7 EHT and multi-link support rtw88 - SDIO bus support - RTL8822BS, RTL8822CS and RTL8821CS SDIO chipset support rtw89 - framework firmware backwards compatibility brcmfmac - Cypress 43439 SDIO support mt76 - mt7921 P2P support - mt7996 mesh A-MSDU support - mt7996 EHT support - mt7996 coredump support wcn36xx - support for pronto v3 hardware ath11k - PCIe DeviceTree bindings - WCN6750: enable SAR support ath10k - convert DeviceTree bindings to YAML * tag 'wireless-next-2023-04-21' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (261 commits) wifi: rtw88: Update spelling in main.h wifi: airo: remove ISA_DMA_API dependency wifi: rtl8xxxu: Simplify setting the initial gain wifi: rtl8xxxu: Add rtl8xxxu_write{8,16,32}_{set,clear} wifi: rtl8xxxu: Don't print the vendor/product/serial wifi: rtw88: Fix memory leak in rtw88_usb wifi: rtw88: call rtw8821c_switch_rf_set() according to chip variant wifi: rtw88: set pkg_type correctly for specific rtw8821c variants wifi: rtw88: rtw8821c: Fix rfe_option field width wifi: rtw88: usb: fix priority queue to endpoint mapping wifi: rtw88: 8822c: add iface combination wifi: rtw88: handle station mode concurrent scan with AP mode wifi: rtw88: prevent scan abort with other VIFs wifi: rtw88: refine reserved page flow for AP mode wifi: rtw88: disallow PS during AP mode wifi: rtw88: 8822c: extend reserved page number wifi: rtw88: add port switch for AP mode wifi: rtw88: add bitmap for dynamic port settings wifi: rtw89: mac: use regular int as return type of DLE buffer request wifi: mac80211: remove return value check of debugfs_create_dir() ... ==================== Link: https://lore.kernel.org/r/20230421104726.800BCC433D2@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 02e93e0475df21a1091a9833c52c0e241586573a Author: Magnus Karlsson Date: Fri Apr 21 08:22:08 2023 +0200 selftests/xsk: Put MAP_HUGE_2MB in correct argument Put the flag MAP_HUGE_2MB in the correct flags argument instead of the wrong offset argument. Fixes: 2ddade322925 ("selftests/xsk: Fix munmap for hugepage allocated umem") Reported-by: Kal Cutter Conley Signed-off-by: Magnus Karlsson Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230421062208.3772-1-magnus.karlsson@gmail.com commit 4ab07209d5cc8cb6d2a5324c07b3efc3b2fde494 Author: Dave Marchevsky Date: Fri Apr 21 00:44:31 2023 -0700 bpf: Fix bpf_refcount_acquire's refcount_t address calculation When calculating the address of the refcount_t struct within a local kptr, bpf_refcount_acquire_impl should add refcount_off bytes to the address of the local kptr. Due to some missing parens, the function is incorrectly adding sizeof(refcount_t) * refcount_off bytes. This patch fixes the calculation. Due to the incorrect calculation, bpf_refcount_acquire_impl was trying to refcount_inc some memory well past the end of local kptrs, resulting in kasan and refcount complaints, as reported in [0]. In that thread, Florian and Eduard discovered that bpf selftests written in the new style - with __success and an expected __retval, specifically - were not actually being run. As a result, selftests added in bpf_refcount series weren't really exercising this behavior, and thus didn't unearth the bug. With this fixed behavior it's safe to revert commit 7c4b96c00043 ("selftests/bpf: disable program test run for progs/refcounted_kptr.c"), this patch does so. [0] https://lore.kernel.org/bpf/ZEEp+j22imoN6rn9@strlen.de/ Fixes: 7c50b1cb76ac ("bpf: Add bpf_refcount_acquire kfunc") Reported-by: Florian Westphal Reported-by: Eduard Zingerman Signed-off-by: Dave Marchevsky Signed-off-by: Daniel Borkmann Tested-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20230421074431.3548349-1-davemarchevsky@fb.com commit acf1c3d68e9a31f10d92bc67ad4673cdae5e8d92 Author: Alexei Starovoitov Date: Thu Apr 20 18:49:01 2023 -0700 bpf: Fix race between btf_put and btf_idr walk. Florian and Eduard reported hard dead lock: [ 58.433327] _raw_spin_lock_irqsave+0x40/0x50 [ 58.433334] btf_put+0x43/0x90 [ 58.433338] bpf_find_btf_id+0x157/0x240 [ 58.433353] btf_parse_fields+0x921/0x11c0 This happens since btf->refcount can be 1 at the time of btf_put() and btf_put() will call btf_free_id() which will try to grab btf_idr_lock and will dead lock. Avoid the issue by doing btf_put() without locking. Fixes: 3d78417b60fb ("bpf: Add bpf_btf_find_by_name_kind() helper.") Fixes: 1e89106da253 ("bpf: Add bpf_core_add_cands() and wire it into bpf_core_apply_relo_insn().") Reported-by: Florian Westphal Reported-by: Eduard Zingerman Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Tested-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20230421014901.70908-1-alexei.starovoitov@gmail.com commit 93822f5161a2dc57a60b95b35b3cb8589f53413e Author: Tomáš Pecka Date: Thu Apr 20 19:19:39 2023 +0200 hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E The bit flags in pmbus_driver_info functionality for YM-2151E chip were joined with a comma operator instead of a bitwise OR. This means that the last constant PMBUS_HAVE_IIN was not OR-ed with the other PM_BUS_HAVE_* constants for this page but it initialized the next element of the func array (which was not accessed from anywhere because of the number of pages). However, there is no need for setting PMBUS_HAVE_IIN in the 5Vsb page because this command does not seem to be paged. Obviously, the device only has one IIN sensor, so it doesn't make sense to query it again from the second page. Fixes: 1734b4135a62 ("hwmon: Add driver for fsp-3y PSUs and PDUs") Signed-off-by: Jan Kundrát Signed-off-by: Tomáš Pecka Link: https://lore.kernel.org/r/20230420171939.212040-1-tomas.pecka@cesnet.cz Signed-off-by: Guenter Roeck commit 2a8e41ad337508fc5d598c0f9288890214f8e318 Author: Chris Packham Date: Wed Apr 19 11:36:55 2023 +1200 hwmon: (adt7475) Use device_property APIs when configuring polarity On DT unaware platforms of_property_read_u32_array() returns -ENOSYS which wasn't handled by the code treating adi,pwm-active-state as optional. Update the code to use device_property_read_u32_array() which deals gracefully with DT unaware platforms. Fixes: 86da28eed4fb ("hwmon: (adt7475) Add support for inverting pwm output") Reported-by: Mariusz Białończyk Link: https://lore.kernel.org/linux-hwmon/52e26a67-9131-2dc0-40cb-db5c07370027@alliedtelesis.co.nz/T/#mdd0505801e0a4e72340de009a47c0fca4f771ed3 Signed-off-by: Chris Packham Link: https://lore.kernel.org/r/20230418233656.869055-2-chris.packham@alliedtelesis.co.nz Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck commit 19692f17cd133ba2305e1f5c6484e623ec1ac7d0 Author: Aleksa Savic Date: Sun Apr 16 20:17:01 2023 +0200 hwmon: (aquacomputer_d5next) Add support for Aquacomputer Aquastream XT Extend aquacomputer_d5next driver to expose various hardware sensors of the Aquacomputer Aquastream XT watercooling pump, which communicates through a proprietary USB HID protocol. Implemented by Leonard Anderweit [1] [2]. Coolant temp, fan IC and external temp sensor readings are available, along with speed and voltage of both the pump and optionally connected fan. It also exposes pump current. Additionally, serial number and firmware version are exposed through debugfs. [1] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/pull/46 [2] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/pull/49 Originally-from: Leonard Anderweit Signed-off-by: Aleksa Savic Link: https://lore.kernel.org/r/20230416181702.9892-1-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck commit 0be100771711b99ab561ee3121657329a11e173a Author: Frank Crawford Date: Sun Apr 16 14:25:10 2023 +1000 hwmon: (it87) Disable/enable SMBus access for IT8622E chipset Configure the IT8622E chip to disable/re-enable access via an SMBus when reading or writing the chip's registers. Signed-off-by: Frank Crawford Signed-off-by: Guenter Roeck commit 376e1a937b3056802f3ad86811ec92ee3f49d560 Author: Frank Crawford Date: Sun Apr 16 14:25:09 2023 +1000 hwmon: (it87) Add calls to smbus_enable/smbus_disable as required Disable/re-enable access through SMBus for chip registers when they are are being read or written. For simple cases this is done at the same time as when a mutex is set, however, within loops or during initialisation it is done separately. Signed-off-by: Frank Crawford [groeck: Fixed multi-line alignment] Signed-off-by: Guenter Roeck commit 0282ba4a4fe6c8e6c0ffecfcdf214fa7f6452dc4 Author: Frank Crawford Date: Sun Apr 16 14:25:08 2023 +1000 hwmon: (it87) Test for error in it87_update_device Handle errors from it87_update_device(), which currently only occurs if SMBus access locking fails. Signed-off-by: Frank Crawford [groeck: Fixed handling in show_temp_type()] Signed-off-by: Guenter Roeck commit 1c5e9170ad93d3bd62a7ed8380e60b62c88b90a8 Author: Rob Herring Date: Mon Apr 10 18:27:35 2023 -0500 bus: tegra-gmi: Replace of_platform.h with explicit includes Tegra-gmi doesn't use anything from of_platform.h, but depends on of.h, of_device.h, and platform_device.h which are all implicitly included, but that is going to be removed soon. Link: https://lore.kernel.org/r/20230410232735.1562296-1-robh@kernel.org Signed-off-by: Rob Herring commit 3714c8d480964ca449bbe881f70b31f1bf7b428a Author: Rob Herring Date: Fri Mar 10 08:47:06 2023 -0600 hte: Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Acked-by: Dipen Patel Link: https://lore.kernel.org/r/20230310144706.1542365-1-robh@kernel.org Signed-off-by: Rob Herring commit 6da07bdda1a4da07a8f1b6316e331974d6b6eef8 Author: Rob Herring Date: Fri Mar 10 08:47:36 2023 -0600 w1: w1-gpio: Use of_property_read_bool() for boolean properties It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. Convert reading boolean properties to to of_property_read_bool(). Link: https://lore.kernel.org/r/20230310144737.1547200-1-robh@kernel.org Signed-off-by: Rob Herring commit 10ce6b701c21e4951ded058e06508d0f68a908df Author: Rob Herring Date: Fri Mar 10 08:47:31 2023 -0600 virt: fsl: Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Link: https://lore.kernel.org/r/20230310144731.1546259-1-robh@kernel.org Signed-off-by: Rob Herring commit 83f32497890c8f3e5d2337bc4f353442641b6750 Author: Rob Herring Date: Fri Mar 10 08:47:23 2023 -0600 soc: fsl: Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Link: https://lore.kernel.org/r/20230310144723.1545069-1-robh@kernel.org Signed-off-by: Rob Herring commit c763a0833fd451a7bbe207be843caf1666f46612 Author: Rob Herring Date: Fri Mar 10 08:47:22 2023 -0600 sbus: display7seg: Use of_property_read_bool() for boolean properties It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. Convert reading boolean properties to to of_property_read_bool(). Link: https://lore.kernel.org/r/20230310144723.1544930-1-robh@kernel.org Signed-off-by: Rob Herring commit 967ca91a996f82219f2883e9e53d8e20df49025a Author: Krishna Yarlagadda Date: Fri Apr 21 14:43:09 2023 +0530 spi: tegra210-quad: Enable TPM wait polling Trusted Platform Module requires flow control. As defined in TPM interface specification, client would drive MISO line at same cycle as last address bit on MOSI. Tegra234 and Tegra241 QSPI controllers have TPM wait state detection feature which is enabled for TPM client devices reported in SPI device mode bits. Signed-off-by: Krishna Yarlagadda Reviewed-by: Jon Hunter Reviewed-by: Jerry Snitselaar Link: https://lore.kernel.org/r/20230421091309.2672-4-kyarlagadda@nvidia.com Signed-off-by: Mark Brown commit 67a142dc9eb96a5cc018e5db62390665eb5f038c Author: Krishna Yarlagadda Date: Fri Apr 21 14:43:07 2023 +0530 spi: Add TPM HW flow flag TPM specification [1] defines flow control over SPI. Client device can insert a wait state on MISO when address is transmitted by controller on MOSI. Detecting the wait state in software is only possible for full duplex controllers. For controllers that support only half- duplex, the wait state detection needs to be implemented in hardware. Add a flag SPI_TPM_HW_FLOW for TPM device to set when software flow control is not possible and hardware flow control is expected from SPI controller. Reference: [1] https://trustedcomputinggroup.org/resource/pc-client-platform-tpm -profile-ptp-specification/ Signed-off-by: Krishna Yarlagadda Reviewed-by: Jerry Snitselaar Link: https://lore.kernel.org/r/20230421091309.2672-2-kyarlagadda@nvidia.com Signed-off-by: Mark Brown commit f7abf14f0001a5a47539d9f60bbdca649e43536b Author: Thomas Gleixner Date: Mon Apr 17 15:37:55 2023 +0200 posix-cpu-timers: Implement the missing timer_wait_running callback For some unknown reason the introduction of the timer_wait_running callback missed to fixup posix CPU timers, which went unnoticed for almost four years. Marco reported recently that the WARN_ON() in timer_wait_running() triggers with a posix CPU timer test case. Posix CPU timers have two execution models for expiring timers depending on CONFIG_POSIX_CPU_TIMERS_TASK_WORK: 1) If not enabled, the expiry happens in hard interrupt context so spin waiting on the remote CPU is reasonably time bound. Implement an empty stub function for that case. 2) If enabled, the expiry happens in task work before returning to user space or guest mode. The expired timers are marked as firing and moved from the timer queue to a local list head with sighand lock held. Once the timers are moved, sighand lock is dropped and the expiry happens in fully preemptible context. That means the expiring task can be scheduled out, migrated, interrupted etc. So spin waiting on it is more than suboptimal. The timer wheel has a timer_wait_running() mechanism for RT, which uses a per CPU timer-base expiry lock which is held by the expiry code and the task waiting for the timer function to complete blocks on that lock. This does not work in the same way for posix CPU timers as there is no timer base and expiry for process wide timers can run on any task belonging to that process, but the concept of waiting on an expiry lock can be used too in a slightly different way: - Add a mutex to struct posix_cputimers_work. This struct is per task and used to schedule the expiry task work from the timer interrupt. - Add a task_struct pointer to struct cpu_timer which is used to store a the task which runs the expiry. That's filled in when the task moves the expired timers to the local expiry list. That's not affecting the size of the k_itimer union as there are bigger union members already - Let the task take the expiry mutex around the expiry function - Let the waiter acquire a task reference with rcu_read_lock() held and block on the expiry mutex This avoids spin-waiting on a task which might not even be on a CPU and works nicely for RT too. Fixes: ec8f954a40da ("posix-timers: Use a callback for cancel synchronization on PREEMPT_RT") Reported-by: Marco Elver Signed-off-by: Thomas Gleixner Tested-by: Marco Elver Tested-by: Sebastian Andrzej Siewior Reviewed-by: Frederic Weisbecker Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87zg764ojw.ffs@tglx commit 2ff1b0839ddd514be4752c64c1c6facf91ff3a56 Merge: 275232c0b4064 0989ffb31cff7 Author: Marc Zyngier Date: Fri Apr 21 14:05:31 2023 +0100 Merge branch irq/misc-6.4 into irq/irqchip-next * irq/misc-6.4: : . : Misc irqchip changes for 6.4: : : - Replace uses of of_find_property() with the more : appropriate of_property_read_bool() : : - Make bcm-6345-l1 request its MMIO region : : - Add suspend support to the SiFive PLIC : : - Drop support for stih415, stih416 and stid127 platforms : . irqchip/st: Remove stih415/stih416 and stid127 platforms support irqchip/irq-sifive-plic: Add syscore callbacks for hibernation irqchip: Use of_property_read_bool() for boolean properties irqchip/bcm-6345-l1: Request memory region Signed-off-by: Marc Zyngier commit 275232c0b4064b85fd48532dff1a9b2764d67617 Merge: e7b5771aa0874 48ce2d722f7f1 Author: Marc Zyngier Date: Fri Apr 21 14:05:25 2023 +0100 Merge branch irq/loongarch-fixes-6.4 into irq/irqchip-next * irq/loongarch-fixes-6.4: : . : More Loongarch fixes from Lianmin Lv, fixing issues : in the so called "dual-bridge" systems. : . irqchip/loongson-pch-pic: Fix pch_pic_acpi_init calling irqchip/loongson-pch-pic: Fix registration of syscore_ops irqchip/loongson-eiointc: Fix registration of syscore_ops irqchip/loongson-eiointc: Fix incorrect use of acpi_get_vec_parent irqchip/loongson-eiointc: Fix returned value on parsing MADT Signed-off-by: Marc Zyngier commit e7b5771aa08746c13bb03ebe0a5053df1498c328 Merge: f39157b3c0bb4 f8415f2def181 Author: Marc Zyngier Date: Fri Apr 21 14:05:17 2023 +0100 Merge branch irq/riscv-ipi into irq/irqchip-next * irq/riscv-ipi: : . : RISC-V IPI rework from Anup Patel: : : "This series aims to improve IPI support in Linux RISC-V in following ways: : 1) Treat IPIs as normal per-CPU interrupts instead of having custom RISC-V : specific hooks. This also makes Linux RISC-V IPI support aligned with : other architectures. : 2) Remote TLB flushes and icache flushes should prefer local IPIs instead : of SBI calls whenever we have specialized hardware (such as RISC-V AIA : IMSIC and RISC-V SWI) which allows S-mode software to directly inject : IPIs without any assistance from M-mode runtime firmware." : . irqchip/riscv-intc: Add empty irq_eoi() for chained irq handlers RISC-V: Use IPIs for remote icache flush when possible RISC-V: Use IPIs for remote TLB flush when possible RISC-V: Allow marking IPIs as suitable for remote FENCEs RISC-V: Treat IPIs as normal Linux IRQs irqchip/riscv-intc: Allow drivers to directly discover INTC hwnode RISC-V: Clear SIP bit only when using SBI IPI operations Signed-off-by: Marc Zyngier commit f39157b3c0bb4afdcaea7809b3669de8e0495ed5 Merge: 197b6b60ae7bc a8707f5538846 Author: Marc Zyngier Date: Fri Apr 21 14:05:08 2023 +0100 Merge branch irq/gic-6.4 into irq/irqchip-next * irq/gic-6.4: : . : Collection of GIC/GICv3 fixes and cleanups : : - Workaround for the nvidia T241 chip that gets confused : in 3 and 4 socket configurations, leading to the GIC : malfunctionning in some contexts : : - Drop support for non-firmware driven GIC configurarations : now that the old ARM11MP Cavium board is gone : : - Workaround for the Rockchip 3588 chip that doesn't : correctly deal with the shareability attributes. : . irqchip/gic-v3: Add Rockchip 3588001 erratum workaround irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 irqchip/gic: Drop support for board files Signed-off-by: Marc Zyngier commit aaa2f14e6f3f34de8edfb13566110a0fe0d88785 Author: Mark Brown Date: Tue Mar 7 17:37:16 2023 +0000 KVM: arm64: Clarify host SME state management Normally when running a guest we do not touch the floating point register state until first use of floating point by the guest, saving the current state and loading the guest state at that point. This has been found to offer a performance benefit in common cases. However currently if SME is active when switching to a guest then we exit streaming mode, disable ZA and invalidate the floating point register state prior to starting the guest. The exit from streaming mode is required for correct guest operation, if we leave streaming mode enabled then many non-SME operations can generate SME traps (eg, SVE operations will become streaming SVE operations). If EL1 leaves CPACR_EL1.SMEN disabled then the host is unable to intercept these traps. This will mean that a SME unaware guest will see SME exceptions which will confuse it. Disabling streaming mode also avoids creating spurious indications of usage of the SME hardware which could impact system performance, especially with shared SME implementations. Document the requirement to exit streaming mode clearly. There is no issue with guest operation caused by PSTATE.ZA so we can defer handling for that until first floating point usage, do so if the register state is not that of the current task and hence has already been saved. We could also do this for the case where the register state is that for the current task however this is very unlikely to happen and would require disproportionate effort so continue to save the state in that case. Saving this state on first use would require that we map and unmap storage for the host version of these registers for use by the hypervisor, taking care to deal with protected KVM and the fact that the host can free or reallocate the backing storage. Given that the strong recommendation is that applications should only keep PSTATE.ZA enabled when the state it enables is in active use it is difficult to see a case where a VMM would wish to do this, it would need to not only be using SME but also running the guest in the middle of SME usage. This can be revisited in the future if a use case does arises, in the interim such tasks will work but experience a performance overhead. This brings our handling of SME more into line with our handling of other floating point state and documents more clearly the constraints we have, especially around streaming mode. Signed-off-by: Mark Brown Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20221214-kvm-arm64-sme-context-switch-v2-3-57ba0082e9ff@kernel.org commit d071cefdcca39fdbcdd4bf36868448820dbac34b Author: Mark Brown Date: Tue Mar 7 17:37:15 2023 +0000 KVM: arm64: Restructure check for SVE support in FP trap handler We share the same handler for general floating point and SVE traps with a check to make sure we don't handle any SVE traps if the system doesn't have SVE support. Since we will be adding SME support and wishing to handle that along with other FP related traps rewrite the check to be more scalable and a bit clearer too, ensuring we don't misidentify SME traps as SVE ones. Signed-off-by: Mark Brown Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20221214-kvm-arm64-sme-context-switch-v2-2-57ba0082e9ff@kernel.org commit 4c181e3d352e9280c84fb4b4c7a8940ce005374e Author: Mark Brown Date: Tue Mar 7 17:37:14 2023 +0000 KVM: arm64: Document check for TIF_FOREIGN_FPSTATE In kvm_arch_vcpu_load_fp() we unconditionally set the current FP state to FP_STATE_HOST_OWNED, this will be overridden to FP_STATE_NONE if TIF_FOREIGN_FPSTATE is set but the check is deferred until kvm_arch_vcpu_ctxflush_fp() where we are no longer preemptable. Add a comment to this effect to help avoid people being concerned about the lack of a check and discover where the check is done. Signed-off-by: Mark Brown Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20221214-kvm-arm64-sme-context-switch-v2-1-57ba0082e9ff@kernel.org commit 3d1793562858f2bc42cc722fe00ec9b2ff0618e1 Author: Jingyu Wang Date: Thu Mar 9 15:59:19 2023 +0800 KVM: arm64: Fix repeated words in comments Delete the redundant word 'to'. Signed-off-by: Jingyu Wang Reviewed-by: Mukesh Ojha Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230309075919.169518-1-jingyuwang_vip@163.com commit 25f0617109496e1aff49594fbae5644286447a0f Author: Dhruva Gole Date: Thu Apr 20 17:46:15 2023 +0530 spi: bcm63xx: remove PM_SLEEP based conditional compilation Get rid of conditional compilation based on CONFIG_PM_SLEEP because it may introduce build issues with certain configs where it maybe disabled This is because if above config is not enabled the suspend-resume functions are never part of the code but the bcm63xx_spi_pm_ops struct still inits them to non-existent suspend-resume functions. Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") Signed-off-by: Dhruva Gole Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com Signed-off-by: Mark Brown commit dc801ea8ae37d54706e6f1cef140731ac5981c9c Author: Kuninori Morimoto Date: Fri Apr 21 00:11:31 2023 +0000 ASoC: fsl: imx-audmix: remove dummy dai_link->platform Dummy dai_link->platform is not needed. Signed-off-by: Kuninori Morimoto Acked-by: Shengjiu Wang Tested-by: Shengjiu Wang Link: https://lore.kernel.org/r/877cu6f619.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3ce08f85133fc93278801aba3efb4548d3ef3ca0 Author: Kuninori Morimoto Date: Fri Apr 21 00:11:21 2023 +0000 ASoC: fsl: imx-audmix: cleanup platform which is using Generic DMA If CPU is using soc-generic-dmaengine-pcm, Platform Component will be same as CPU Component. In this case, we can use CPU dlc for Platform dlc. This patch shares CPU dlc with Platform, and add comment. Signed-off-by: Kuninori Morimoto Acked-by: Shengjiu Wang Tested-by: Shengjiu Wang Link: https://lore.kernel.org/r/878remf61j.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2324bc107b0b3d2de351f35032dc5093cbb61493 Author: Kuninori Morimoto Date: Fri Apr 21 00:11:07 2023 +0000 ASoC: fsl: imx-spdif: cleanup platform which is using Generic DMA If CPU is using soc-generic-dmaengine-pcm, Platform Component will be same as CPU Component. In this case, we can use CPU dlc for Platform dlc. This patch shares CPU dlc with Platform, and add comment. Signed-off-by: Kuninori Morimoto Acked-by: Shengjiu Wang Tested-by: Shengjiu Wang Link: https://lore.kernel.org/r/87a5z2f61w.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d6e28695dcb6f653c7f2adf38021a5e934a6f416 Author: Kuninori Morimoto Date: Fri Apr 21 00:10:56 2023 +0000 ASoC: fsl: imx-es8328: cleanup platform which is using Generic DMA If CPU is using soc-generic-dmaengine-pcm, Platform Component will be same as CPU Component. In this case, we can use CPU dlc for Platform dlc. This patch shares CPU dlc with Platform, and add comment. Signed-off-by: Kuninori Morimoto Acked-by: Shengjiu Wang Tested-by: Shengjiu Wang Link: https://lore.kernel.org/r/87bkjif628.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2f4d58f7635aec014428e73ef6120c4d0377c430 Author: Anup Patel Date: Wed Jan 11 11:26:10 2023 +0530 RISC-V: KVM: Virtualize per-HART AIA CSRs The AIA specification introduce per-HART AIA CSRs which primarily support: * 64 local interrupts on both RV64 and RV32 * priority for each of the 64 local interrupts * interrupt filtering for local interrupts This patch virtualize above mentioned AIA CSRs and also extend ONE_REG interface to allow user-space save/restore Guest/VM view of these CSRs. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit 1b617bc93178912fa36f87a957c15d1f1708c299 Author: Pierre Asselin Date: Wed Apr 19 00:48:34 2023 -0400 firmware/sysfb: Fix VESA format selection Some legacy BIOSes report no reserved bits in their 32-bit rgb mode, breaking the calculation of bits_per_pixel in commit f35cd3fa7729 ("firmware/sysfb: Fix EFI/VESA format selection"). However they report lfb_depth correctly for those modes. Keep the computation but set bits_per_pixel to lfb_depth if the latter is larger. v2 fixes the warnings from a max3() macro with arguments of different types; split the bits_per_pixel assignment to avoid uglyfing the code with too many typecasts. v3 fixes space and formatting blips pointed out by Javier, and change the bit_per_pixel assignment back to a single statement using two casts. v4 go back to v2 and use max_t() Signed-off-by: Pierre Asselin Fixes: f35cd3fa7729 ("firmware/sysfb: Fix EFI/VESA format selection") Link: https://lore.kernel.org/r/4Psm6B6Lqkz1QXM@panix3.panix.com Link: https://lore.kernel.org/r/20230412150225.3757223-1-javierm@redhat.com Tested-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230419044834.10816-1-pa@panix.com commit 6b1e8ba4bac49d99232026cae7eb8db3d338f9c2 Author: Anup Patel Date: Tue Apr 4 11:55:55 2023 +0530 RISC-V: KVM: Use bitmap for irqs_pending and irqs_pending_mask To support 64 VCPU local interrupts on RV32 host, we should use bitmap for irqs_pending and irqs_pending_mask in struct kvm_vcpu_arch. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit 78f94c082a2f74b78c8b9c779756d8b25317a55a Author: Anup Patel Date: Fri Mar 31 20:06:18 2023 +0530 RISC-V: KVM: Add ONE_REG interface for AIA CSRs We implement ONE_REG interface for AIA CSRs as a separate subtype under the CSR ONE_REG interface. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 7d50dd5012013f7c8e3c3e5d0bed78ba85800934 Author: Anup Patel Date: Fri Mar 31 19:56:56 2023 +0530 RISC-V: KVM: Implement subtype for CSR ONE_REG interface To make the CSR ONE_REG interface extensible, we implement subtype for the CSR ONE_REG IDs. The existing CSR ONE_REG IDs are treated as subtype = 0 (aka General CSRs). Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 54e43320c2ba0c70258a3aea690da38c6ea3293c Author: Anup Patel Date: Tue Jan 10 16:44:25 2023 +0530 RISC-V: KVM: Initial skeletal support for AIA To incrementally implement AIA support, we first add minimal skeletal support which only compiles and detects AIA hardware support at the boot-time but does not provide any functionality. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit e290dbb7f73670e06df7f8ec44c3f502c20707d7 Author: Anup Patel Date: Mon Jan 9 11:55:55 2023 +0530 RISC-V: KVM: Drop the _MASK suffix from hgatp.VMID mask defines The hgatp.VMID mask defines are used before shifting when extracting VMID value from hgatp CSR value so based on the convention followed in the other parts of asm/csr.h, the hgatp.VMID mask defines should not have a _MASK suffix. While we are here, let's use GENMASK() for hgatp.VMID and hgatp.PPN. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 8fe6f7e14c7eeb01c3a1994eba2356400981cb1e Author: Anup Patel Date: Mon Mar 6 12:10:15 2023 +0530 RISC-V: Detect AIA CSRs from ISA string We have two extension names for AIA ISA support: Smaia (M-mode AIA CSRs) and Ssaia (S-mode AIA CSRs). We extend the ISA string parsing to detect Smaia and Ssaia extensions. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Palmer Dabbelt commit d6f5f6e904be628941eeab7d6ae7d1fb9190c486 Author: Anup Patel Date: Tue Jan 18 11:12:40 2022 +0530 RISC-V: Add AIA related CSR defines The RISC-V AIA specification improves handling per-HART local interrupts in a backward compatible manner. This patch adds defines for new RISC-V AIA CSRs. Signed-off-by: Anup Patel Reviewed-by: Conor Dooley Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Signed-off-by: Anup Patel Acked-by: Palmer Dabbelt commit 90deec51d726b4d829ca7a684595154bebdf8353 Author: Anup Patel Date: Sat Apr 1 15:21:34 2023 +0530 RISC-V: KVM: Allow Zbb extension for Guest/VM We extend the KVM ISA extension ONE_REG interface to allow KVM user space to detect and enable Zbb extension for Guest/VM. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit 96b3d4bd93f913440b4cb06233a1ecbc4dd41dad Author: Anup Patel Date: Mon Nov 28 11:43:16 2022 +0530 RISC-V: KVM: Add ONE_REG interface to enable/disable SBI extensions We add ONE_REG interface to enable/disable SBI extensions (just like the ONE_REG interface for ISA extensions). This allows KVM user-space to decide the set of SBI extension enabled for a Guest and by default all SBI extensions are enabled. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Signed-off-by: Anup Patel commit c69daf8bf88c09271a55c65140c8af8fcd565c09 Author: Andrew Jones Date: Wed Mar 22 20:28:57 2023 +0100 RISC-V: KVM: Alphabetize selects While alphabetized lists tend to become unalphabetized almost as quickly as they get fixed up, it is preferred to keep select lists in Kconfigs in order. Let's fix KVM's up. Signed-off-by: Andrew Jones Reviewed-by: Anup Patel Signed-off-by: Anup Patel commit 2ed90cb0938a45b12eb947af062d12c7af0067b3 Author: David Matlack Date: Fri Mar 17 14:11:06 2023 -0700 KVM: RISC-V: Retry fault if vma_lookup() results become invalid Read mmu_invalidate_seq before dropping the mmap_lock so that KVM can detect if the results of vma_lookup() (e.g. vma_shift) become stale before it acquires kvm->mmu_lock. This fixes a theoretical bug where a VMA could be changed by userspace after vma_lookup() and before KVM reads the mmu_invalidate_seq, causing KVM to install page table entries based on a (possibly) no-longer-valid vma_shift. Re-order the MMU cache top-up to earlier in user_mem_abort() so that it is not done after KVM has read mmu_invalidate_seq (i.e. so as to avoid inducing spurious fault retries). It's unlikely that any sane userspace currently modifies VMAs in such a way as to trigger this race. And even with directed testing I was unable to reproduce it. But a sufficiently motivated host userspace might be able to exploit this race. Note KVM/ARM had the same bug and was fixed in a separate, near identical patch (see Link). Link: https://lore.kernel.org/kvm/20230313235454.2964067-1-dmatlack@google.com/ Fixes: 9955371cc014 ("RISC-V: KVM: Implement MMU notifiers") Cc: stable@vger.kernel.org Signed-off-by: David Matlack Tested-by: Anup Patel Signed-off-by: Anup Patel commit 743767d6f6b8f28228be181fe369657f7ecd1eb2 Author: Stephane Eranian Date: Wed Apr 19 14:42:41 2023 -0700 perf/x86/intel/uncore: Add events for Intel SPR IMC PMU Add missing clockticks and cas_count_* events for Intel SapphireRapids IMC PMU. These events are useful to measure memory bandwidth. Signed-off-by: Stephane Eranian Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20230419214241.2310385-1-eranian@google.com commit f31dcb152a3d0816e2f1deab4e64572336da197d Author: Aaron Thompson Date: Thu Apr 13 17:50:12 2023 +0000 sched/clock: Fix local_clock() before sched_clock_init() Have local_clock() return sched_clock() if sched_clock_init() has not yet run. sched_clock_cpu() has this check but it was not included in the new noinstr implementation of local_clock(). The effect can be seen on x86 with CONFIG_PRINTK_TIME enabled, for instance. scd->clock quickly reaches the value of TICK_NSEC and that value is returned until sched_clock_init() runs. dmesg without this patch: [ 0.000000] kvm-clock: ... [ 0.000002] kvm-clock: ... [ 0.000672] clocksource: ... [ 0.001000] tsc: ... [ 0.001000] e820: ... [ 0.001000] e820: ... ... [ 0.001000] ..TIMER: ... [ 0.001000] clocksource: ... [ 0.378956] Calibrating delay loop ... [ 0.379955] pid_max: ... dmesg with this patch: [ 0.000000] kvm-clock: ... [ 0.000001] kvm-clock: ... [ 0.000675] clocksource: ... [ 0.002685] tsc: ... [ 0.003331] e820: ... [ 0.004190] e820: ... ... [ 0.421939] ..TIMER: ... [ 0.422842] clocksource: ... [ 0.424582] Calibrating delay loop ... [ 0.425580] pid_max: ... Fixes: 776f22913b8e ("sched/clock: Make local_clock() noinstr") Signed-off-by: Aaron Thompson Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230413175012.2201-1-dev@aaront.org commit feffe5bb274dd3442080ef0e4053746091878799 Author: Schspa Shi Date: Mon Aug 29 01:03:02 2022 +0800 sched/rt: Fix bad task migration for rt tasks Commit 95158a89dd50 ("sched,rt: Use the full cpumask for balancing") allows find_lock_lowest_rq() to pick a task with migration disabled. The purpose of the commit is to push the current running task on the CPU that has the migrate_disable() task away. However, there is a race which allows a migrate_disable() task to be migrated. Consider: CPU0 CPU1 push_rt_task check is_migration_disabled(next_task) task not running and migration_disabled == 0 find_lock_lowest_rq(next_task, rq); _double_lock_balance(this_rq, busiest); raw_spin_rq_unlock(this_rq); double_rq_lock(this_rq, busiest); <> task become running migrate_disable(); deactivate_task(rq, next_task, 0); set_task_cpu(next_task, lowest_rq->cpu); WARN_ON_ONCE(is_migration_disabled(p)); Fixes: 95158a89dd50 ("sched,rt: Use the full cpumask for balancing") Signed-off-by: Schspa Shi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Steven Rostedt (Google) Reviewed-by: Dietmar Eggemann Reviewed-by: Valentin Schneider Tested-by: Dwaine Gonyier commit 223baf9d17f25e2608dbdff7232c095c1e612268 Author: Mathieu Desnoyers Date: Thu Apr 20 10:55:48 2023 -0400 sched: Fix performance regression introduced by mm_cid Introduce per-mm/cpu current concurrency id (mm_cid) to fix a PostgreSQL sysbench regression reported by Aaron Lu. Keep track of the currently allocated mm_cid for each mm/cpu rather than freeing them immediately on context switch. This eliminates most atomic operations when context switching back and forth between threads belonging to different memory spaces in multi-threaded scenarios (many processes, each with many threads). The per-mm/per-cpu mm_cid values are serialized by their respective runqueue locks. Thread migration is handled by introducing invocation to sched_mm_cid_migrate_to() (with destination runqueue lock held) in activate_task() for migrating tasks. If the destination cpu's mm_cid is unset, and if the source runqueue is not actively using its mm_cid, then the source cpu's mm_cid is moved to the destination cpu on migration. Introduce a task-work executed periodically, similarly to NUMA work, which delays reclaim of cid values when they are unused for a period of time. Keep track of the allocation time for each per-cpu cid, and let the task work clear them when they are observed to be older than SCHED_MM_CID_PERIOD_NS and unused. This task work also clears all mm_cids which are greater or equal to the Hamming weight of the mm cidmask to keep concurrency ids compact. Because we want to ensure the mm_cid converges towards the smaller values as migrations happen, the prior optimization that was done when context switching between threads belonging to the same mm is removed, because it could delay the lazy release of the destination runqueue mm_cid after it has been replaced by a migration. Removing this prior optimization is not an issue performance-wise because the introduced per-mm/per-cpu mm_cid tracking also covers this more specific case. Fixes: af7f588d8f73 ("sched: Introduce per-memory-map concurrency ID") Reported-by: Aaron Lu Signed-off-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Tested-by: Aaron Lu Link: https://lore.kernel.org/lkml/20230327080502.GA570847@ziqianlu-desk2/ commit 5a4d3b38ed0cd5bbb03eccea6d9949136abc45c3 Merge: 9b8e17813aecc 6a8f57ae2eb07 Author: Peter Zijlstra Date: Fri Apr 21 13:24:18 2023 +0200 Merge branch 'v6.3-rc7' Sync with the urgent patches; in particular: a53ce18cacb4 ("sched/fair: Sanitize vruntime of entity being migrated") Signed-off-by: Peter Zijlstra commit dfc39d4026fb2432363c0f77543c4cf3adca4c7b Author: Jianfeng Tan Date: Wed Apr 19 15:24:16 2023 +0800 net/packet: support mergeable feature of virtio Packet sockets, like tap, can be used as the backend for kernel vhost. In packet sockets, virtio net header size is currently hardcoded to be the size of struct virtio_net_hdr, which is 10 bytes; however, it is not always the case: some virtio features, such as mrg_rxbuf, need virtio net header to be 12-byte long. Mergeable buffers, as a virtio feature, is worthy of supporting: packets that are larger than one-mbuf size will be dropped in vhost worker's handle_rx if mrg_rxbuf feature is not used, but large packets cannot be avoided and increasing mbuf's size is not economical. With this virtio feature enabled by virtio-user, packet sockets with hardcoded 10-byte virtio net header will parse mac head incorrectly in packet_snd by taking the last two bytes of virtio net header as part of mac header. This incorrect mac header parsing will cause packet to be dropped due to invalid ether head checking in later under-layer device packet receiving. By adding extra field vnet_hdr_sz with utilizing holes in struct packet_sock to record currently used virtio net header size and supporting extra sockopt PACKET_VNET_HDR_SZ to set specified vnet_hdr_sz, packet sockets can know the exact length of virtio net header that virtio user gives. In packet_snd, tpacket_snd and packet_recvmsg, instead of using hardcoded virtio net header size, it can get the exact vnet_hdr_sz from corresponding packet_sock, and parse mac header correctly based on this information to avoid the packets being mistakenly dropped. Signed-off-by: Jianfeng Tan Co-developed-by: Anqi Shen Signed-off-by: Anqi Shen Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 156c93986d940e0c55a9aec8b77387f7bb4eb790 Merge: 35226750f7ab9 45fd01f2fbf11 Author: David S. Miller Date: Fri Apr 21 11:49:47 2023 +0100 Merge branch 'mlx5-ipsec-fixes' Leon Romanovsky says: ==================== Fixes to mlx5 IPsec implementation This small patchset includes various fixes and one refactoring patch which I collected for the features sent in this cycle, with one exception - first patch. First patch fixes code which was introduced in previous cycle, however I was able to trigger FW error only in custom debug code, so don't see a need to send it to net-rc. ==================== Signed-off-by: David S. Miller commit 45fd01f2fbf1119d083931b095ad6d0f13443d0e Author: Leon Romanovsky Date: Thu Apr 20 11:02:51 2023 +0300 net/mlx5e: Refactor duplicated code in mlx5e_ipsec_init_macs ARP discovery code has same logic for RX and TX flows, but with different source and destination fields. Instead of duplicating same code in mlx5e_ipsec_init_macs, let's refactor. Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 94edec448479e302b7c7e18f40cb0d7f32e71682 Author: Leon Romanovsky Date: Thu Apr 20 11:02:50 2023 +0300 net/mlx5e: Properly release work data structure There are some flows in which work structure is not allocated at all and it is needed to be checked prior release of data structure. general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] CPU: 6 PID: 3486 Comm: kworker/6:0 Not tainted 6.3.0-rc5_for_upstream_debug_2023_04_06_11_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: events xfrm_state_gc_task RIP: 0010:mlx5e_xfrm_free_state+0x177/0x260 [mlx5_core] Code: c1 ea 03 80 3c 02 00 0f 85 f5 00 00 00 4c 8b a5 08 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b7 00 00 00 49 8b 7c 24 50 e8 85 7c 09 e0 4c 89 RSP: 0018:ffff888137a8fc50 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff888180398000 RCX: 0000000000000000 RDX: 000000000000000a RSI: ffffffffa1878227 RDI: 0000000000000050 RBP: ffff88812a0c8000 R08: ffff888137a8fb60 R09: 0000000000000000 R10: fffffbfff09aba0c R11: 0000000000000001 R12: 0000000000000000 R13: ffff88812a0c8108 R14: ffffffff84c63480 R15: ffff8881acb63118 FS: 0000000000000000(0000) GS:ffff88881eb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f667e8bc000 CR3: 0000000004693006 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ___xfrm_state_destroy+0x3c8/0x5e0 xfrm_state_gc_task+0xf6/0x140 ? ___xfrm_state_destroy+0x5e0/0x5e0 process_one_work+0x7c2/0x1340 ? lockdep_hardirqs_on_prepare+0x3f0/0x3f0 ? pwq_dec_nr_in_flight+0x230/0x230 ? spin_bug+0x1d0/0x1d0 worker_thread+0x59d/0xec0 ? __kthread_parkme+0xd9/0x1d0 ? process_one_work+0x1340/0x1340 kthread+0x28f/0x330 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Modules linked in: sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_umad ib_ipoib ib_cm ib_uverbs ib_core vfio_pci vfio_pci_core vfio_iommu_type1 vfio cuse overlay zram zsmalloc fuse [last unloaded: mlx5_core] ---[ end trace 0000000000000000 ]--- Fixes: 4562116f8a56 ("net/mlx5e: Generalize IPsec work structs") Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 3198ae7d42af844a7d30f6e432c079c134b03852 Author: Leon Romanovsky Date: Thu Apr 20 11:02:49 2023 +0300 net/mlx5e: Compare all fields in IPv6 address Fix size argument in memcmp to compare whole IPv6 address. Fixes: b3beba1fb404 ("net/mlx5e: Allow policies with reqid 0, to support IKE policy holes") Reviewed-by: Raed Salem Reviewed-by: Emeel Hakim Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 697b3518ebfd1d0ccae455d8ac1ac9c88884f4e5 Author: Leon Romanovsky Date: Thu Apr 20 11:02:48 2023 +0300 net/mlx5e: Don't overwrite extack message returned from IPsec SA validator Addition of new err_xfrm label caused to error messages be overwritten. Fix it by using proper NL_SET_ERR_MSG_WEAK_MOD macro together with change in a default message. Fixes: aa8bd0c9518c ("net/mlx5e: Support IPsec acquire default SA") Reviewed-by: Raed Salem Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit e239e31ae8026b85e225941eb3f2cd7deb24f0d1 Author: Leon Romanovsky Date: Thu Apr 20 11:02:47 2023 +0300 net/mlx5e: Fix FW error while setting IPsec policy block action When trying to set IPsec policy block action the following error is generated: mlx5_cmd_out_err:803:(pid 3426): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x8708c3), err(-22) This error means that drop action is not allowed when modify action is set, so update the code to skip modify header for XFRM_POLICY_BLOCK action. Fixes: 6721239672fe ("net/mlx5e: Skip IPsec encryption for TX path without matching policy") Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 35226750f7ab9d49140d95bc7d38a2a9b0f4fdfc Author: Yan Wang Date: Wed Apr 19 22:13:46 2023 +0800 net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA ports The system hang because of dsa_tag_8021q_port_setup()-> stmmac_vlan_rx_add_vid(). I found in stmmac_drv_probe() that cailing pm_runtime_put() disabled the clock. First, when the kernel is compiled with CONFIG_PM=y,The stmmac's resume/suspend is active. Secondly,stmmac as DSA master,the dsa_tag_8021q_port_setup() function will callback stmmac_vlan_rx_add_vid when DSA dirver starts. However, The system is hanged for the stmmac_vlan_rx_add_vid() accesses its registers after stmmac's clock is closed. I would suggest adding the pm_runtime_resume_and_get() to the stmmac_vlan_rx_add_vid().This guarantees that resuming clock output while in use. Fixes: b3dcb3127786 ("net: stmmac: correct clocks enabled in stmmac_vlan_rx_kill_vid()") Reviewed-by: Jacob Keller Signed-off-by: Yan Wang Signed-off-by: David S. Miller commit 2d60eca501bc70fc73d30a1b151a137c3b990183 Author: Christophe JAILLET Date: Thu Apr 20 21:19:03 2023 +0200 sh: sq: Use the bitmap API when applicable Using the bitmap API is less verbose than hand writing it. It also improves the semantic. Signed-off-by: Christophe JAILLET Reviewed-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/a51e9f32c19a007f4922943282cb12c89064440d.1681671848.git.christophe.jaillet@wanadoo.fr Signed-off-by: John Paul Adrian Glaubitz commit 9f656705c5faa18afb26d922cfc64f9fd103c38d Author: Oswald Buddenhagen Date: Thu Apr 20 13:33:23 2023 +0200 ALSA: pcm: rewrite snd_pcm_playback_silence() The auto-silencer supports two modes: "thresholded" to fill up "just enough", and "top-up" to fill up "as much as possible". The two modes used rather distinct code paths, which this patch unifies. The only remaining distinction is how much we actually want to fill. This fixes a bug in thresholded mode, where we failed to use new_hw_ptr, resulting in under-fill. Top-up mode is now more well-behaved and much easier to understand in corner cases. This also updates comments in the proximity of silencing-related data structures. Signed-off-by: Oswald Buddenhagen Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230420113324.877164-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 1ea244158a4a20ac686f4d1d46285f3d38d4571f Author: Marc Zyngier Date: Fri Apr 21 10:18:34 2023 +0100 KVM: arm64: Constify start/end/phys fields of the pgtable walker data As we are revamping the way the pgtable walker evaluates some of the data, make it clear that we rely on somew of the fields to be constant across the lifetime of a walk. For this, flag the start, end and phys fields of the walk data as 'const', which will generate an error if we were to accidentally update these fields again. Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 39bc95be3782ba88e55cd72e830f37e74395831b Author: Oliver Upton Date: Fri Apr 21 07:16:06 2023 +0000 KVM: arm64: Infer PA offset from VA in hyp map walker Similar to the recently fixed stage-2 walker, the hyp map walker increments the PA and VA of a walk separately. Unlike stage-2, there is no bug here as the map walker has exclusive access to the stage-1 page tables. Nonetheless, in the interest of continuity throughout the page table code, tweak the hyp map walker to avoid incrementing the PA and instead use the VA as the authoritative source of how far along a table walk has gotten. Calculate the PA to use for a leaf PTE by adding the offset of the VA from the start of the walk to the starting PA. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230421071606.1603916-3-oliver.upton@linux.dev commit 1f0f4a2ef7a5693b135ce174e71f116db4bd684d Author: Oliver Upton Date: Fri Apr 21 07:16:05 2023 +0000 KVM: arm64: Infer the PA offset from IPA in stage-2 map walker Until now, the page table walker counted increments to the PA and IPA of a walk in two separate places. While the PA is incremented as soon as a leaf PTE is installed in stage2_map_walker_try_leaf(), the IPA is actually bumped in the generic table walker context. Critically, __kvm_pgtable_visit() rereads the PTE after the LEAF callback returns to work out if a table or leaf was installed, and only bumps the IPA for a leaf PTE. This arrangement worked fine when we handled faults behind the write lock, as the walker had exclusive access to the stage-2 page tables. However, commit 1577cb5823ce ("KVM: arm64: Handle stage-2 faults in parallel") started handling all stage-2 faults behind the read lock, opening up a race where a walker could increment the PA but not the IPA of a walk. Nothing good ensues, as the walker starts mapping with the incorrect IPA -> PA relationship. For example, assume that two vCPUs took a data abort on the same IPA. One observes that dirty logging is disabled, and the other observed that it is enabled: vCPU attempting PMD mapping vCPU attempting PTE mapping ====================================== ===================================== /* install PMD */ stage2_make_pte(ctx, leaf); data->phys += granule; /* replace PMD with a table */ stage2_try_break_pte(ctx, data->mmu); stage2_make_pte(ctx, table); /* table is observed */ ctx.old = READ_ONCE(*ptep); table = kvm_pte_table(ctx.old, level); /* * map walk continues w/o incrementing * IPA. */ __kvm_pgtable_walk(..., level + 1); Bring an end to the whole mess by using the IPA as the single source of truth for how far along a walk has gotten. Work out the correct PA to map by calculating the IPA offset from the beginning of the walk and add that to the starting physical address. Cc: stable@vger.kernel.org Fixes: 1577cb5823ce ("KVM: arm64: Handle stage-2 faults in parallel") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230421071606.1603916-2-oliver.upton@linux.dev commit b7badd752de05312fdb1aeb388480f706d0c087f Author: Hans Verkuil Date: Thu Apr 20 14:47:05 2023 +0200 pinctrl-bcm2835.c: fix race condition when setting gpio dir In the past setting the pin direction called pinctrl_gpio_direction() which uses a mutex to serialize this. That was changed to set the direction directly in the pin controller driver, but that lost the serialization mechanism. Since the direction of multiple pins are in the same register you can have a race condition, something that was in fact observed with the cec-gpio driver. Add a new spinlock to serialize writing to the FSEL registers. Signed-off-by: Hans Verkuil Fixes: 1a4541b68e25 ("pinctrl-bcm2835: don't call pinctrl_gpio_direction()") Link: https://lore.kernel.org/r/4302b66b-ca20-0f19-d2aa-ee8661118863@xs4all.nl Signed-off-by: Linus Walleij commit b19a1d8f1dbd2410eaa2f4a5f7680197e2647c94 Author: Rob Herring Date: Tue Apr 18 10:06:13 2023 -0500 dt-bindings: pinctrl: qcom,sm8150: Drop duplicate function value "atest_usb2" The enum value "atest_usb2" appears twice. Remove the duplicate. The meta-schema normally catches these, but schemas under "$defs" was not getting checked. A fix for that is pending. Signed-off-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230418150613.1528233-1-robh@kernel.org Signed-off-by: Linus Walleij commit 36fe1b29b3cae48f781011abd5a0b9e938f5b35f Merge: 6dcf7316e05ec bcf3e7da3ad3b Author: Marc Zyngier Date: Fri Apr 21 09:44:58 2023 +0100 Merge branch kvm-arm64/spec-ptw into kvmarm-master/next * kvm-arm64/spec-ptw: : . : On taking an exception from EL1&0 to EL2(&0), the page table walker is : allowed to carry on with speculative walks started from EL1&0 while : running at EL2 (see R_LFHQG). Given that the PTW may be actively using : the EL1&0 system registers, the only safe way to deal with it is to : issue a DSB before changing any of it. : : We already did the right thing for SPE and TRBE, but ignored the PTW : for unknown reasons (probably because the architecture wasn't crystal : clear at the time). : : This requires a bit of surgery in the nvhe code, though most of these : patches are comments so that my future self can understand the purpose : of these barriers. The VHE code is largely unaffected, thanks to the : DSB in the context switch. : . KVM: arm64: vhe: Drop extra isb() on guest exit KVM: arm64: vhe: Synchronise with page table walker on MMU update KVM: arm64: pkvm: Document the side effects of kvm_flush_dcache_to_poc() KVM: arm64: nvhe: Synchronise with page table walker on TLBI KVM: arm64: nvhe: Synchronise with page table walker on vcpu run Signed-off-by: Marc Zyngier commit 6dcf7316e05eccded11fc640813c8a8879f271a6 Merge: 367eb095b841a c5284f6d8ce2b Author: Marc Zyngier Date: Fri Apr 21 09:43:38 2023 +0100 Merge branch kvm-arm64/smccc-filtering into kvmarm-master/next * kvm-arm64/smccc-filtering: : . : SMCCC call filtering and forwarding to userspace, courtesy of : Oliver Upton. From the cover letter: : : "The Arm SMCCC is rather prescriptive in regards to the allocation of : SMCCC function ID ranges. Many of the hypercall ranges have an : associated specification from Arm (FF-A, PSCI, SDEI, etc.) with some : room for vendor-specific implementations. : : The ever-expanding SMCCC surface leaves a lot of work within KVM for : providing new features. Furthermore, KVM implements its own : vendor-specific ABI, with little room for other implementations (like : Hyper-V, for example). Rather than cramming it all into the kernel we : should provide a way for userspace to handle hypercalls." : . KVM: selftests: Fix spelling mistake "KVM_HYPERCAL_EXIT_SMC" -> "KVM_HYPERCALL_EXIT_SMC" KVM: arm64: Test that SMC64 arch calls are reserved KVM: arm64: Prevent userspace from handling SMC64 arch range KVM: arm64: Expose SMC/HVC width to userspace KVM: selftests: Add test for SMCCC filter KVM: selftests: Add a helper for SMCCC calls with SMC instruction KVM: arm64: Let errors from SMCCC emulation to reach userspace KVM: arm64: Return NOT_SUPPORTED to guest for unknown PSCI version KVM: arm64: Introduce support for userspace SMCCC filtering KVM: arm64: Add support for KVM_EXIT_HYPERCALL KVM: arm64: Use a maple tree to represent the SMCCC filter KVM: arm64: Refactor hvc filtering to support different actions KVM: arm64: Start handling SMCs from EL1 KVM: arm64: Rename SMC/HVC call handler to reflect reality KVM: arm64: Add vm fd device attribute accessors KVM: arm64: Add a helper to check if a VM has ran once KVM: x86: Redefine 'longmode' as a flag for KVM_EXIT_HYPERCALL Signed-off-by: Marc Zyngier commit 367eb095b841a1af8a4a1425021ac43159049dcd Merge: e2e321a7d663a 767cc0501bbb5 Author: Marc Zyngier Date: Fri Apr 21 09:39:07 2023 +0100 Merge branch kvm-arm64/selftest/misc-6.4 into kvmarm-master/next * kvm-arm64/selftest/misc-6.4: : . : Misc selftest updates for 6.4 : : - Add comments for recently added ID registers : . KVM: selftests: Comment newly defined aarch64 ID registers Signed-off-by: Marc Zyngier commit d59655d3c014fd08896b01a4602bbd8ee67db944 Author: Devi Priya Date: Mon Apr 17 11:43:37 2023 +0530 dt-bindings: pinctrl: qcom: Add few missing functions Added the missing functions cri_trng2, gpio and removed the duplicate entry qdss_tracedata_b Fixes: 5b63ccb69ee8 ("dt-bindings: pinctrl: qcom: Add support for IPQ9574") Acked-by: Krzysztof Kozlowski Signed-off-by: Devi Priya Link: https://lore.kernel.org/r/20230417061337.6552-1-quic_devipriy@quicinc.com Signed-off-by: Linus Walleij commit e2e321a7d663acd964e2fcdafbf5c9f5a36d55a5 Merge: b22498c4846b5 e17071754cf50 Author: Marc Zyngier Date: Fri Apr 21 09:37:36 2023 +0100 Merge branch kvm-arm64/selftest/lpa into kvmarm-master/next * kvm-arm64/selftest/lpa: : . : Selftest fixes addressing PTE and TTBR0_EL1 encodings for : 52bit PAs : . KVM: selftests: arm64: Fix ttbr0_el1 encoding for PA bits > 48 KVM: selftests: arm64: Fix pte encode/decode for PA bits > 48 KVM: selftests: Fixup config fragment for access_tracking_perf_test Signed-off-by: Marc Zyngier commit b22498c4846b52a5df2cc821d97c4049df0cf67a Merge: ef5f97e9de9fc a6610435ac17d Author: Marc Zyngier Date: Fri Apr 21 09:31:17 2023 +0100 Merge branch kvm-arm64/timer-vm-offsets into kvmarm-master/next * kvm-arm64/timer-vm-offsets: (21 commits) : . : This series aims at satisfying multiple goals: : : - allow a VMM to atomically restore a timer offset for a whole VM : instead of updating the offset each time a vcpu get its counter : written : : - allow a VMM to save/restore the physical timer context, something : that we cannot do at the moment due to the lack of offsetting : : - provide a framework that is suitable for NV support, where we get : both global and per timer, per vcpu offsetting, and manage : interrupts in a less braindead way. : : Conflict resolution involves using the new per-vcpu config lock instead : of the home-grown timer lock. : . KVM: arm64: Handle 32bit CNTPCTSS traps KVM: arm64: selftests: Augment existing timer test to handle variable offset KVM: arm64: selftests: Deal with spurious timer interrupts KVM: arm64: selftests: Add physical timer registers to the sysreg list KVM: arm64: nv: timers: Support hyp timer emulation KVM: arm64: nv: timers: Add a per-timer, per-vcpu offset KVM: arm64: Document KVM_ARM_SET_CNT_OFFSETS and co KVM: arm64: timers: Abstract the number of valid timers per vcpu KVM: arm64: timers: Fast-track CNTPCT_EL0 trap handling KVM: arm64: Elide kern_hyp_va() in VHE-specific parts of the hypervisor KVM: arm64: timers: Move the timer IRQs into arch_timer_vm_data KVM: arm64: timers: Abstract per-timer IRQ access KVM: arm64: timers: Rationalise per-vcpu timer init KVM: arm64: timers: Allow save/restoring of the physical timer KVM: arm64: timers: Allow userspace to set the global counter offset KVM: arm64: Expose {un,}lock_all_vcpus() to the rest of KVM KVM: arm64: timers: Allow physical offset without CNTPOFF_EL2 KVM: arm64: timers: Use CNTPOFF_EL2 to offset the physical timer arm64: Add HAS_ECV_CNTPOFF capability arm64: Add CNTPOFF_EL2 register definition ... Signed-off-by: Marc Zyngier commit ef5f97e9de9fc0d5bb6136de3d01d78c072a452f Merge: 197b6b60ae7bc a189884bdc923 Author: Marc Zyngier Date: Fri Apr 21 09:30:46 2023 +0100 Merge branch kvm-arm64/lock-inversion into kvmarm-master/next * kvm-arm64/lock-inversion: : . : vm/vcpu lock inversion fixes, courtesy of Oliver Upton, plus a few : extra fixes from both Oliver and Reiji Watanabe. : : From the initial cover letter: : : As it so happens, lock ordering in KVM/arm64 is completely backwards. : There's a significant amount of VM-wide state that needs to be accessed : from the context of a vCPU. Until now, this was accomplished by : acquiring the kvm->lock, but that cannot be nested within vcpu->mutex. : : This series fixes the issue with some fine-grained locking for MP state : and a new, dedicated mutex that can nest with both kvm->lock and : vcpu->mutex. : . KVM: arm64: Have kvm_psci_vcpu_on() use WRITE_ONCE() to update mp_state KVM: arm64: Acquire mp_state_lock in kvm_arch_vcpu_ioctl_vcpu_init() KVM: arm64: vgic: Don't acquire its_lock before config_lock KVM: arm64: Use config_lock to protect vgic state KVM: arm64: Use config_lock to protect data ordered against KVM_RUN KVM: arm64: Avoid lock inversion when setting the VM register width KVM: arm64: Avoid vcpu->mutex v. kvm->lock inversion in CPU_ON Signed-off-by: Marc Zyngier commit 7abf7f88df456a373ce34c05a54068574f6fbfef Author: Luca Weiss Date: Tue Apr 18 18:43:18 2023 +0200 pinctrl: qcom: spmi-gpio: Add PMI632 support Add support for the 8 GPIOs found on PMI632. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20230414-pmi632-v2-2-98bafa909c36@z3ntu.xyz Signed-off-by: Linus Walleij commit 4b648d94946618c7efee21227a5d646cec3335c3 Author: Luca Weiss Date: Tue Apr 18 18:43:17 2023 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: add PMI632 Document the 8 GPIOs found on PMI632. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230414-pmi632-v2-1-98bafa909c36@z3ntu.xyz Signed-off-by: Linus Walleij commit f9a5502f8ee3d2bc4403f561f0037c920ca35e6d Author: Jonathan Neuschäfer Date: Wed Apr 12 20:50:49 2023 +0200 pinctrl: wpcm450: select MFD_SYSCON The pinctrl-wpcm450 driver relies on MFD_SYSCON functionality in order to find some of its MMIO registers. Select MFD_SYSCON from PINCTRL_WPCM450 to ensure that it's enabled. Signed-off-by: Jonathan Neuschäfer Link: https://lore.kernel.org/r/20230412185049.3782842-1-j.neuschaefer@gmx.net Signed-off-by: Linus Walleij commit aaee8c7f2a17d2dd015dc97c113c9ea0cc97272a Author: Simon Horman Date: Fri Apr 21 09:11:49 2023 +0200 m68k: kexec: Include Include reboot.h in machine_kexec.c for declaration of machine_crash_shutdown and machine_shutdown. gcc-12 with W=1 reports: arch/m68k/kernel/machine_kexec.c:26:6: warning: no previous prototype for 'machine_shutdown' [-Wmissing-prototypes] 26 | void machine_shutdown(void) | ^~~~~~~~~~~~~~~~ arch/m68k/kernel/machine_kexec.c:30:6: warning: no previous prototype for 'machine_crash_shutdown' [-Wmissing-prototypes] 30 | void machine_crash_shutdown(struct pt_regs *regs) | ^~~~~~~~~~~~~~~~~~~~~~ No functional changes intended. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230421-m68k-kexec-include-reboot-v1-1-7552963a0f25@kernel.org Signed-off-by: Geert Uytterhoeven commit c8687694bb1f5c48134f152f8c5c2e53483eb99d Author: Sui Jingfeng Date: Thu Apr 20 11:05:00 2023 +0800 drm/fbdev-generic: prohibit potential out-of-bounds access The fbdev test of IGT may write after EOF, which lead to out-of-bound access for drm drivers with fbdev-generic. For example, run fbdev test on a x86+ast2400 platform, with 1680x1050 resolution, will cause the linux kernel hang with the following call trace: Oops: 0000 [#1] PREEMPT SMP PTI [IGT] fbdev: starting subtest eof Workqueue: events drm_fb_helper_damage_work [drm_kms_helper] [IGT] fbdev: starting subtest nullptr RIP: 0010:memcpy_erms+0xa/0x20 RSP: 0018:ffffa17d40167d98 EFLAGS: 00010246 RAX: ffffa17d4eb7fa80 RBX: ffffa17d40e0aa80 RCX: 00000000000014c0 RDX: 0000000000001a40 RSI: ffffa17d40e0b000 RDI: ffffa17d4eb80000 RBP: ffffa17d40167e20 R08: 0000000000000000 R09: ffff89522ecff8c0 R10: ffffa17d4e4c5000 R11: 0000000000000000 R12: ffffa17d4eb7fa80 R13: 0000000000001a40 R14: 000000000000041a R15: ffffa17d40167e30 FS: 0000000000000000(0000) GS:ffff895257380000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa17d40e0b000 CR3: 00000001eaeca006 CR4: 00000000001706e0 Call Trace: ? drm_fbdev_generic_helper_fb_dirty+0x207/0x330 [drm_kms_helper] drm_fb_helper_damage_work+0x8f/0x170 [drm_kms_helper] process_one_work+0x21f/0x430 worker_thread+0x4e/0x3c0 ? __pfx_worker_thread+0x10/0x10 kthread+0xf4/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 CR2: ffffa17d40e0b000 ---[ end trace 0000000000000000 ]--- The is because damage rectangles computed by drm_fb_helper_memory_range_to_clip() function is not guaranteed to be bound in the screen's active display area. Possible reasons are: 1) Buffers are allocated in the granularity of page size, for mmap system call support. The shadow screen buffer consumed by fbdev emulation may also choosed be page size aligned. 2) The DIV_ROUND_UP() used in drm_fb_helper_memory_range_to_clip() will introduce off-by-one error. For example, on a 16KB page size system, in order to store a 1920x1080 XRGB framebuffer, we need allocate 507 pages. Unfortunately, the size 1920*1080*4 can not be divided exactly by 16KB. 1920 * 1080 * 4 = 8294400 bytes 506 * 16 * 1024 = 8290304 bytes 507 * 16 * 1024 = 8306688 bytes line_length = 1920*4 = 7680 bytes 507 * 16 * 1024 / 7680 = 1081.6 off / line_length = 507 * 16 * 1024 / 7680 = 1081 DIV_ROUND_UP(507 * 16 * 1024, 7680) will yeild 1082 memcpy_toio() typically issue the copy line by line, when copy the last line, out-of-bound access will be happen. Because: 1082 * line_length = 1082 * 7680 = 8309760, and 8309760 > 8306688 Note that userspace may still write to the invisiable area if a larger buffer than width x stride is exposed. But it is not a big issue as long as there still have memory resolve the access if not drafting so far. - Also limit the y1 (Daniel) - keep fix patch it to minimal (Daniel) - screen_size is page size aligned because of it need mmap (Thomas) - Adding fixes tag (Thomas) Signed-off-by: Sui Jingfeng Fixes: aa15c677cc34 ("drm/fb-helper: Fix vertical damage clipping") Reviewed-by: Thomas Zimmermann Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/dri-devel/ad44df29-3241-0d9e-e708-b0338bf3c623@189.cn/ Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230420030500.1578756-1-suijingfeng@loongson.cn commit 4327a6137ed43a091d900b1ac833345d60f32228 Author: Jammy Huang Date: Fri Apr 21 08:33:54 2023 +0800 drm/ast: Fix ARM compatibility ARM architecture only has 'memory', so all devices are accessed by MMIO if possible. Signed-off-by: Jammy Huang Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230421003354.27767-1-jammy_huang@aspeedtech.com commit d8bb382419230cf626a527eeb55efae0c56039fb Merge: 25c800b210587 ddbcb22055d13 Author: David S. Miller Date: Fri Apr 21 08:29:14 2023 +0100 Merge branch 'pds_core' Shannon Nelson says: ==================== pds_core driver Summary: -------- This patchset implements a new driver for use with the AMD/Pensando Distributed Services Card (DSC), intended to provide core configuration services through the auxiliary_bus and through a couple of EXPORTed functions for use initially in VFio and vDPA feature specific drivers. To keep this patchset to a manageable size, the pds_vdpa and pds_vfio drivers have been split out into their own patchsets to be reviewed separately. Detail: ------- AMD/Pensando is making available a new set of devices for supporting vDPA, VFio, and potentially other features in the Distributed Services Card (DSC). These features are implemented through a PF that serves as a Core device for controlling and configuring its VF devices. These VF devices have separate drivers that use the auxiliary_bus to work through the Core device as the control path. Currently, the DSC supports standard ethernet operations using the ionic driver. This is not replaced by the Core-based devices - these new devices are in addition to the existing Ethernet device. Typical DSC configurations will include both PDS devices and Ionic Eth devices. However, there is a potential future path for ethernet services to come through this device as well. The Core device is a new PCI PF/VF device managed by a new driver 'pds_core'. The PF device has access to an admin queue for configuring the services used by the VFs, and sets up auxiliary_bus devices for each vDPA VF for communicating with the drivers for the vDPA devices. The VFs may be for VFio or vDPA, and other services in the future; these VF types are selected as part of the DSC internal FW configurations, which is out of the scope of this patchset. When the vDPA support set is enabled in the core PF through its devlink param, auxiliary_bus devices are created for each VF that supports the feature. The vDPA driver then connects to and uses this auxiliary_device to do control path configuration through the PF device. This can then be used with the vdpa kernel module to provide devices for virtio_vdpa kernel module for host interfaces, or vhost_vdpa kernel module for interfaces exported into your favorite VM. A cheap ASCII diagram of a vDPA instance looks something like this: ,----------. | vdpa | '----------' | || ctl data | || .----------. || | pds_vdpa | || '----------' || | || pds_core.vDPA.1 || | || .---------------. || | pds_core | || '---------------' || || || || 09:00.0 09:00.1 == PCI ============================================ || || .----------. .----------. ,------| PF |---| VF |-------, | '----------' '----------' | | DSC | | | ------------------------------------------ Changes: v11: - change strncpy to strscpy Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304181137.WaZTYyAa-lkp@intel.com/ v10: Link: https://lore.kernel.org/netdev/20230418003228.28234-1-shannon.nelson@amd.com/ - remove CONFIG_DEBUG_FS guard static inline stuff - remove unnecessary 0 and null initializations - verify in driver load that PDS_CORE_DRV_NAME matches KBUILD_MODNAME - remove debugfs irqs_show(), redundant with /proc - return -ENOMEM if intr_info = kcalloc() fails - move the status code enum into pds_core_if.h as part of API definition - fix up one place in pdsc_devcmd_wait() we're using the status codes where we could use the errno - remove redundant calls to flush_workqueue() - grab config_lock before testing state bits in pdsc_fw_reporter_diagnose() - change pdsc_color_match() to return bool - remove useless VIF setup loop and just setup vDPA services for now - remove pf pointer from struct padev and have clients use pci_physfn() - drop use of "vf" in auxdev.c function names, make more generic - remove last of client ops struct and simply export the functions - drop drivers@pensando.io from MAINTAINERS and add new include dir - include dynamic_debug.h in adminq.c to protect dynamic_hex_dump() - fixed fw_slot type from u8 to int for handling error returns - fixed comment spelling - changed void arg in pdsc_adminq_post() to struct pdsc * v9: Link: https://lore.kernel.org/netdev/20230406234143.11318-1-shannon.nelson@amd.com/ - change pdsc field name id to uid to clarify the unique id used for aux device - remove unnecessary pf->state and other checks in aux device creation - hardcode fw slotnames for devlink info, don't use strings from FW - handle errors from PDS_CORE_CMD_INIT devcmd call - tighten up health thread use of config_lock - remove pdsc_queue_health_check() layer over queuing health check - start pds_core.rst file in first patch, add to it incrementally - give more user interaction info in commit messages - removed a few more extraneous includes v8: Link: https://lore.kernel.org/netdev/20230330234628.14627-1-shannon.nelson@amd.com/ - fixed deadlock problem, use devl_health_reporter_destroy() when devlink is locked - don't clear client_id until after auxiliary_device_uninit() v7: Link: https://lore.kernel.org/netdev/20230330192313.62018-1-shannon.nelson@amd.com/ - use explicit devlink locking and devl_* APIs - move some of devlink setup logic into probe and remove - use debugfs_create_u{type}() for state and queue head and tail - add include for linux/vmalloc.h Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202303260420.Tgq0qobF-lkp@intel.com/ v6: Link: https://lore.kernel.org/netdev/20230324190243.27722-1-shannon.nelson@amd.com/ - removed version.h include noticed by kernel test robot's version check Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202303230742.pX3ply0t-lkp@intel.com/ - fixed up the more egregious checkpatch line length complaints - make sure pdsc_auxbus_dev_register() checks padev pointer errcode v5: Link: https://lore.kernel.org/netdev/20230322185626.38758-1-shannon.nelson@amd.com/ - added devlink health reporter for FW issues - removed asic_type, asic_rev, serial_num, fw_version from debugfs as they are available through other means - trimed OS info in pdsc_identify(), we don't need to send that much info to the FW - removed reg/unreg from auxbus client API, they are now in the core when VF is started - removed need for pdsc definition in client by simplifying the padev to only carry struct pci_dev pointers rather than full struct pdsc to the pf and vf - removed the unused pdsc argument in pdsc_notify() - moved include/linux/pds/pds_core.h to driver/../pds_core/core.h - restored a few pds_core_if.h interface values and structs that are shared with FW source - moved final config_lock unlock to before tear down of timer and workqueue to be sure there are no deadlocks while waiting for any stragglers - changed use of PAGE_SIZE to local PDS_PAGE_SIZE to keep with FW layout needs without regard to kernel PAGE_SIZE configuration - removed the redundant *adminqcq argument from pdsc_adminq_post() v4: Link: https://lore.kernel.org/netdev/20230308051310.12544-1-shannon.nelson@amd.com/ - reworked to attach to both Core PF and vDPA VF PCI devices - now creates auxiliary_device as part of each VF PCI probe, removes them on PCI remove - auxiliary devices now use simple unique id rather than PCI address for identifier - replaced home-grown event publishing with kernel-based notifier service - dropped live_migration parameter, not needed when not creating aux device for it - replaced devm_* functions with traditional interfaces - added MAINTAINERS entry - removed lingering traces of set/get_vf attribute adminq commands - trimmed some include lists - cleaned a kernel test robot complaint about a stray unused variable Link: https://lore.kernel.org/oe-kbuild-all/202302181049.yeUQMeWY-lkp@intel.com/ v3: Link: https://lore.kernel.org/netdev/20230217225558.19837-1-shannon.nelson@amd.com/ - changed names from "pensando" to "amd" and updated copyright strings - dropped the DEVLINK_PARAM_GENERIC_ID_FW_BANK for future development - changed the auxiliary device creation to be triggered by the PCI bus event BOUND_DRIVER, and torn down at UNBIND_DRIVER in order to properly handle users using the sysfs bind/unbind functions - dropped some noisy log messages - rebased to current net-next RFC to v2: Link: https://lore.kernel.org/netdev/20221207004443.33779-1-shannon.nelson@amd.com/ - added separate devlink param patches for DEVLINK_PARAM_GENERIC_ID_ENABLE_MIGRATION and DEVLINK_PARAM_GENERIC_ID_FW_BANK, and dropped the driver specific implementations - updated descriptions for the new devlink parameters - dropped netdev support - dropped vDPA patches, will followup later - separated fw update and fw bank select into their own patches RFC: Link: https://lore.kernel.org/netdev/20221118225656.48309-1-snelson@pensando.io/ ==================== Signed-off-by: David S. Miller commit ddbcb22055d136f58841c73ca2226dab79eb6101 Author: Shannon Nelson Date: Wed Apr 19 10:04:27 2023 -0700 pds_core: Kconfig and pds_core.rst Remaining documentation and Kconfig hook for building the driver. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit d24c28278a01dc4c80d1470533c667cf406f0e88 Author: Shannon Nelson Date: Wed Apr 19 10:04:26 2023 -0700 pds_core: publish events to the clients When the Core device gets an event from the device, or notices the device FW to be up or down, it needs to send those events on to the clients that have an event handler. Add the code to pass along the events to the clients. The entry points pdsc_register_notify() and pdsc_unregister_notify() are EXPORTed for other drivers that want to listen for these events. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 10659034c622738bc1bfab8a76fc576c52d5acce Author: Shannon Nelson Date: Wed Apr 19 10:04:25 2023 -0700 pds_core: add the aux client API Add the client API operations for running adminq commands. The core registers the client with the FW, then the client has a context for requesting adminq services. We expect to add additional operations for other clients, including requesting additional private adminqs and IRQs, but don't have the need yet. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 40ced89445364baa8620e92fba5b3fff8d9742b9 Author: Shannon Nelson Date: Wed Apr 19 10:04:24 2023 -0700 pds_core: devlink params for enabling VIF support Add the devlink parameter switches so the user can enable the features supported by the VFs. The only feature supported at the moment is vDPA. Example: devlink dev param set pci/0000:2b:00.0 \ name enable_vnet cmode runtime value true Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 4569cce43bc61e4cdd76597a1cf9b608846c18cc Author: Shannon Nelson Date: Wed Apr 19 10:04:23 2023 -0700 pds_core: add auxiliary_bus devices An auxiliary_bus device is created for each vDPA type VF at VF probe and destroyed at VF remove. The aux device name comes from the driver name + VIF type + the unique id assigned at PCI probe. The VFs are always removed on PF remove, so there should be no issues with VFs trying to access missing PF structures. The auxiliary_device names will look like "pds_core.vDPA.nn" where 'nn' is the VF's uid. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit f53d93110aa526ad3df628ad6d9f672c7d5ae285 Author: Shannon Nelson Date: Wed Apr 19 10:04:22 2023 -0700 pds_core: add initial VF device handling This is the initial VF PCI driver framework for the new pds_vdpa VF device, which will work in conjunction with an auxiliary_bus client of the pds_core driver. This does the very basics of registering for the new VF device, setting up debugfs entries, and registering with devlink. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 65e0185ad764d2801811bb2e7c122e92557208c4 Author: Shannon Nelson Date: Wed Apr 19 10:04:21 2023 -0700 pds_core: set up the VIF definitions and defaults The Virtual Interfaces (VIFs) supported by the DSC's configuration (vDPA, Eth, RDMA, etc) are reported in the dev_ident struct and made visible in debugfs. At this point only vDPA is supported in this driver so we only setup devices for that feature. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 49ce92fbee0b6bb8066dddf37489483b3b6b5c25 Author: Shannon Nelson Date: Wed Apr 19 10:04:20 2023 -0700 pds_core: add FW update feature to devlink Add in the support for doing firmware updates. Of the two main banks available, a and b, this updates the one not in use and then selects it for the next boot. Example: devlink dev flash pci/0000:b2:00.0 \ file pensando/dsc_fw_1.63.0-22.tar Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 01ba61b55b2041a39c54aefb3153c770dd59a0ef Author: Shannon Nelson Date: Wed Apr 19 10:04:19 2023 -0700 pds_core: Add adminq processing and commands Add the service routines for submitting and processing the adminq messages and for handling notifyq events. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 Author: Shannon Nelson Date: Wed Apr 19 10:04:18 2023 -0700 pds_core: set up device and adminq Set up the basic adminq and notifyq queue structures. These are used mostly by the client drivers for feature configuration. These are essentially the same adminq and notifyq as in the ionic driver. Part of this includes querying for device identity and FW information, so we can make that available to devlink dev info. $ devlink dev info pci/0000:b5:00.0 pci/0000:b5:00.0: driver pds_core serial_number FLM18420073 versions: fixed: asic.id 0x0 asic.rev 0x0 running: fw 1.51.0-73 stored: fw.goldfw 1.15.9-C-22 fw.mainfwa 1.60.0-73 fw.mainfwb 1.60.0-57 Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 25b450c05a49e34f2d08ac469ae19d7651abc57c Author: Shannon Nelson Date: Wed Apr 19 10:04:17 2023 -0700 pds_core: add devlink health facilities Add devlink health reporting on top of our fw watchdog. Example: # devlink health show pci/0000:2b:00.0 reporter fw pci/0000:2b:00.0: reporter fw state healthy error 0 recover 0 # devlink health diagnose pci/0000:2b:00.0 reporter fw Status: healthy State: 1 Generation: 0 Recoveries: 0 Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit c2dbb0904310362aaff213e8c877e655c745d0d1 Author: Shannon Nelson Date: Wed Apr 19 10:04:16 2023 -0700 pds_core: health timer and workqueue Add in the periodic health check and the related workqueue, as well as the handlers for when a FW reset is seen. The firmware is polled every 5 seconds to be sure that it is still alive and that the FW generation didn't change. The alive check looks to see that the PCI bus is still readable and the fw_status still has the RUNNING bit on. If not alive, the driver stops activity and tears things down. When the FW recovers and the alive check again succeeds, the driver sets back up for activity. The generation check looks at the fw_generation to see if it has changed, which can happen if the FW crashed and recovered or was updated in between health checks. If changed, the driver counts that as though the alive test failed and forces the fw_down/fw_up cycle. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 523847df1b3718d6286dce0ed1c83742fe0ffa94 Author: Shannon Nelson Date: Wed Apr 19 10:04:15 2023 -0700 pds_core: add devcmd device interfaces The devcmd interface is the basic connection to the device through the PCI BAR for low level identification and command services. This does the early device initialization and finds the identity data, and adds devcmd routines to be used by later driver bits. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 55435ea7729accb5b8a330de751836c4be524834 Author: Shannon Nelson Date: Wed Apr 19 10:04:14 2023 -0700 pds_core: initial framework for pds_core PF driver This is the initial PCI driver framework for the new pds_core device driver and its family of devices. This does the very basics of registering for the new PF PCI device 1dd8:100c, setting up debugfs entries, and registering with devlink. Signed-off-by: Shannon Nelson Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 25c800b210587801a55d1b667059e5ae388a5edb Merge: 1cf3fe1c3726a 7648ac72dcd7e Author: David S. Miller Date: Fri Apr 21 08:25:51 2023 +0100 Merge branch 'bridge-neigh-suppression' Ido Schimmel says: ==================== bridge: Add per-{Port, VLAN} neighbor suppression Background ========== In order to minimize the flooding of ARP and ND messages in the VXLAN network, EVPN includes provisions [1] that allow participating VTEPs to suppress such messages in case they know the MAC-IP binding and can reply on behalf of the remote host. In Linux, the above is implemented in the bridge driver using a per-port option called "neigh_suppress" that was added in kernel version 4.15 [2]. Motivation ========== Some applications use ARP messages as keepalives between the application nodes in the network. This works perfectly well when two nodes are connected to the same VTEP. When a node goes down it will stop responding to ARP requests and the other node will notice it immediately. However, when the two nodes are connected to different VTEPs and neighbor suppression is enabled, the local VTEP will reply to ARP requests even after the remote node went down, until certain timers expire and the EVPN control plane decides to withdraw the MAC/IP Advertisement route for the address. Therefore, some users would like to be able to disable neighbor suppression on VLANs where such applications reside and keep it enabled on the rest. Implementation ============== The proposed solution is to allow user space to control neighbor suppression on a per-{Port, VLAN} basis, in a similar fashion to other per-port options that gained per-{Port, VLAN} counterparts such as "mcast_router". This allows users to benefit from the operational simplicity and scalability associated with shared VXLAN devices (i.e., external / collect-metadata mode), while still allowing for per-VLAN/VNI neighbor suppression control. The user interface is extended with a new "neigh_vlan_suppress" bridge port option that allows user space to enable per-{Port, VLAN} neighbor suppression on the bridge port. When enabled, the existing "neigh_suppress" option has no effect and neighbor suppression is controlled using a new "neigh_suppress" VLAN option. Example usage: # bridge link set dev vxlan0 neigh_vlan_suppress on # bridge vlan add vid 10 dev vxlan0 # bridge vlan set vid 10 dev vxlan0 neigh_suppress on Testing ======= Tested using existing bridge selftests. Added a dedicated selftest in the last patch. Patchset overview ================= Patches #1-#5 are preparations. Patch #6 adds per-{Port, VLAN} neighbor suppression support to the bridge's data path. Patches #7-#8 add the required netlink attributes to enable the feature. Patch #9 adds a selftest. iproute2 patches can be found here [3]. Changelog ========= Since RFC [4]: No changes. [1] https://www.rfc-editor.org/rfc/rfc7432#section-10 [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a42317785c898c0ed46db45a33b0cc71b671bf29 [3] https://github.com/idosch/iproute2/tree/submit/neigh_suppress_v1 [4] https://lore.kernel.org/netdev/20230413095830.2182382-1-idosch@nvidia.com/ ==================== Signed-off-by: David S. Miller commit 7648ac72dcd7e22ac1fa5e573e536592773831dc Author: Ido Schimmel Date: Wed Apr 19 18:35:00 2023 +0300 selftests: net: Add bridge neighbor suppression test Add test cases for bridge neighbor suppression, testing both per-port and per-{Port, VLAN} neighbor suppression with both ARP and NS packets. Example truncated output: # ./test_bridge_neigh_suppress.sh [...] Tests passed: 148 Tests failed: 0 Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 160656d7201d861a1f2a0bf279a765e8cda2317a Author: Ido Schimmel Date: Wed Apr 19 18:34:59 2023 +0300 bridge: Allow setting per-{Port, VLAN} neighbor suppression state Add a new bridge port attribute that allows user space to enable per-{Port, VLAN} neighbor suppression. Example: # bridge -d -j -p link show dev swp1 | jq '.[]["neigh_vlan_suppress"]' false # bridge link set dev swp1 neigh_vlan_suppress on # bridge -d -j -p link show dev swp1 | jq '.[]["neigh_vlan_suppress"]' true # bridge link set dev swp1 neigh_vlan_suppress off # bridge -d -j -p link show dev swp1 | jq '.[]["neigh_vlan_suppress"]' false Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 83f6d600796c65ab34b08dbddb5795099dfda4d1 Author: Ido Schimmel Date: Wed Apr 19 18:34:58 2023 +0300 bridge: vlan: Allow setting VLAN neighbor suppression state Add a new VLAN attribute that allows user space to set the neighbor suppression state of the port VLAN. Example: # bridge -d -j -p vlan show dev swp1 vid 10 | jq '.[]["vlans"][]["neigh_suppress"]' false # bridge vlan set vid 10 dev swp1 neigh_suppress on # bridge -d -j -p vlan show dev swp1 vid 10 | jq '.[]["vlans"][]["neigh_suppress"]' true # bridge vlan set vid 10 dev swp1 neigh_suppress off # bridge -d -j -p vlan show dev swp1 vid 10 | jq '.[]["vlans"][]["neigh_suppress"]' false # bridge vlan set vid 10 dev br0 neigh_suppress on Error: bridge: Can't set neigh_suppress for non-port vlans. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 412614b1457af278b00152f3804af5481c6c55ac Author: Ido Schimmel Date: Wed Apr 19 18:34:57 2023 +0300 bridge: Add per-{Port, VLAN} neighbor suppression data path support When the bridge is not VLAN-aware (i.e., VLAN ID is 0), determine if neighbor suppression is enabled on a given bridge port solely based on the existing 'BR_NEIGH_SUPPRESS' flag. Otherwise, if the bridge is VLAN-aware, first check if per-{Port, VLAN} neighbor suppression is enabled on the given bridge port using the 'BR_NEIGH_VLAN_SUPPRESS' flag. If so, look up the VLAN and check whether it has neighbor suppression enabled based on the per-VLAN 'BR_VLFLAG_NEIGH_SUPPRESS_ENABLED' flag. If the bridge is VLAN-aware, but the bridge port does not have per-{Port, VLAN} neighbor suppression enabled, then fallback to determine neighbor suppression based on the 'BR_NEIGH_SUPPRESS' flag. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 3aca683e0654a2f4ff6996341cba98a5396ff050 Author: Ido Schimmel Date: Wed Apr 19 18:34:56 2023 +0300 bridge: Encapsulate data path neighbor suppression logic Currently, there are various places in the bridge data path that check whether neighbor suppression is enabled on a given bridge port. As a preparation for per-{Port, VLAN} neighbor suppression, encapsulate this logic in a function and pass the VLAN ID of the packet as an argument. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 6be42ed0a5f4b26e77b51cd10a09b41d53f97570 Author: Ido Schimmel Date: Wed Apr 19 18:34:55 2023 +0300 bridge: Take per-{Port, VLAN} neighbor suppression into account The bridge driver gates the neighbor suppression code behind an internal per-bridge flag called 'BROPT_NEIGH_SUPPRESS_ENABLED'. The flag is set when at least one bridge port has neighbor suppression enabled. As a preparation for per-{Port, VLAN} neighbor suppression, make sure the global flag is also set if per-{Port, VLAN} neighbor suppression is enabled. That is, when the 'BR_NEIGH_VLAN_SUPPRESS' flag is set on at least one bridge port. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit a714e3ec230892039b5d5ae6902b58bb084a15c1 Author: Ido Schimmel Date: Wed Apr 19 18:34:54 2023 +0300 bridge: Add internal flags for per-{Port, VLAN} neighbor suppression Add two internal flags that will be used to enable / disable per-{Port, VLAN} neighbor suppression: 1. 'BR_NEIGH_VLAN_SUPPRESS': A per-port flag used to indicate that per-{Port, VLAN} neighbor suppression is enabled on the bridge port. When set, 'BR_NEIGH_SUPPRESS' has no effect. 2. 'BR_VLFLAG_NEIGH_SUPPRESS_ENABLED': A per-VLAN flag used to indicate that neighbor suppression is enabled on the given VLAN. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit e408336a693e0fd74ba1b959627594b80f1761c3 Author: Ido Schimmel Date: Wed Apr 19 18:34:53 2023 +0300 bridge: Pass VLAN ID to br_flood() Subsequent patches are going to add per-{Port, VLAN} neighbor suppression, which will require br_flood() to potentially suppress ARP / NS packets on a per-{Port, VLAN} basis. As a preparation, pass the VLAN ID of the packet as another argument to br_flood(). Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 013a7ce81dd8a5bba31f802053829d91f9a43a8f Author: Ido Schimmel Date: Wed Apr 19 18:34:52 2023 +0300 bridge: Reorder neighbor suppression check when flooding The bridge does not flood ARP / NS packets for which a reply was sent to bridge ports that have neighbor suppression enabled. Subsequent patches are going to add per-{Port, VLAN} neighbor suppression, which is going to make it more expensive to check whether neighbor suppression is enabled since a VLAN lookup will be required. Therefore, instead of unnecessarily performing this lookup for every packet, only perform it for ARP / NS packets for which a reply was sent. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 1cf3fe1c3726ac2e7aa47407321c484a468feb94 Merge: e2598dbd21279 7661351a54ec9 Author: David S. Miller Date: Fri Apr 21 08:22:15 2023 +0100 Merge branch 'macsec-vlan' Emeel Hakim says: ==================== Support MACsec VLAN This patch series introduces support for hardware (HW) offload MACsec devices with VLAN configuration. The patches address both scenarios where the VLAN header is both the inner and outer header for MACsec. The changes include: 1. Adding MACsec offload operation for VLAN. 2. Considering VLAN when accessing MACsec net device. 3. Currently offloading MACsec when it's configured over VLAN with current MACsec TX steering rules would wrongly insert the MACsec sec tag after inserting the VLAN header. This resulted in an ETHERNET | SECTAG | VLAN packet when ETHERNET | VLAN | SECTAG is configured. The patche handles this issue when configuring steering rules. 4. Adding MACsec rx_handler change support in case of a marked skb and a mismatch on the dst MAC address. Please review these changes and let me know if you have any feedback or concerns. Updates since v1: - Consult vlan_features when adding NETIF_F_HW_MACSEC. - Allow grep for the functions. - Add helper function to get the macsec operation to allow the compiler to make some choice. Updates since v2: - Don't use macros to allow direct navigattion from mdo functions to its implementation. - Make the vlan_get_macsec_ops argument a const. - Check if the specific mdo function is available before calling it. - Enable NETIF_F_HW_MACSEC by default when the lower device has it enabled and in case the lower device currently has NETIF_F_HW_MACSEC but disabled let the new vlan device also have it disabled. Updates since v3: - Split patch ("vlan: Add MACsec offload operations for VLAN interface") to prevent mixing generic vlan code changes with driver changes. - Add mdo_open, stop and stats to support drivers which have those. - Don't fail if macsec offload operations are available but a specific function is not, to support drivers which does not implement all macsec offload operations. - Don't call find_rx_sc twice in the same loop, instead save the result in a parameter and re-use it. - Completely remove _BUILD_VLAN_MACSEC_MDO macro, to prevent returning from a macro. - Reorder the functions inside struct macsec_ops to match the struct decleration. Updates since v4: - Change subject line of ("macsec: Add MACsec rx_handler change support") and adapt commit message. - Don't separate the new check in patch ("macsec: Add MACsec rx_handler change support") from the previous if/else if. - Drop"_found" from the parameter naming "rx_sc_found" and move the definition to the relevant block. - Remove "{}" since not needed around a single line. Updates since v5: - Consider promiscuous mode case. Updates since v6: - Use IS_ENABLED instead of checking for ifdef. - Don't add inline keywork in c files, let the compiler make its own decisions. ==================== Signed-off-by: David S. Miller commit 7661351a54ec9a6a20203f94fd459a9360049045 Author: Emeel Hakim Date: Wed Apr 19 17:21:26 2023 +0300 macsec: Don't rely solely on the dst MAC address to identify destination MACsec device Offloading device drivers will mark offloaded MACsec SKBs with the corresponding SCI in the skb_metadata_dst so the macsec rx handler will know to which interface to divert those skbs, in case of a marked skb and a mismatch on the dst MAC address, divert the skb to the macsec net_device where the macsec rx_handler will be called to consider cases where relying solely on the dst MAC address is insufficient. One such instance is when using MACsec with a VLAN as an inner header, where the packet structure is ETHERNET | SECTAG | VLAN. In such a scenario, the dst MAC address in the ethernet header will correspond to the VLAN MAC address, resulting in a mismatch. Signed-off-by: Emeel Hakim Reviewed-by: Subbaraya Sundeep Signed-off-by: David S. Miller commit 765f974c7dfd104ed569fae1669adfc0e70ded1b Author: Emeel Hakim Date: Wed Apr 19 17:21:25 2023 +0300 net/mlx5: Consider VLAN interface in MACsec TX steering rules Offloading MACsec when its configured over VLAN with current MACsec TX steering rules will wrongly insert MACsec sec tag after inserting the VLAN header leading to a ETHERNET | SECTAG | VLAN packet when ETHERNET | VLAN | SECTAG is configured. The above issue is due to adding the SECTAG by HW which is a later stage compared to the VLAN header insertion stage. Detect such a case and adjust TX steering rules to insert the SECTAG in the correct place by using reformat_param_0 field in the packet reformat to indicate the offset of SECTAG from end of the MAC header to account for VLANs in granularity of 4Bytes. Signed-off-by: Emeel Hakim Reviewed-by: Subbaraya Sundeep Signed-off-by: David S. Miller commit 4bba492b04270c29259594d1b9ee66ce96af9466 Author: Emeel Hakim Date: Wed Apr 19 17:21:24 2023 +0300 net/mlx5: Support MACsec over VLAN MACsec device may have a VLAN device on top of it. Detect MACsec state correctly under this condition, and return the correct net device accordingly. Signed-off-by: Emeel Hakim Reviewed-by: Subbaraya Sundeep Signed-off-by: David S. Miller commit 339ccec8d43d004a377b01e1a9a85487f95e8f13 Author: Emeel Hakim Date: Wed Apr 19 17:21:23 2023 +0300 net/mlx5: Enable MACsec offload feature for VLAN interface Enable MACsec offload feature over VLAN by adding NETIF_F_HW_MACSEC to the device vlan_features. Signed-off-by: Emeel Hakim Reviewed-by: Subbaraya Sundeep Signed-off-by: David S. Miller commit abff3e5e2935f5cc34feb559b352179b13eaa066 Author: Emeel Hakim Date: Wed Apr 19 17:21:22 2023 +0300 vlan: Add MACsec offload operations for VLAN interface Add support for MACsec offload operations for VLAN driver to allow offloading MACsec when VLAN's real device supports Macsec offload by forwarding the offload request to it. Signed-off-by: Emeel Hakim Reviewed-by: Subbaraya Sundeep Signed-off-by: David S. Miller commit e2598dbd21279d355d9c808eb14d336b94e3c788 Merge: 2f3a247c3994e dbda0fba7a14f Author: David S. Miller Date: Fri Apr 21 08:19:30 2023 +0100 Merge branch 'sctp-nested-flex-arrays' Xin Long says: ==================== sctp: fix a plenty of flexible-array-nested warnings Paolo noticed a compile warning in SCTP, ../net/sctp/stream_sched_fc.c: note: in included file (through ../include/net/sctp/sctp.h): ../include/net/sctp/structs.h:335:41: warning: array of flexible structures But not only this, there are actually quite a lot of such warnings in some SCTP structs. This patchset fixes most of warnings by deleting these nested flexible array members. After this patchset, there are still some warnings left: # make C=2 CF="-Wflexible-array-nested" M=./net/sctp/ ./include/net/sctp/structs.h:1145:41: warning: nested flexible array ./include/uapi/linux/sctp.h:641:34: warning: nested flexible array ./include/uapi/linux/sctp.h:643:34: warning: nested flexible array ./include/uapi/linux/sctp.h:644:33: warning: nested flexible array ./include/uapi/linux/sctp.h:650:40: warning: nested flexible array ./include/uapi/linux/sctp.h:653:39: warning: nested flexible array the 1st is caused by __data[] in struct ip_options, not in SCTP; the others are in uapi, and we should not touch them. Note that instead of completely deleting it, we just leave it as a comment in the struct, signalling to the reader that we do expect such variable parameters over there, as Marcelo suggested. ==================== Signed-off-by: David S. Miller commit dbda0fba7a14f14835c34d59fd329cb90a887862 Author: Xin Long Date: Wed Apr 19 11:16:33 2023 -0400 sctp: delete the nested flexible array payload This patch deletes the flexible-array payload[] from the structure sctp_datahdr to avoid some sparse warnings: # make C=2 CF="-Wflexible-array-nested" M=./net/sctp/ net/sctp/socket.c: note: in included file (through include/net/sctp/structs.h, include/net/sctp/sctp.h): ./include/linux/sctp.h:230:29: warning: nested flexible array This member is not even used anywhere. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 2ab399a931dddacdf7202cd4b49a5187154623d1 Author: Xin Long Date: Wed Apr 19 11:16:32 2023 -0400 sctp: delete the nested flexible array hmac This patch deletes the flexible-array hmac[] from the structure sctp_authhdr to avoid some sparse warnings: # make C=2 CF="-Wflexible-array-nested" M=./net/sctp/ net/sctp/auth.c: note: in included file (through include/net/sctp/structs.h, include/net/sctp/sctp.h): ./include/linux/sctp.h:735:29: warning: nested flexible array Signed-off-by: Xin Long Signed-off-by: David S. Miller commit f97278ff346a5f11c68d0ac499999d5ad06a6db2 Author: Xin Long Date: Wed Apr 19 11:16:31 2023 -0400 sctp: delete the nested flexible array peer_init This patch deletes the flexible-array peer_init[] from the structure sctp_cookie to avoid some sparse warnings: # make C=2 CF="-Wflexible-array-nested" M=./net/sctp/ net/sctp/sm_make_chunk.c: note: in included file (through include/net/sctp/sctp.h): ./include/net/sctp/structs.h:1588:28: warning: nested flexible array ./include/net/sctp/structs.h:343:28: warning: nested flexible array Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 9789c1c6619e0a5eccfc31abe49b1ce5ca3cd11f Author: Xin Long Date: Wed Apr 19 11:16:30 2023 -0400 sctp: delete the nested flexible array variable This patch deletes the flexible-array variable[] from the structure sctp_sackhdr and sctp_errhdr to avoid some sparse warnings: # make C=2 CF="-Wflexible-array-nested" M=./net/sctp/ net/sctp/sm_statefuns.c: note: in included file (through include/net/sctp/structs.h, include/net/sctp/sctp.h): ./include/linux/sctp.h:451:28: warning: nested flexible array ./include/linux/sctp.h:393:29: warning: nested flexible array Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 73175a042955e531ec355a8708585befa67a22db Author: Xin Long Date: Wed Apr 19 11:16:29 2023 -0400 sctp: delete the nested flexible array skip This patch deletes the flexible-array skip[] from the structure sctp_ifwdtsn/fwdtsn_hdr to avoid some sparse warnings: # make C=2 CF="-Wflexible-array-nested" M=./net/sctp/ net/sctp/stream_interleave.c: note: in included file (through include/net/sctp/structs.h, include/net/sctp/sctp.h): ./include/linux/sctp.h:611:32: warning: nested flexible array ./include/linux/sctp.h:628:33: warning: nested flexible array Signed-off-by: Xin Long Signed-off-by: David S. Miller commit add7370a398930077c6bc257ef5016b040d476eb Author: Xin Long Date: Wed Apr 19 11:16:28 2023 -0400 sctp: delete the nested flexible array params This patch deletes the flexible-array params[] from the structure sctp_inithdr, sctp_addiphdr and sctp_reconf_chunk to avoid some sparse warnings: # make C=2 CF="-Wflexible-array-nested" M=./net/sctp/ net/sctp/input.c: note: in included file (through include/net/sctp/structs.h, include/net/sctp/sctp.h): ./include/linux/sctp.h:278:29: warning: nested flexible array ./include/linux/sctp.h:675:30: warning: nested flexible array This warning is reported if a structure having a flexible array member is included by other structures. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit c82729e06644f4e087f5ff0f91b8fb15e03b8890 Author: Cindy Lu Date: Thu Apr 20 23:17:34 2023 +0800 vhost_vdpa: fix unmap process in no-batch mode While using the vdpa device with vIOMMU enabled in the guest VM, when the vdpa device bind to vfio-pci and run testpmd then system will fail to unmap. The test process is Load guest VM --> attach to virtio driver--> bind to vfio-pci driver So the mapping process is 1)batched mode map to normal MR 2)batched mode unmapped the normal MR 3)unmapped all the memory 4)mapped to iommu MR This error happened in step 3). The iotlb was freed in step 2) and the function vhost_vdpa_process_iotlb_msg will return fail Which causes failure. To fix this, we will not remove the AS while the iotlb->nmaps is 0. This will free in the vhost_vdpa_clean Cc: stable@vger.kernel.org Fixes: aaca8373c4b1 ("vhost-vdpa: support ASID based IOTLB API") Signed-off-by: Cindy Lu Message-Id: <20230420151734.860168-1-lulu@redhat.com> Signed-off-by: Michael S. Tsirkin commit 11841c52fa525c9be17c0731cc897d93c3c0f4fe Author: Xuan Zhuo Date: Thu Apr 13 15:16:10 2023 +0800 MAINTAINERS: make me a reviewer of VIRTIO CORE AND NET DRIVERS First of all, I personally love open source, linux and virtio. I have also participated in community work such as virtio for a long time. I think I am familiar enough with virtio/virtio-net and is adequate as a reviewer. Every time there is some patch/bug, I wish I can get pinged and I will feedback on that. For me personally, being a reviewer is an honor and a responsibility, and it also makes it easier for me to participate in virtio-related work. And I will spend more time reviewing virtio patch. Better advance virtio development I had some contributions to virtio/virtio-net and some support for it. * per-queue reset * virtio-net xdp * some bug fix * ...... I make a humble request to grant the reviewer role for the virtio core and net drivers. Signed-off-by: Xuan Zhuo Message-Id: <20230413071610.43659-1-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit e9c4962c5d69b8a238bb8bd51e8fdce39be13e5b Author: Shunsuke Mie Date: Mon Apr 17 11:20:37 2023 +0900 tools/virtio: fix build caused by virtio_ring changes Fix the build dependency for virtio_test. The virtio_ring that is used from the test requires container_of_const(). Change to use container_of.h kernel header directly and adapt related codes. Signed-off-by: Shunsuke Mie Message-Id: <20230417022037.917668-2-mie@igel.co.jp> Signed-off-by: Michael S. Tsirkin commit 38fc29ea754711e9a8c4e9ca2678ab41353a4662 Author: Shunsuke Mie Date: Mon Apr 17 11:20:36 2023 +0900 virtio_ring: add a struct device forward declaration The virtio_ring header file uses the struct device without a forward declaration. Signed-off-by: Shunsuke Mie Message-Id: <20230417022037.917668-1-mie@igel.co.jp> Signed-off-by: Michael S. Tsirkin commit abebb16254b362664452e14d9711ddb54855ddcf Author: Stefano Garzarella Date: Fri Apr 7 15:36:58 2023 +0200 vdpa_sim_blk: support shared backend The vdpa_sim_blk simulator uses a ramdisk as the backend. To test live migration, we need two devices that share the backend to have the data synchronized with each other. Add a new module parameter to make the buffer shared between all devices. The shared_buffer_mutex is used just to ensure that each operation is atomic, but it is up to the user to use the devices knowing that the underlying ramdisk is shared. For example, when we do a migration, the VMM (e.g., QEMU) will guarantee to write to the destination device, only after completing operations with the source device. Signed-off-by: Stefano Garzarella Message-Id: <20230407133658.66339-3-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 112f23cd72a2975e11986d73575e2c3651ea4c7e Author: Stefano Garzarella Date: Fri Apr 7 15:36:57 2023 +0200 vdpa_sim: move buffer allocation in the devices Currently, the vdpa_sim core does not use the buffer, but only allocates it. The buffer is used by devices differently, and some future devices may not use it. So let's move all its management inside the devices. Add a new `free` device callback called to clean up the resources allocated by the device. Signed-off-by: Stefano Garzarella Message-Id: <20230407133658.66339-2-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 5b250fac7c76b670dd1b28b67f1a91a1907bc117 Author: Alvaro Karsz Date: Sun Apr 9 15:02:42 2023 +0300 vdpa/snet: use likely/unlikely macros in hot functions - kick callback: most likely that the VQ is ready. - interrupt handlers: most likely that the callback is not NULL. Signed-off-by: Alvaro Karsz Message-Id: <20230409120242.3460074-1-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin commit 51b6e6c1c8e382c50fe88a04e25d326ceff74f89 Author: Alvaro Karsz Date: Mon Apr 17 11:38:53 2023 +0300 vdpa/snet: implement kick_vq_with_data callback Implement the kick_vq_with_data vDPA callback. On kick, we pass the next available data to the DPU by writing it in the kick offset. Signed-off-by: Alvaro Karsz Message-Id: <20230417083853.375076-1-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin commit 2c4e4a22a3b090e06191f8544d21e0e1d72ce518 Author: Alvaro Karsz Date: Thu Apr 13 11:18:55 2023 +0300 virtio-vdpa: add VIRTIO_F_NOTIFICATION_DATA feature support Add VIRTIO_F_NOTIFICATION_DATA support for vDPA transport. If this feature is negotiated, the driver passes extra data when kicking a virtqueue. A device that offers this feature needs to implement the kick_vq_with_data callback. kick_vq_with_data receives the vDPA device and data. data includes: 16 bits vqn and 16 bits next available index for split virtqueues. 16 bits vqs, 15 least significant bits of next available index and 1 bit next_wrap for packed virtqueues. This patch follows a patch [1] by Viktor Prutyanov which adds support for the MMIO, channel I/O and modern PCI transports. Signed-off-by: Alvaro Karsz Message-Id: <20230413081855.36643-3-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit af8ececda185078c096852edb4e1d7a2349e6856 Author: Viktor Prutyanov Date: Thu Apr 13 11:18:54 2023 +0300 virtio: add VIRTIO_F_NOTIFICATION_DATA feature support According to VirtIO spec v1.2, VIRTIO_F_NOTIFICATION_DATA feature indicates that the driver passes extra data along with the queue notifications. In a split queue case, the extra data is 16-bit available index. In a packed queue case, the extra data is 1-bit wrap counter and 15-bit available index. Add support for this feature for MMIO, channel I/O and modern PCI transports. Signed-off-by: Viktor Prutyanov Acked-by: Jason Wang Reviewed-by: Xuan Zhuo Message-Id: <20230413081855.36643-2-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin commit 3616bf377a5a8ef4f124dfde5f3522c4da335561 Author: Alvaro Karsz Date: Thu Apr 13 10:33:37 2023 +0300 vdpa/snet: support the suspend vDPA callback When suspend is called, the driver sends a suspend command to the DPU through the control mechanism. Signed-off-by: Alvaro Karsz Message-Id: <20230413073337.31367-3-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 3f3a1675b731e532d479e65570f2904878fbd9f0 Author: Alvaro Karsz Date: Thu Apr 13 10:33:36 2023 +0300 vdpa/snet: support getting and setting VQ state This patch adds the get_vq_state and set_vq_state vDPA callbacks. In order to get the VQ state, the state needs to be read from the DPU. In order to allow that, the old messaging mechanism is replaced with a new, flexible control mechanism. This mechanism allows to read data from the DPU. The mechanism can be used if the negotiated config version is 2 or higher. If the new mechanism is used when the config version is 1, it will call snet_send_ctrl_msg_old, which is config 1 compatible. Signed-off-by: Alvaro Karsz Message-Id: <20230413073337.31367-2-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 4a536d881a661c7ff7d241c537ee511106d88163 Author: Simon Horman Date: Fri Mar 31 10:56:57 2023 +0200 MAINTAINERS: add vringh.h to Virtio Core and Net Drivers vringh.h doesn't seem to belong to any section in MAINTAINERS. Add it to Virtio Core and Net Drivers, which seems to be the most appropriate section to me. Signed-off-by: Simon Horman Message-Id: <20230331-vhost-fixes-v1-3-1f046e735b9e@kernel.org> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit b2ffaa672edaf1a681537a9f47bc14ab6c9e8845 Author: Simon Horman Date: Fri Mar 31 10:56:56 2023 +0200 vringh: address kdoc warnings Address some minor kdoc warnings in vring.h. * Place kdoc for 'struct vringh_config_ops' immediately before the structure * Add missing documentation of members of 'vringh_iov' and 'vringh_kiov' Warnings flagged by: $ ./scripts/kernel-doc -none include/linux/vringh.h include/linux/vringh.h:68: error: Cannot parse struct or union! include/linux/vringh.h:92: warning: Function parameter or member 'iov' not described in 'vringh_iov' include/linux/vringh.h:92: warning: Function parameter or member 'consumed' not described in 'vringh_iov' include/linux/vringh.h:92: warning: Function parameter or member 'i' not described in 'vringh_iov' include/linux/vringh.h:92: warning: Function parameter or member 'used' not described in 'vringh_iov' include/linux/vringh.h:92: warning: Function parameter or member 'max_num' not described in 'vringh_iov' include/linux/vringh.h:104: warning: Function parameter or member 'iov' not described in 'vringh_kiov' include/linux/vringh.h:104: warning: Function parameter or member 'consumed' not described in 'vringh_kiov' include/linux/vringh.h:104: warning: Function parameter or member 'i' not described in 'vringh_kiov' include/linux/vringh.h:104: warning: Function parameter or member 'used' not described in 'vringh_kiov' include/linux/vringh.h:104: warning: Function parameter or member 'max_num' not described in 'vringh_kiov' Signed-off-by: Simon Horman Message-Id: <20230331-vhost-fixes-v1-2-1f046e735b9e@kernel.org> Signed-off-by: Michael S. Tsirkin commit 9be5d2d424a19a0c6d643a1baecba3d58e725012 Author: Simon Horman Date: Fri Mar 31 10:56:55 2023 +0200 vdpa: address kdoc warnings This patch addresses the following minor kdoc problems. * Incorrect spelling of 'callback' and 'notification' * Unrecognised kdoc format for 'struct vdpa_map_file' * Missing documentation of 'get_vendor_vq_stats' member of 'struct vdpa_config_ops' * Missing documentation of 'max_supported_vqs' and 'supported_features' members of 'struct vdpa_mgmt_dev' Most of these problems were flagged by: $ ./scripts/kernel-doc -Werror -none include/linux/vdpa.h include/linux/vdpa.h:20: warning: expecting prototype for struct vdpa_calllback. Prototype was for struct vdpa_callback instead include/linux/vdpa.h:117: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Corresponding file area for device memory mapping include/linux/vdpa.h:357: warning: Function parameter or member 'get_vendor_vq_stats' not described in 'vdpa_config_ops' include/linux/vdpa.h:518: warning: Function parameter or member 'supported_features' not described in 'vdpa_mgmt_dev' include/linux/vdpa.h:518: warning: Function parameter or member 'max_supported_vqs' not described in 'vdpa_mgmt_dev' The misspelling of 'notification' was flagged by: $ ./scripts/checkpatch.pl --codespell --showfile --strict -f include/linux/vdpa.h include/linux/vdpa.h:171: CHECK: 'notifcation' may be misspelled - perhaps 'notification'? ... Signed-off-by: Simon Horman Message-Id: <20230331-vhost-fixes-v1-1-1f046e735b9e@kernel.org> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 6c0b057cec5eade4c3afec3908821176931a9997 Author: Albert Huang Date: Wed Mar 29 18:23:00 2023 +0800 virtio_ring: don't update event idx on get_buf In virtio_net, if we disable napi_tx, when we trigger a tx interrupt, the vq->event_triggered will be set to true. It is then never reset until we explicitly call virtqueue_enable_cb_delayed or virtqueue_enable_cb_prepare. If we disable the napi_tx, virtqueue_enable_cb* will only be called when the tx ring is getting relatively empty. Since event_triggered is true, VRING_AVAIL_F_NO_INTERRUPT or VRING_PACKED_EVENT_FLAG_DISABLE will not be set. As a result we update vring_used_event(&vq->split.vring) or vq->packed.vring.driver->off_wrap every time we call virtqueue_get_buf_ctx. This causes more interrupts. To summarize: 1) event_triggered was set to true in vring_interrupt() 2) after this nothing will happen in virtqueue_disable_cb() so VRING_AVAIL_F_NO_INTERRUPT is not set in avail_flags_shadow 3) virtqueue_get_buf_ctx_split() will still think the cb is enabled and then it will publish a new event index To fix: update VRING_AVAIL_F_NO_INTERRUPT or VRING_PACKED_EVENT_FLAG_DISABLE in the vq when we call virtqueue_disable_cb even when event_triggered is true. Tested with iperf: iperf3 tcp stream: vm1 -----------------> vm2 vm2 just receives tcp data stream from vm1, and sends acks to vm1, there are many tx interrupts in vm2. with the patch applied there are just a few tx interrupts. v2->v3: -update the interrupt disable flag even with the event_triggered is set, -instead of checking whether event_triggered is set in -virtqueue_get_buf_ctx_{packed/split}, will cause the drivers which have -not called virtqueue_{enable/disable}_cb to miss notifications. v3->v4: -remove change for -"if (vq->packed.event_flags_shadow != VRING_PACKED_EVENT_FLAG_DISABLE)" -in virtqueue_disable_cb_packed Fixes: 8d622d21d248 ("virtio: fix up virtio_disable_cb") Signed-off-by: Albert Huang Signed-off-by: Michael S. Tsirkin Signed-off-by: Jason Wang Message-Id: <20230329102300.61000-1-huangjie.albert@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 4bb94d2de2fa90aa8d4e1ce940b1b2f7708cf141 Author: Stefano Garzarella Date: Tue Apr 4 15:17:34 2023 +0200 vdpa_sim: add support for user VA The new "use_va" module parameter (default: true) is used in vdpa_alloc_device() to inform the vDPA framework that the device supports VA. vringh is initialized to use VA only when "use_va" is true and the user's mm has been bound. So, only when the bus supports user VA (e.g. vhost-vdpa). vdpasim_mm_work_fn work is used to serialize the binding to a new address space when the .bind_mm callback is invoked, and unbinding when the .unbind_mm callback is invoked. Call mmget_not_zero()/kthread_use_mm() inside the worker function to pin the address space only as long as needed, following the documentation of mmget() in include/linux/sched/mm.h: * Never use this function to pin this address space for an * unbounded/indefinite amount of time. Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20230404131734.45943-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit d7621c28fca1c16f9e94245479792024a5676c50 Author: Stefano Garzarella Date: Tue Apr 4 15:17:29 2023 +0200 vdpa_sim: replace the spinlock with a mutex to protect the state The spinlock we use to protect the state of the simulator is sometimes held for a long time (for example, when devices handle requests). This also prevents us from calling functions that might sleep (such as kthread_flush_work() in the next patch), and thus having to release and retake the lock. For these reasons, let's replace the spinlock with a mutex that gives us more flexibility. Suggested-by: Jason Wang Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20230404131730.45920-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 76acfa7bc54f1e3b9dde396e0a3534493419fd6f Author: Stefano Garzarella Date: Tue Apr 4 15:17:25 2023 +0200 vdpa_sim: use kthread worker Let's use our own kthread to run device jobs. This allows us more flexibility, especially we can attach the kthread to the user address space when vDPA uses user's VA. Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20230404131725.45908-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit e2a4f808a78646badefcd13a6e995d369898f443 Author: Stefano Garzarella Date: Tue Apr 4 15:17:21 2023 +0200 vdpa_sim: make devices agnostic for work management Let's move work management inside the vdpa_sim core. This way we can easily change how we manage the works, without having to change the devices each time. Acked-by: Eugenio Pérez Martin Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20230404131721.45886-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 42823a871fd4e17b34034f43b36ae57bd2ed8a67 Author: Stefano Garzarella Date: Tue Apr 4 15:17:16 2023 +0200 vringh: support VA with iotlb vDPA supports the possibility to use user VA in the iotlb messages. So, let's add support for user VA in vringh to use it in the vDPA simulators. Acked-by: Eugenio Pérez Signed-off-by: Stefano Garzarella Message-Id: <20230404131716.45855-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit f609d6cbb36ab1c9c7434f67d555c57a2f7d3dde Author: Stefano Garzarella Date: Tue Apr 4 15:13:21 2023 +0200 vringh: define the stride used for translation Define a macro to be reused in the different parts of the code. Useful for the next patches where we add more arrays to manage also translations with user VA. Suggested-by: Eugenio Perez Martin Signed-off-by: Stefano Garzarella Message-Id: <20230404131326.44403-5-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit c0371782500c5314741da9ccbfbf0375a0d379fc Author: Stefano Garzarella Date: Tue Apr 4 15:13:20 2023 +0200 vringh: replace kmap_atomic() with kmap_local_page() kmap_atomic() is deprecated in favor of kmap_local_page() since commit f3ba3c710ac5 ("mm/highmem: Provide kmap_local*"). With kmap_local_page() the mappings are per thread, CPU local, can take page-faults, and can be called from any context (including interrupts). Furthermore, the tasks can be preempted and, when they are scheduled to run again, the kernel virtual addresses are restored and still valid. kmap_atomic() is implemented like a kmap_local_page() which also disables page-faults and preemption (the latter only for !PREEMPT_RT kernels, otherwise it only disables migration). The code within the mappings/un-mappings in getu16_iotlb() and putu16_iotlb() don't depend on the above-mentioned side effects of kmap_atomic(), so that mere replacements of the old API with the new one is all that is required (i.e., there is no need to explicitly add calls to pagefault_disable() and/or preempt_disable()). This commit reuses a "boiler plate" commit message from Fabio, who has already did this change in several places. Cc: "Fabio M. De Francesco" Reviewed-by: Fabio M. De Francesco Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20230404131326.44403-4-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 9067de4725a299bc1baf11de9f5040fdd0bd05c3 Author: Stefano Garzarella Date: Tue Apr 4 15:13:19 2023 +0200 vhost-vdpa: use bind_mm/unbind_mm device callbacks When the user call VHOST_SET_OWNER ioctl and the vDPA device has `use_va` set to true, let's call the bind_mm callback. In this way we can bind the device to the user address space and directly use the user VA. The unbind_mm callback is called during the release after stopping the device. Signed-off-by: Stefano Garzarella Message-Id: <20230404131326.44403-3-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit c618c84d4ccc6268c3da7609c7388b6cb305c639 Author: Stefano Garzarella Date: Tue Apr 4 15:13:18 2023 +0200 vdpa: add bind_mm/unbind_mm callbacks These new optional callbacks is used to bind/unbind the device to a specific address space so the vDPA framework can use VA when these callbacks are implemented. Suggested-by: Jason Wang Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20230404131326.44403-2-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 905233af513c0c6971cae0f25280f23be1f6cbe4 Author: Stefano Garzarella Date: Fri Mar 31 10:02:08 2023 +0200 vringh: fix typos in the vringh_init_* documentation Replace `userpace` with `userspace`. Cc: Simon Horman Signed-off-by: Stefano Garzarella Message-Id: <20230331080208.17002-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Acked-by: Jason Wang commit b774f93d87e198481680873b22c2a443e10c3f93 Author: Xie Yongji Date: Thu Mar 23 13:30:43 2023 +0800 vduse: Support specifying bounce buffer size via sysfs As discussed in [1], this adds sysfs interface to support specifying bounce buffer size in virtio-vdpa case. It would be a performance tuning parameter for high throughput workloads. [1] https://lore.kernel.org/netdev/e8f25a35-9d45-69f9-795d-bdbbb90337a3@redhat.com/ Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20230323053043.35-12-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit d4438d23eeeef8bb1b3a8abe418abffd60bb544a Author: Xie Yongji Date: Thu Mar 23 13:30:42 2023 +0800 vduse: Delay iova domain creation Delay creating iova domain until the vduse device is registered to vdpa bus. This is a preparation for adding sysfs interface to support specifying bounce buffer size for the iova domain. Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20230323053043.35-11-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit e38632dd71818d99bcebeb55f27dc764a9f7d547 Author: Xie Yongji Date: Thu Mar 23 13:30:41 2023 +0800 vduse: Signal vq trigger eventfd directly if possible Now the vdpa callback will associate an trigger eventfd in some cases. For performance reasons, VDUSE can signal it directly during irq injection. Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20230323053043.35-10-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 5e68470f4e80a4120e9ecec408f6ab4ad386bd4a Author: Xie Yongji Date: Thu Mar 23 13:30:40 2023 +0800 vdpa: Add eventfd for the vdpa callback Add eventfd for the vdpa callback so that user can signal it directly instead of triggering the callback. It will be used for vhost-vdpa case. Signed-off-by: Xie Yongji Message-Id: <20230323053043.35-9-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 66640f4a6fcc1861d1b1f9b36b65a218064f263f Author: Xie Yongji Date: Thu Mar 23 13:30:39 2023 +0800 vduse: Add sysfs interface for irq callback affinity Add sysfs interface for each vduse virtqueue to get/set the affinity for irq callback. This might be useful for performance tuning when the irq callback affinity mask contains more than one CPU. Signed-off-by: Xie Yongji Message-Id: <20230323053043.35-8-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit bfae1648ec2159da0a14d71a7d75b810f728a1e6 Author: Xie Yongji Date: Thu Mar 23 13:30:38 2023 +0800 vduse: Support get_vq_affinity callback This implements get_vq_affinity callback so that the virtio-blk driver can build the blk-mq queues based on the irq callback affinity. Signed-off-by: Xie Yongji Message-Id: <20230323053043.35-7-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 28f6288eb63d5979fa6758e64f52e4d55cf184a8 Author: Xie Yongji Date: Thu Mar 23 13:30:37 2023 +0800 vduse: Support set_vq_affinity callback Since virtio-vdpa bus driver already support interrupt affinity spreading mechanism, let's implement the set_vq_affinity callback to bring it to vduse device. After we get the virtqueue's affinity, we can spread IRQs between CPUs in the affinity mask, in a round-robin manner, to run the irq callback. Signed-off-by: Xie Yongji Message-Id: <20230323053043.35-6-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 78885597b9ccf68d4ce554aec98db01ee3c2d3fc Author: Xie Yongji Date: Thu Mar 23 13:30:36 2023 +0800 vduse: Refactor allocation for vduse virtqueues Allocate memory for vduse virtqueues one by one instead of doing one allocation for all of them. This is a preparation for adding sysfs interface for virtqueues. Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20230323053043.35-5-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 3dad56823b5332ffdbe1867b2d7b50fbacea124a Author: Xie Yongji Date: Thu Mar 23 13:30:35 2023 +0800 virtio-vdpa: Support interrupt affinity spreading mechanism To support interrupt affinity spreading mechanism, this makes use of group_cpus_evenly() to create an irq callback affinity mask for each virtqueue of vdpa device. Then we will unify set_vq_affinity callback to pass the affinity to the vdpa device driver. Signed-off-by: Xie Yongji Message-Id: <20230323053043.35-4-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 1d24692732fb299c94b0dcc032b48ac8fa85c854 Author: Xie Yongji Date: Thu Mar 23 13:30:34 2023 +0800 vdpa: Add set/get_vq_affinity callbacks in vdpa_config_ops This introduces set/get_vq_affinity callbacks in vdpa_config_ops to support virtqueue affinity management for vdpa device drivers. Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20230323053043.35-3-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit aaf0594829c3a6f16bdf5d30904a7db4548dae15 Author: Xie Yongji Date: Thu Mar 23 13:30:33 2023 +0800 lib/group_cpus: Export group_cpus_evenly() Export group_cpus_evenly() so that some modules can make use of it to group CPUs evenly according to NUMA and CPU locality. Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20230323053043.35-2-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit e9d67e59f151eae964f749af74dbe4bd3b01b0d2 Author: Eli Cohen Date: Tue Mar 21 13:28:09 2023 +0200 vdpa/mlx5: Extend driver support for new features Extend the possible list for features that can be supported by firmware. Note that different versions of firmware may or may not support these features. The driver is made aware of them by querying the firmware. While doing this, improve the code so we use enum names instead of hard coded numerical values. The new features supported by the driver are the following: VIRTIO_NET_F_MRG_RXBUF VIRTIO_NET_F_HOST_ECN VIRTIO_NET_F_GUEST_ECN VIRTIO_NET_F_GUEST_TSO6 VIRTIO_NET_F_GUEST_TSO4 Reviewed-by: Si-Wei Liu Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20230321112809.221432-3-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez Martin commit 791a1cb7b8591ece6a5075dfed803da379e7ecd3 Author: Eli Cohen Date: Tue Mar 21 13:28:08 2023 +0200 vdpa/mlx5: Make VIRTIO_NET_F_MRG_RXBUF off by default Following patch adds driver support for VIRTIO_NET_F_MRG_RXBUF. Current firmware versions show degradation in packet rate when using MRG_RXBUF. Users who favor memory saving over packet rate could enable this feature but we want to keep it off by default. One can still enable it when creating the vdpa device using vdpa tool by providing features that include it. For example: $ vdpa dev add name vdpa0 mgmtdev pci/0000:86:00.2 device_features 0x300cb982b Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20230321112809.221432-2-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu commit a084983dcd4e75616fe4102c690d2fc922ac32b5 Author: Feng Liu Date: Wed Mar 15 20:54:56 2023 +0200 virtio_ring: Allow non power of 2 sizes for packed virtqueue According to the Virtio Specification, the Queue Size parameter of a virtqueue corresponds to the maximum number of descriptors in that queue, and it does not have to be a power of 2 for packed virtqueues. However, the virtio_pci_modern driver enforced a power of 2 check for virtqueue sizes, which is unnecessary and restrictive for packed virtuqueue. Split virtqueue still needs to check the virtqueue size is power_of_2 which has been done in vring_alloc_queue_split of the virtio_ring layer. To validate this change, we tested various virtqueue sizes for packed rings, including 128, 256, 512, 100, 200, 500, and 1000, with CONFIG_PAGE_POISONING enabled, and all tests passed successfully. Signed-off-by: Feng Liu Reviewed-by: Jiri Pirko Message-Id: <20230315185458.11638-2-feliu@nvidia.com> Signed-off-by: Michael S. Tsirkin commit bea273c7a8712a055cd504a2bb7d76d8d713ba6e Author: Mike Christie Date: Mon Mar 20 21:06:24 2023 -0500 vhost-scsi: Reduce vhost_scsi_mutex use We on longer need to hold the vhost_scsi_mutex the entire time we set/clear the endpoint. The tv_tpg_mutex handles tpg accesses not related to the tpg list, the port link/unlink functions use the tv_tpg_mutex while accessing the tpg->vhost_scsi pointer, vhost_scsi_do_plug will no longer queue events after the virtqueue's backend has been cleared and flushed, and we don't drop our refcount to the tpg until after we have stopped cmds and wait for outstanding cmds to complete. This moves the vhost_scsi_mutex use to it's documented use of being used to access the tpg list. We then don't need to hold it while a flush is being performed causing other device's vhost_scsi_set_endpoint and vhost_scsi_make_tpg/vhost_scsi_drop_tpg calls to have to wait on a flakey device. Signed-off-by: Mike Christie Message-Id: <20230321020624.13323-8-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit f5ed6f9e82ee62bf805551522dfa2d6c8030bb47 Author: Mike Christie Date: Mon Mar 20 21:06:23 2023 -0500 vhost-scsi: Drop vhost_scsi_mutex use in port callouts We are using the vhost_scsi_mutex to make sure vhost_scsi_port_link and vhost_scsi_port_unlink see if vhost_scsi_clear_endpoint has cleared tpg->vhost_scsi and it can't be freed while they are using. However, we currently set the tpg->vhost_scsi pointer while holding tv_tpg_mutex. So, we can just hold that while calling vhost_scsi_hotplug/hotunplug. We then don't need to hold the vhost_scsi_mutex while vhost_scsi_clear_endpoint is holding it and doing a flush which could cause the LUN map/unmap to have to wait on another device's flush. Signed-off-by: Mike Christie Message-Id: <20230321020624.13323-7-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit ced9eb376ab716ec5b06bef8c3e05608b8eb6700 Author: Mike Christie Date: Mon Mar 20 21:06:22 2023 -0500 vhost-scsi: Check for a cleared backend before queueing an event We currenly hold the vhost_scsi_mutex while clearing the endpoint and while performing vhost_scsi_do_plug, so tpg->vhost_scsi can't be freed from uder us, and to make sure anything queued is handled by the full call in vhost_scsi_clear_endpoint. This patch removes the need for the vhost_scsi_mutex for the latter case. In the next patches, we won't hold the vhost_scsi_mutex while flushing so this patch adds a check for the clearing of the virtqueue from vhost_scsi_clear_endpoint. We then know that once vhost_scsi_clear_endpoint has cleared the backend that no new events will be queued, and the flush after the vhost_vq_set_backend(vq, NULL) call will see everything that's been queued to that point. So the flush will then handle all events without the need for the vhost_scsi_mutex. Signed-off-by: Mike Christie Message-Id: <20230321020624.13323-6-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit eb1b291466376ad4d2f0a42392a2cd9f0e4983e5 Author: Mike Christie Date: Mon Mar 20 21:06:21 2023 -0500 vhost-scsi: Drop device mutex use in vhost_scsi_do_plug We don't need the device mutex in vhost_scsi_do_plug because: 1. we have the vhost_scsi_mutex so the tpg->vhost_scsi pointer will not change on us and the vhost_scsi can't be freed from under us if it was set. 2. vhost_scsi_clear_endpoint will stop the virtqueues and flush them while holding the vhost_scsi_mutex so we know once vhost_scsi_clear_endpoint has completed that vhost_scsi_do_plug can't send new events and any queued ones have completed. So this patch drops the device mutex use in vhost_scsi_do_plug. Signed-off-by: Mike Christie Message-Id: <20230321020624.13323-5-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 9a10cb4de33f4c914bd2e33ac05cff3ddb6a67b0 Author: Mike Christie Date: Mon Mar 20 21:06:20 2023 -0500 vhost-scsi: Delay releasing our refcount on the tpg We currently hold the vhost_scsi_mutex the entire time we are running vhost_scsi_clear_endpoint. One of the reasons for this is that it prevents userspace from being able to free the se_tpg from under us after we have called target_undepend_item. However, it forces management operations for for other devices to have to wait on a flakey device's: vhost_scsi_clear_endpoint -> vhost_scsi_flush() call which can which can take a long time. This moves the target_undepend_item call and the tpg unsetup code to after we have stopped new IO from starting up and after we have waited on running IO. We can then release our refcount on the tpg and session knowing our device is no longer accessing them. We can then drop the vhost_scsi_mutex use during thee flush call in later patches in this set, when we have removed other reasons for holding it. Signed-off-by: Mike Christie Message-Id: <20230321020624.13323-4-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 4b6ec919b84830949313c805c586fb34f141ce0c Author: Feng Liu Date: Fri Mar 10 07:34:28 2023 +0200 virtio_ring: Use const to annotate read-only pointer params Add const to make the read-only pointer parameters clear, similar to many existing functions. To implement this change, the commit also introduces the use of `container_of_const` to implement `to_vvq`, which ensures the const-ness of read-only parameters and avoids accidental modification of their members. Signed-off-by: Feng Liu Reviewed-by: Jiri Pirko Reviewed-by: Parav Pandit Reviewed-by: Gavin Li Reviewed-by: Bodong Wang Message-Id: <20230310053428.3376-4-feliu@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 1adbd6b2fc0c09645c4c30c5eb47beaa3e6ea4b4 Author: Feng Liu Date: Fri Mar 10 07:34:27 2023 +0200 virtio_ring: Avoid using inline for small functions According to kernel coding style [1], defining inline functions is not necessary and beneficial for simple functions. Hence clean up the code by removing the inline keyword. It is verified with GCC 12.2.0, the generated code with/without inline is same. Additionally tested with pktgen and iperf, and verified the result, the pps test results are the same in the cases of with/without inline. Iperf and pps of pktgen for virtio-net didn't change before and after the change. [1] https://www.kernel.org/doc/html/v6.2-rc3/process/coding-style.html#the-inline-disease Signed-off-by: Feng Liu Reviewed-by: Jiri Pirko Reviewed-by: Parav Pandit Reviewed-by: Gavin Li Reviewed-by: Bodong Wang Reviewed-by: David Edmondson Message-Id: <20230310053428.3376-3-feliu@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 6b27cd84a7917b995f66c052fd3453fdbd6e3d70 Author: Rong Tao Date: Thu Mar 9 16:42:50 2023 +0800 tools/virtio: virtio_test -h,--help should return directly When we get help information, we should return directly, and we should not execute test cases. Move the exit() directly into the help() function and remove it from case '?'. Signed-off-by: Rong Tao Message-Id: Signed-off-by: Michael S. Tsirkin commit 9b2b3de63c07123c0ec9b912d7b8e77b150e520b Author: Rong Tao Date: Thu Mar 9 14:13:20 2023 +0800 tools/virtio: virtio_test: Fix indentation Replace eight spaces with Tab. Signed-off-by: Rong Tao Message-Id: Signed-off-by: Michael S. Tsirkin commit 48cd6bc5b22d68b8bbc8601f3c7ddeed99541a0b Author: Christophe JAILLET Date: Sat Feb 18 09:10:31 2023 +0100 virtio: Reorder fields in 'struct virtqueue' Group some variables based on their sizes to reduce hole and avoid padding. On x86_64, this shrinks the size of 'struct virtqueue' from 72 to 68 bytes. It saves a few bytes of memory. Signed-off-by: Christophe JAILLET Message-Id: <8f3d2e49270a2158717e15008e7ed7228196ba02.1676707807.git.christophe.jaillet@wanadoo.fr> Signed-off-by: Michael S. Tsirkin Acked-by: Peter Lafreniere Reviewed-by: Stefano Garzarella commit e4be66e5f36b8cd2a052ba9e2ba063e6c37f5453 Author: Jacob Keller Date: Mon Feb 27 13:41:27 2023 -0800 vhost: use struct_size and size_add to compute flex array sizes The vhost_get_avail_size and vhost_get_used_size functions compute the size of structures with flexible array members with an additional 2 bytes if the VIRTIO_RING_F_EVENT_IDX feature flag is set. Convert these functions to use struct_size() and size_add() instead of coding the calculation by hand. This ensures that the calculations will saturate at SIZE_MAX rather than overflowing. Signed-off-by: Jacob Keller Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: virtualization@lists.linux-foundation.org Cc: kvm@vger.kernel.org Message-Id: <20230227214127.3678392-1-jacob.e.keller@intel.com> Signed-off-by: Michael S. Tsirkin commit c384c2401eed99a2e1f84191e573f15b898babe6 Author: Eli Cohen Date: Mon Apr 17 14:03:43 2023 +0300 vdpa/mlx5: Avoid losing link state updates Current code ignores link state updates if VIRTIO_NET_F_STATUS was not negotiated. However, link state updates could be received before feature negotiation was completed , therefore causing link state events to be lost, possibly leaving the link state down. Modify the code so link state notifier is registered after DRIVER_OK was negotiated and carry the registration only if VIRTIO_NET_F_STATUS was negotiated. Unregister the notifier when the device is reset. Fixes: 033779a708f0 ("vdpa/mlx5: make MTU/STATUS presence conditional on feature bits") Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20230417110343.138319-1-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit ec8f32ad9a65a8cbb465b69e154aaec9d2fe45c4 Author: Leon Romanovsky Date: Wed Apr 19 15:19:08 2023 +0300 xfrm: Fix leak of dev tracker At the stage of direction checks, the netdev reference tracker is already initialized, but released with wrong *_put() call. Fixes: 919e43fad516 ("xfrm: add an interface to offload policy") Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Signed-off-by: Steffen Klassert commit 94b95dfaa814f565d92f5a65f0ff12a483095522 Author: Leon Romanovsky Date: Wed Apr 19 15:19:07 2023 +0300 xfrm: release all offloaded policy memory Failure to add offloaded policy will cause to the following error once user will try to reload driver. Unregister_netdevice: waiting for eth3 to become free. Usage count = 2 This was caused by xfrm_dev_policy_add() which increments reference to net_device. That reference was supposed to be decremented in xfrm_dev_policy_free(). However the latter wasn't called. unregister_netdevice: waiting for eth3 to become free. Usage count = 2 leaked reference. xfrm_dev_policy_add+0xff/0x3d0 xfrm_policy_construct+0x352/0x420 xfrm_add_policy+0x179/0x320 xfrm_user_rcv_msg+0x1d2/0x3d0 netlink_rcv_skb+0xe0/0x210 xfrm_netlink_rcv+0x45/0x50 netlink_unicast+0x346/0x490 netlink_sendmsg+0x3b0/0x6c0 sock_sendmsg+0x73/0xc0 sock_write_iter+0x13b/0x1f0 vfs_write+0x528/0x5d0 ksys_write+0x120/0x150 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes: 919e43fad516 ("xfrm: add an interface to offload policy") Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Signed-off-by: Steffen Klassert commit 836a3de6b2bfe0b7c96a7104d3d567883d8a57b3 Author: Michael Ellerman Date: Thu Apr 20 15:21:49 2023 +1000 powerpc/configs/powernv: Add IGB=y Some powernv machines use IGB for networking, so build the driver in to enable net booting such machines. Suggested-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230420052149.1328094-1-mpe@ellerman.id.au commit da66ed3198162882755d5c9a147e36f02dc9be93 Author: Michael Ellerman Date: Thu Apr 20 15:16:09 2023 +1000 powerpc/configs/64s: Drop JFS Filesystem Unlikely that anyone is still regularly using JFS, drop it from the defconfig. Suggested-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230420051609.1324201-2-mpe@ellerman.id.au commit e4c02c3e6c39c3866d517388f6bb431c47743bde Author: Michael Ellerman Date: Thu Apr 20 15:16:08 2023 +1000 powerpc/configs/64s: Use EXT4 to mount EXT2 filesystems The ext4 code will mount ext2 filesystems, no need to build in both. Suggested-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230420051609.1324201-1-mpe@ellerman.id.au commit 9ecda934f43b1502c420653b02d54d4ffd7ae4cb Author: Michael Ellerman Date: Fri Apr 14 23:24:15 2023 +1000 powerpc/configs: Make pseries_defconfig an alias for ppc64le_guest Rather than trying to keep multiple configs up to date, make pseries_defconfig an alias for ppc64le_guest_defconfig. NOTE, pseries_defconfig was a big endian config, but this commit switches it to little endian. Almost all distros are ppc64le these days, so little endian is much more likely to be what a user wants when they build for "pseries". For an actual big endian guest, use ppc64_guest_defconfig. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-32-mpe@ellerman.id.au commit 596ddea8be17b5f4e2f72a0c9af313444d51d177 Author: Michael Ellerman Date: Fri Apr 14 23:24:14 2023 +1000 powerpc/configs: Make pseries_le an alias for ppc64le_guest Rather than trying to keep multiple configs up to date, make pseries_le_defconfig an alias for ppc64le_guest_defconfig. ppc64le_guest_defconfig should work in all cases that pseries_le_defconfig currently does, but if not we can update it. Move pseries_le_defconfig down in the Makefile, so it appears after ppc64le_guest_defconfig in the help output. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-31-mpe@ellerman.id.au commit bac949621c40ec09357c6a8beaacac235ae39239 Author: Michael Ellerman Date: Fri Apr 14 23:24:13 2023 +1000 powerpc/configs: Incorporate generic kvm_guest.config into guest configs Incorporate the generic kvm_guest.config into the powerpc guest configs, ppc64[le]_guest_defconfig. This brings in some useful options, in particular 9P support, and also means future additions to the generic file will be automatically picked up by the powerpc configs. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-30-mpe@ellerman.id.au commit 9ee937539e9bd0bef2ad845b3dfa34fa997775c5 Author: Michael Ellerman Date: Fri Apr 14 23:24:12 2023 +1000 powerpc/configs: Add IBMVETH=y and IBMVNIC=y to guest configs These drivers are sometimes required to have functional networking in a guest, so build them in when building ppc64[le]_guest_defconfig. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-29-mpe@ellerman.id.au commit 4f6cfb53646794a2dc14210fbfedd5c6db38ba2c Author: Michael Ellerman Date: Fri Apr 14 23:24:11 2023 +1000 powerpc/configs/64s: Enable Device Mapper options Add device mapper options for test coverage and in case folks are booting systems that require them. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-28-mpe@ellerman.id.au commit 262a3589df8cd28c152c46c166be9e552da90ed3 Author: Michael Ellerman Date: Fri Apr 14 23:24:10 2023 +1000 powerpc/configs/64s: Enable PSTORE Like pseries & powernv_defconfig, enable PSTORE. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-27-mpe@ellerman.id.au commit 48b2e99def2d92dbf2f7cb4b7f42ee8d98c56768 Author: Michael Ellerman Date: Fri Apr 14 23:24:09 2023 +1000 powerpc/configs/64s: Enable VLAN support Most other configs, and distros enable it. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-26-mpe@ellerman.id.au commit 22f615cb87af5a26c0ac91d02020575edb5aeb89 Author: Michael Ellerman Date: Fri Apr 14 23:24:08 2023 +1000 powerpc/configs/64s: Enable BLK_DEV_NVME Copy powernv_defconfig and enable BLK_DEV_NVME. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-25-mpe@ellerman.id.au commit a4f64f73b6a368c067beae20e0fac6625e8768cb Author: Michael Ellerman Date: Fri Apr 14 23:24:07 2023 +1000 powerpc/configs/64s: Drop REISERFS No reason to use this anymore. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-24-mpe@ellerman.id.au commit 649181aea2be6deaa1c9aef66e765a7ba0d077c5 Author: Michael Ellerman Date: Fri Apr 14 23:24:06 2023 +1000 powerpc/configs/64s: Use SHA512 for module signatures Modern distros use SHA512 for module signing. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-23-mpe@ellerman.id.au commit 6880db8fe1d042b164473fd865ee2ec6f5ee3df6 Author: Michael Ellerman Date: Fri Apr 14 23:24:05 2023 +1000 powerpc/configs/64s: Enable IO_STRICT_DEVMEM Distros enable it. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-22-mpe@ellerman.id.au commit d3a85f29c30d9876440c03933b3793607f616ed6 Author: Michael Ellerman Date: Fri Apr 14 23:24:04 2023 +1000 powerpc/configs/64s: Enable SCHEDSTATS Distros enable it. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-21-mpe@ellerman.id.au commit 3c18a2094ffe06626f09c923067ab284b294d5c6 Author: Michael Ellerman Date: Fri Apr 14 23:24:03 2023 +1000 powerpc/configs/64s: Enable DEBUG_VM & other options Fedora enables DEBUG_VM, which has led to occasions where a VM_BUG_ON() is not caught by upstream testing, but rather is first found in Fedora, which is not how it's meant to be. PAGE_OWNER & PAGE_POISONING both need to be enabled on the kernel command line, so should not add much overhead in normal operation. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-20-mpe@ellerman.id.au commit 7ccad8eee0d92f7566e4f9e12f2f26d74885f1a5 Author: Michael Ellerman Date: Fri Apr 14 23:24:02 2023 +1000 powerpc/configs/64s: Enable EMULATED_STATS This is enabled in some of the other powerpc configs, and can be useful for debugging, so enable it in ppc64[le]_defconfig. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-19-mpe@ellerman.id.au commit 5029aa2a47bd18c654a20a6b1a84b9e418189ad9 Author: Michael Ellerman Date: Fri Apr 14 23:24:01 2023 +1000 powerpc/configs/64s: Enable KUNIT and most tests All built as modules, so the tests only happen when the modules are loaded, not affecting normal boot time. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-18-mpe@ellerman.id.au commit 69c483660ef9735a71ca280f48584068c903c278 Author: Michael Ellerman Date: Fri Apr 14 23:24:00 2023 +1000 powerpc/configs/64s: Enable SELINUX Fedora, CentOS, RHEL & SUSE all enable it. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-17-mpe@ellerman.id.au commit 2e46fbe0881b18e4e338035958e1f49263629ca1 Author: Michael Ellerman Date: Fri Apr 14 23:23:59 2023 +1000 powerpc/configs/64s: Enable YAMA, LANDLOCK & BPF LSMs Multiple distros enable these. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-16-mpe@ellerman.id.au commit 40605274cf9b26f921df6d1875e3cf6fcc22dec0 Author: Michael Ellerman Date: Fri Apr 14 23:23:58 2023 +1000 powerpc/configs/64s: Enable SLAB hardening options Fedora & CentOS enable these. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-15-mpe@ellerman.id.au commit 90ae13b654ee58d5d0d0152d196d0419021273e6 Author: Michael Ellerman Date: Fri Apr 14 23:23:57 2023 +1000 powerpc/configs/64s: Enable ZSWAP & ZRAM Most distros enable these. In particular Fedore uses zram in the default install. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-14-mpe@ellerman.id.au commit b92c4675f0b20ccf493449c02357f0ff1241f6db Author: Michael Ellerman Date: Fri Apr 14 23:23:56 2023 +1000 powerpc/configs/64s: Enable CHECKPOINT_RESTORE Most distros enable this. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-13-mpe@ellerman.id.au commit 6c95035e06e8c38ce8d9a74f53ac49ede86e584f Author: Michael Ellerman Date: Fri Apr 14 23:23:55 2023 +1000 powerpc/configs/64s: Enable common CGROUP & related options Distros enable these options. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-12-mpe@ellerman.id.au commit ea87ec60e96e55ed034fbf1f91300b9bf12e412a Author: Michael Ellerman Date: Fri Apr 14 23:23:54 2023 +1000 powerpc/configs/64s: Enable NO_HZ_FULL At least Fedora & SUSE enable it. VIRT_CPU_ACCOUNTING_GEN is selected so no longer needs to be in the defconfig. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-11-mpe@ellerman.id.au commit 88e284b64b0b3193fc3c451d12e912f58375904c Author: Michael Ellerman Date: Fri Apr 14 23:23:53 2023 +1000 powerpc/configs/64s: Enable common accounting options These options are enabled by most distros. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-10-mpe@ellerman.id.au commit 1b813ac21b5d2c142bcbe0dbd58a23dcc8594d59 Author: Michael Ellerman Date: Fri Apr 14 23:23:52 2023 +1000 powerpc/configs/64s: Enable AUDIT Essentially all distros enable it. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-9-mpe@ellerman.id.au commit 3a4b71786e9828a0b85600013da7fbe8cb3d0138 Author: Michael Ellerman Date: Fri Apr 14 23:23:51 2023 +1000 powerpc/configs/64s: Enable PREEMPT_VOLUNTARY Traditionally on powerpc servers PREEMPT_NONE was used, but these days multiple distros are building with PREEMPT_VOLUNTARY - Ubuntu, Fedora & CentOS all enable it. So update the upstream config to reflect that, and get test coverage before code hits the distros. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-8-mpe@ellerman.id.au commit e0fe568ebbc0705fe2fe4ea62be752fad9d801d0 Author: Michael Ellerman Date: Fri Apr 14 23:23:50 2023 +1000 powerpc/configs/64s: Select ARCH_WANT_DEFAULT_BPF_JIT Tell the generic BPF code that the JIT should be enabled by default, rather than the interpreter. Most distros use CONFIG_BPF_JIT_ALWAYS_ON=y anyway, so this just updates upstream to more closely match that. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-7-mpe@ellerman.id.au commit d892ed0420e20a6423a165fdebb228590ece5f95 Author: Michael Ellerman Date: Fri Apr 14 23:23:49 2023 +1000 powerpc/configs/64s: Add secure boot options to defconfig Add the numerous options required to get secure boot enabled. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-6-mpe@ellerman.id.au commit 64fcdb2930290c84a65147410551857e60a7db2c Author: Michael Ellerman Date: Fri Apr 14 23:23:48 2023 +1000 powerpc/configs/64s: Enable PAPR_SCM This is a powerpc specific driver so add the symbols required to enable it so it gets some build/boot test coverage. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-5-mpe@ellerman.id.au commit 94d0b37feedc3701d5da4f69448d12352f437837 Author: Michael Ellerman Date: Fri Apr 14 23:23:47 2023 +1000 powerpc/configs/6s: Drop obsolete crypto ALGs These algorithms were marked obsolete in commit 1674aea5f080 ("crypto: Kconfig - mark unused ciphers as obsolete"). Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-4-mpe@ellerman.id.au commit 1ce7fda142af48f5c603cc72061e4e8bd32edab6 Author: Michael Ellerman Date: Fri Apr 14 23:23:46 2023 +1000 powerpc/configs/64s: Drop IPV6 which is default y Since commit de551f2eb22a ("net: Build IPv6 into kernel by default"), IPV6 is default y. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-3-mpe@ellerman.id.au commit 91c4ef9539c439af454674b0a617f1b855056066 Author: Michael Ellerman Date: Fri Apr 14 23:23:45 2023 +1000 powerpc/configs/64s: Drop SPLPAR which is default y SPLPAR is default y since commit 20c0e8269e9d ("powerpc/pseries: Implement paravirt qspinlocks for SPLPAR"), so doesn't need to be in the defconfig. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-2-mpe@ellerman.id.au commit cc876c7a245979e3e860da66a693fc5d94543010 Author: Michael Ellerman Date: Fri Apr 14 23:23:44 2023 +1000 powerpc/configs/64s: Update defconfig for symbol movement Update ppc64_defconfig to account for symbols moving around, no actual changes. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230414132415.821564-1-mpe@ellerman.id.au commit 22db99d673641d37c4e184ca8cff95d8441986af Author: Michael Ellerman Date: Wed Mar 29 18:23:34 2023 +1100 powerpc/Makefile: Add generated defconfigs to help output Currently none of the generated defconfigs appear in the help output, because the help text discovers defconfigs by looking for actual files named "*_defconfig". Collect the generated defconfig names into a variable and then print those out in archhelp. Output looks like eg: pseries_le_defconfig - Build for pseries_le ppc64le_defconfig - Build for ppc64le ppc64le_guest_defconfig - Build for ppc64le_guest ... ppc64_randconfig - Build for ppc64_randconfig adder875_defconfig - Build for adder875 amigaone_defconfig - Build for amigaone Signed-off-by: Michael Ellerman [mpe: Fix PHONY bug which broke in-tree build, thanks rmclure] Link: https://msgid.link/20230329072334.2023357-2-mpe@ellerman.id.au commit 8f40fc0808137c157dd408d2632e63bfca2aecdb Author: Wesley Cheng Date: Thu Apr 20 14:27:59 2023 -0700 usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API Several sequences utilize the same routine for forcing the control endpoint back into the SETUP phase. This is required, because those operations need to ensure that EP0 is back in the default state. Acked-by: Thinh Nguyen Signed-off-by: Wesley Cheng Link: https://lore.kernel.org/r/20230420212759.29429-3-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 39674be56fba1cd3a03bf4617f523a35f85fd2c1 Author: Wesley Cheng Date: Thu Apr 20 14:27:58 2023 -0700 usb: dwc3: gadget: Execute gadget stop after halting the controller Do not call gadget stop until the poll for controller halt is completed. DEVTEN is cleared as part of gadget stop, so the intention to allow ep0 events to continue while waiting for controller halt is not happening. Fixes: c96683798e27 ("usb: dwc3: ep0: Don't prepare beyond Setup stage") Cc: stable@vger.kernel.org Acked-by: Thinh Nguyen Signed-off-by: Wesley Cheng Link: https://lore.kernel.org/r/20230420212759.29429-2-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 2f3a247c3994ece3acb7616965b656622bbf5243 Merge: 7ab75456be144 baa951a1c1771 Author: Jakub Kicinski Date: Thu Apr 20 20:20:51 2023 -0700 Merge branch 'net-extend-drop-reasons' Johannes Berg says: ==================== net: extend drop reasons Here's v4 of the extended drop reasons, with fixes to kernel-doc and checkpatch. ==================== Link: https://lore.kernel.org/r/20230419125254.20789-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit baa951a1c1771810f3a378a95fc93e81953027d5 Author: Johannes Berg Date: Wed Apr 19 14:52:54 2023 +0200 mac80211: use the new drop reasons infrastructure It can be really hard to analyse or debug why packets are going missing in mac80211, so add the needed infrastructure to use use the new per-subsystem drop reasons. We actually use two drop reason subsystems here because of the different handling of frames that are dropped but still go to monitor for old versions of hostapd, and those that are just completely unusable (e.g. crypto failed.) Annotate a few reasons here just to illustrate this, we'll need to go through and annotate more of them later. Signed-off-by: Johannes Berg Signed-off-by: Jakub Kicinski commit 071c0fc6fb919dcf29c676a842dda08a674877d7 Author: Johannes Berg Date: Wed Apr 19 14:52:53 2023 +0200 net: extend drop reasons for multiple subsystems Extend drop reasons to make them usable by subsystems other than core by reserving the high 16 bits for a new subsystem ID, of which 0 of course is used for the existing reasons immediately. To still be able to have string reasons, restructure that code a bit to make the loopup under RCU, the only user of this (right now) is drop_monitor. Link: https://lore.kernel.org/netdev/00659771ed54353f92027702c5bbb84702da62ce.camel@sipsolutions.net Signed-off-by: Johannes Berg Signed-off-by: Jakub Kicinski commit 5b8285cca6fed9bc5baabe2e5699a5a5c0d96371 Author: Johannes Berg Date: Wed Apr 19 14:52:52 2023 +0200 net: move dropreason.h to dropreason-core.h This will, after the next patch, hold only the core drop reasons and minimal infrastructure. Fix a small kernel-doc issue while at it, to avoid the move triggering a checker. Signed-off-by: Johannes Berg Signed-off-by: Jakub Kicinski commit 7ab75456be144a354fbb3df1516d82fc24d3d67d Author: Mahesh Bandewar Date: Tue Apr 18 18:32:38 2023 -0700 ipv6: add icmpv6_error_anycast_as_unicast for ICMPv6 ICMPv6 error packets are not sent to the anycast destinations and this prevents things like traceroute from working. So create a setting similar to ECHO when dealing with Anycast sources (icmpv6_echo_ignore_anycast). Signed-off-by: Mahesh Bandewar Reviewed-by: David Ahern Reviewed-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20230419013238.2691167-1-maheshb@google.com Signed-off-by: Jakub Kicinski commit b7b871f5dc4c854f3c1f444397493c7a7bc79c73 Merge: 787e6144aef74 e6991384ace5c Author: Jakub Kicinski Date: Thu Apr 20 20:03:24 2023 -0700 Merge branch 'ethtool-mm-api-consolidation' Vladimir Oltean says: ==================== ethtool mm API consolidation This series consolidates the behavior of the 2 drivers that implement the ethtool MAC Merge layer by making NXP ENETC commit its preemptible traffic classes to hardware only when MM TX is active (same as Ocelot). Then, after resolving an issue with the ENETC driver, it restricts user space from entering 2 states which don't make sense: - pmac-enabled off tx-enabled on verify-enabled * - pmac-enabled * tx-enabled off verify-enabled on Then, it introduces a selftest (ethtool_mm.sh) which puts everything together and tests all valid configurations known to me. This is simultaneously the v2 of "[PATCH net-next 0/2] ethtool mm API improvements": https://lore.kernel.org/netdev/20230415173454.3970647-1-vladimir.oltean@nxp.com/ which had caused some problems to openlldp. Those were solved in the meantime, see: https://github.com/intel/openlldp/commit/11171b474f6f3cbccac5d608b7f26b32ff72c651 and of "[RFC PATCH net-next] selftests: forwarding: add a test for MAC Merge layer": https://lore.kernel.org/netdev/20230210221243.228932-1-vladimir.oltean@nxp.com/ ==================== Link: https://lore.kernel.org/r/20230418111459.811553-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit e6991384ace5c9cbbe453ad1d8998b0cdaf222f5 Author: Vladimir Oltean Date: Tue Apr 18 14:14:59 2023 +0300 selftests: forwarding: add a test for MAC Merge layer The MAC Merge layer (IEEE 802.3-2018 clause 99) does all the heavy lifting for Frame Preemption (IEEE 802.1Q-2018 clause 6.7.2), a TSN feature for minimizing latency. Preemptible traffic is different on the wire from normal traffic in incompatible ways. If we send a preemptible packet and the link partner doesn't support preemption, it will drop it as an error frame and we will never know. The MAC Merge layer has a control plane of its own, which can be manipulated (using ethtool) in order to negotiate this capability with the link partner (through LLDP). Actually the TLV format for LLDP solves this problem only partly, because both partners only advertise: - if they support preemption (RX and TX) - if they have enabled preemption (TX) so we cannot tell the link partner what to do - we cannot force it to enable reception of our preemptible packets. That is fully solved by the verification feature, where the local device generates some small probe frames which look like preemptible frames with no useful content, and the link partner is obliged to respond to them if it supports the standard. If the verification times out, we know that preemption isn't active in our TX direction on the link. Having clarified the definition, this selftest exercises the manual (ethtool) configuration path of 2 link partners (with and without verification), and the LLDP code path, using the openlldp project. The test also verifies the TX activity of the MAC Merge layer by sending traffic through a traffic class configured as preemptible (using mqprio). There isn't a good way to make this really portable (user space cannot find out how many traffic classes there are for a device), but I chose num_tc 4 here, that should work reasonably well. I also know that some devices (stmmac) only permit TXQ0 to be preemptible, so this is why PREEMPTIBLE_PRIO was strategically chosen as 0. Even if other hardware is more configurable, this test should cover the baseline. This is not really a "forwarding" selftest, but I put it near the other "ethtool" selftests. $ ./ethtool_mm.sh eno0 swp0 TEST: Manual configuration with verification: eno0 to swp0 [ OK ] TEST: Manual configuration with verification: swp0 to eno0 [ OK ] TEST: Manual configuration without verification: eno0 to swp0 [ OK ] TEST: Manual configuration without verification: swp0 to eno0 [ OK ] TEST: Manual configuration with failed verification: eno0 to swp0 [ OK ] TEST: Manual configuration with failed verification: swp0 to eno0 [ OK ] TEST: LLDP [ OK ] Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit b5bf7126a6a0e706ef0e6c6cd22b2ebc23bf54a2 Author: Vladimir Oltean Date: Tue Apr 18 14:14:58 2023 +0300 selftests: forwarding: introduce helper for standard ethtool counters Counters for the MAC Merge layer and preemptible MAC have standardized so far on using structured ethtool stats as opposed to the driver specific names and meanings. Benefit from that rare opportunity and introduce a helper to lib.sh for querying standardized counters, in the hope that these will take off for other uses as well. Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 8fcac79270cae2e07e5475b682bc425b71e80595 Author: Petr Machata Date: Tue Apr 18 14:14:57 2023 +0300 selftests: forwarding: generalize bail_on_lldpad from mlxsw mlxsw selftests often invoke a bail_on_lldpad() helper to make sure LLDPAD is not running, to prevent conflicts between the QoS configuration applied through TC or DCB command line tool, and the DCB configuration that LLDPAD might apply. This helper might be useful to others. Move the function to lib.sh, and parameterize to make reusable in other contexts. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 54e906f1639e195bcb52725aab6814e2af922540 Author: Petr Machata Date: Tue Apr 18 14:14:56 2023 +0300 selftests: forwarding: sch_tbf_*: Add a pre-run hook The driver-specific wrappers of these selftests invoke bail_on_lldpad to make sure that LLDPAD doesn't trample the configuration. The function bail_on_lldpad is going to move to lib.sh in the next patch. With that, it won't be visible for the wrappers before sourcing the framework script. And after sourcing it, it is too late: the selftest will have run by then. One option might be to source NUM_NETIFS=0 lib.sh from the wrapper, but even if that worked (it might, it might not), that seems cumbersome. lib.sh is doing fair amount of stuff, and even if it works today, it does not look particularly solid as a solution. Instead, introduce a hook, sch_tbf_pre_hook(), that when available, gets invoked. Move the bail to the hook. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 35b288d6e3d467f6f7bf466fee6184b275999f14 Author: Vladimir Oltean Date: Tue Apr 18 14:14:55 2023 +0300 net: ethtool: mm: sanitize some UAPI configurations The verify-enabled boolean (ETHTOOL_A_MM_VERIFY_ENABLED) was intended to be a sub-setting of tx-enabled (ETHTOOL_A_MM_TX_ENABLED). IOW, MAC Merge TX can be enabled with or without verification, but verification with TX disabled makes no sense. The pmac-enabled boolean (ETHTOOL_A_MM_PMAC_ENABLED) was intended to be a global toggle from an API perspective, whereas tx-enabled just handles the TX direction. IOW, the pMAC can be enabled with or without TX, but it doesn't make sense to enable TX if the pMAC is not enabled. Add two checks which sanitize and reject these invalid cases. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 16a2c7634442b48ff24177d04b7ce429840b102e Author: Vladimir Oltean Date: Tue Apr 18 14:14:54 2023 +0300 net: enetc: include MAC Merge / FP registers in register dump These have been useful in debugging various problems related to frame preemption, so make them available through ethtool --register-dump for later too. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 827145392a4aad635b93e5235b7d7fecc2fa31c7 Author: Vladimir Oltean Date: Tue Apr 18 14:14:53 2023 +0300 net: enetc: only commit preemptible TCs to hardware when MM TX is active This was left as TODO in commit 01e23b2b3bad ("net: enetc: add support for preemptible traffic classes") since it's relatively complicated. Where this makes a difference is with a configuration as follows: ethtool --set-mm eno0 pmac-enabled on tx-enabled on verify-enabled on Preemptible packets should only be sent when the MAC Merge TX direction becomes active (i.o.w. when the verification process succeeds, aka when the link partner confirms it can process preemptible traffic). But the tc qdisc with the preemptible traffic classes is offloaded completely asynchronously w.r.t. the MM becoming active. The ENETC manual does suggest that this should be handled in the driver: "On startup, software should wait for the verification process to complete (MMCSR[VSTS]=011) before initiating traffic". Adding the necessary logic allows future selftests to uphold the claim that an inactive or disabled MAC Merge layer should never send data packets through the pMAC. This change moves enetc_set_ptcfpr() from enetc.c to enetc_ethtool.c, where its only caller is now - enetc_mm_commit_preemptible_tcs(). Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 153b5b1d030de3f94ecac4eec73854e4710ca6ba Author: Vladimir Oltean Date: Tue Apr 18 14:14:52 2023 +0300 net: enetc: report mm tx-active based on tx-enabled and verify-status The MMCSR register contains 2 fields with overlapping meaning: - LPA (Local preemption active): This read-only status bit indicates whether preemption is active for this port. This bit will be set if preemption is both enabled and has completed the verification process. - TXSTS (Merge status): This read-only status field provides the state of the MAC Merge sublayer transmit status as defined in IEEE Std 802.3-2018 Clause 99. 00 Transmit preemption is inactive 01 Transmit preemption is active 10 Reserved 11 Reserved However none of these 2 fields offer reliable reporting to software. When connecting ENETC to a link partner which is not capable of Frame Preemption, the expectation is that ENETC's verification should fail (VSTS=4) and its MM TX direction should be inactive (LPA=0, TXSTS=00) even though the MM TX is enabled (ME=1). But surprise, the LPA bit of MMCSR stays set even if VSTS=4 and ME=1. OTOH, the TXSTS field has the opposite problem. I cannot get its value to change from 0, even when connecting to a link partner capable of frame preemption, which does respond to its verification frames (ME=1 and VSTS=3, "SUCCEEDED"). The only option with such buggy hardware seems to be to reimplement the formula for calculating tx-active in software, which is for tx-enabled to be true, and for the verify-status to be either SUCCEEDED, or DISABLED. Without reliable tx-active reporting, we have no good indication when to commit the preemptible traffic classes to hardware, which makes it possible (but not desirable) to send preemptible traffic to a link partner incapable of receiving it. However, currently we do not have the logic to wait for TX to be active yet, so the impact is limited. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 59be75db5966f920bf5cccfd2a34b3bf222660d7 Author: Vladimir Oltean Date: Tue Apr 18 14:14:51 2023 +0300 net: enetc: fix MAC Merge layer remaining enabled until a link down event Current enetc_set_mm() is designed to set the priv->active_offloads bit ENETC_F_QBU for enetc_mm_link_state_update() to act on, but if the link is already up, it modifies the ENETC_MMCSR_ME ("Merge Enable") bit directly. The problem is that it only *sets* ENETC_MMCSR_ME if the link is up, it doesn't *clear* it if needed. So subsequent enetc_get_mm() calls still see tx-enabled as true, up until a link down event, which is when enetc_mm_link_state_update() will get called. This is not a functional issue as far as I can assess. It has only come up because I'd like to uphold a simple API rule in core ethtool code: the pMAC cannot be disabled if TX is going to be enabled. Currently, the fact that TX remains enabled for longer than expected (after the enetc_set_mm() call that disables it) is going to violate that rule, which is how it was caught. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 787e6144aef74e73f88875cb5d3a5af01701af6f Author: Slark Xiao Date: Thu Apr 20 10:36:17 2023 +0800 wwan: core: add print for wwan port attach/disconnect Refer to USB serial device or net device, there is a notice to let end user know the status of device, like attached or disconnected. Add attach/disconnect print for wwan device as well. Signed-off-by: Slark Xiao Reviewed-by: Loic Poulain Link: https://lore.kernel.org/r/20230420023617.3919569-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 4a892c0fe4bb0546d68a89fa595bd22cb4be2576 Author: Al Viro Date: Sun Aug 21 14:02:15 2022 -0400 fuse_dev_ioctl(): switch to fdget() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 2f31fa029d99f3614e76e3ea4f2e9832c13ba429 Author: Al Viro Date: Sun Aug 21 12:01:26 2022 -0400 cgroup_get_from_fd(): switch to fdget_raw() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 1d0027dc9a3c2be501de625feca2eaac7f67b509 Author: Al Viro Date: Wed Aug 3 20:13:33 2022 -0400 bpf: switch to fdget_raw() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 96e85e95dc22d53650cbd499e963c70103c06738 Author: Al Viro Date: Mon Jun 6 00:30:50 2022 -0400 build_mount_idmapped(): switch to fdget() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 38e124086282715e3b9b3d193d9308bb3499b46c Author: Al Viro Date: Sun May 15 18:16:54 2022 -0400 kill the last remaining user of proc_ns_fget() lookups by descriptor are better off closer to syscall surface... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit d2084fd84569fb7054c97ae6ffaf2755086fd267 Author: Al Viro Date: Sat May 14 19:45:22 2022 -0400 SVM-SEV: convert the rest of fget() uses to fdget() in there Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit e73d43760ad938428537dd6ccbb3653297a1bd69 Author: Al Viro Date: Sat May 14 19:40:47 2022 -0400 convert sgx_set_attribute() to fdget()/fdput() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 281117ccb2d2511d03f592dfec7ffdc33651e9b3 Author: Al Viro Date: Sat May 14 19:33:38 2022 -0400 convert setns(2) to fdget()/fdput() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 9bc37e04823b5280dd0f22b6680fc23fe81ca325 Author: Al Viro Date: Thu Mar 16 07:34:34 2023 +0900 fs: introduce lock_rename_child() helper Pass the dentry of a source file and the dentry of a destination directory to lock parent inodes for rename. As soon as this function returns, ->d_parent of the source file dentry is stable and inodes are properly locked for calling vfs-rename. This helper is needed for ksmbd server. rename request of SMB protocol has to rename an opened file, no matter which directory it's in. Signed-off-by: Al Viro Signed-off-by: Namjae Jeon Signed-off-by: Al Viro commit 211db0ac9e3dc6c46f2dd53395b34d76af929faf Author: Namjae Jeon Date: Thu Mar 16 07:34:33 2023 +0900 ksmbd: remove internal.h include Since vfs_path_lookup is exported, It should not be internal. Move vfs_path_lookup prototype in internal.h to linux/namei.h. Suggested-by: Al Viro Reviewed-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Al Viro commit 8fa66e4a1bdd41d55d7842928e60a40fed65715d Author: Jakub Kicinski Date: Wed Apr 19 19:00:05 2023 -0700 net: skbuff: update and rename __kfree_skb_defer() __kfree_skb_defer() uses the old naming where "defer" meant slab bulk free/alloc APIs. In the meantime we also made __kfree_skb_defer() feed the per-NAPI skb cache, which implies bulk APIs. So take away the 'defer' and add 'napi'. While at it add a drop reason. This only matters on the tx_action path, if the skb has a frag_list. But getting rid of a SKB_DROP_REASON_NOT_SPECIFIED seems like a net benefit so why not. Reviewed-by: Alexander Lobakin Link: https://lore.kernel.org/r/20230420020005.815854-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 61718206ee5de9cc2c3503c59287c0b968446508 Author: Jakub Kicinski Date: Wed Apr 19 18:58:02 2023 -0700 eth: mlx5: avoid iterator use outside of a loop Fix the following warning about risky iterator use: drivers/net/ethernet/mellanox/mlx5/core/eq.c:1010 mlx5_comp_irq_get_affinity_mask() warn: iterator used outside loop: 'eq' Acked-by: Saeed Mahameed Link: https://lore.kernel.org/r/20230420015802.815362-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8c966a10eb8478dea333a0f7f77b11c3cb3f7dcb Author: Simon Horman Date: Wed Apr 19 13:34:35 2023 +0200 flow_dissector: Address kdoc warnings Address a number of warnings flagged by ./scripts/kernel-doc -none include/net/flow_dissector.h include/net/flow_dissector.h:23: warning: Function parameter or member 'addr_type' not described in 'flow_dissector_key_control' include/net/flow_dissector.h:23: warning: Function parameter or member 'flags' not described in 'flow_dissector_key_control' include/net/flow_dissector.h:46: warning: Function parameter or member 'padding' not described in 'flow_dissector_key_basic' include/net/flow_dissector.h:145: warning: Function parameter or member 'tipckey' not described in 'flow_dissector_key_addrs' include/net/flow_dissector.h:157: warning: cannot understand function prototype: 'struct flow_dissector_key_arp ' include/net/flow_dissector.h:171: warning: cannot understand function prototype: 'struct flow_dissector_key_ports ' include/net/flow_dissector.h:203: warning: cannot understand function prototype: 'struct flow_dissector_key_icmp ' Also improve indentation on adjacent lines to those changed to address the above. No functional changes intended. Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20230419-flow-dissector-kdoc-v1-1-1aa0cca1118b@kernel.org Signed-off-by: Jakub Kicinski commit e375b503943f512cdd3a7dd12849972b7a006076 Author: Jeroen de Borst Date: Wed Apr 19 14:05:58 2023 -0700 gve: update MAINTAINERS This reflects role changes in our team. Signed-off-by: Jeroen de Borst Signed-off-by: Praveen Kaligineedi Link: https://lore.kernel.org/r/20230419210558.1893400-1-jeroendb@google.com Signed-off-by: Jakub Kicinski commit dd64b232deb8d48812a2ea739d1fedaeaffb59ed Author: Jakub Kicinski Date: Wed Apr 19 11:20:06 2023 -0700 page_pool: unlink from napi during destroy Jesper points out that we must prevent recycling into cache after page_pool_destroy() is called, because page_pool_destroy() is not synchronized with recycling (some pages may still be outstanding when destroy() gets called). I assumed this will not happen because NAPI can't be scheduled if its page pool is being destroyed. But I missed the fact that NAPI may get reused. For instance when user changes ring configuration driver may allocate a new page pool, stop NAPI, swap, start NAPI, and then destroy the old pool. The NAPI is running so old page pool will think it can recycle to the cache, but the consumer at that point is the destroy() path, not NAPI. To avoid extra synchronization let the drivers do "unlinking" during the "swap" stage while NAPI is indeed disabled. Fixes: 8c48eea3adf3 ("page_pool: allow caching from safely localized NAPI") Reported-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/all/e8df2654-6a5b-3c92-489d-2fe5e444135f@redhat.com/ Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/20230419182006.719923-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4bb7aac70b5d8a4bddf4ee0791b834f9f56883d2 Author: Arnd Bergmann Date: Thu Apr 20 10:45:51 2023 +0200 net: phy: fix circular LEDS_CLASS dependencies The CONFIG_PHYLIB symbol is selected by a number of device drivers that need PHY support, but it now has a dependency on CONFIG_LEDS_CLASS, which may not be enabled, causing build failures. Avoid the risk of missing and circular dependencies by guarding the phylib LED support itself in another Kconfig symbol that can only be enabled if the dependency is met. This could be made a hidden symbol and always enabled when both CONFIG_OF and CONFIG_LEDS_CLASS are reachable from the phylib, but there may be an advantage in having users see this option when they have a misconfigured kernel without built-in LED support. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Signed-off-by: Arnd Bergmann Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230420084624.3005701-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 034ff37d34071ff3f48755f728cd229e42a4f15d Author: Linus Torvalds Date: Thu Apr 20 15:13:50 2023 -0700 x86: rewrite '__copy_user_nocache' function I didn't really want to do this, but as part of all the other changes to the user copy loops, I've been looking at this horror. I tried to clean it up multiple times, but every time I just found more problems, and the way it's written, it's just too hard to fix them. For example, the code is written to do quad-word alignment, and will use regular byte accesses to get to that point. That's fairly simple, but it means that any initial 8-byte alignment will be done with cached copies. However, the code then is very careful to do any 4-byte _tail_ accesses using an uncached 4-byte write, and that was claimed to be relevant in commit a82eee742452 ("x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache()"). So if you do a 4-byte copy using that function, it carefully uses a 4-byte 'movnti' for the destination. But if you were to do a 12-byte copy that is 4-byte aligned, it would _not_ do a 4-byte 'movnti' followed by a 8-byte 'movnti' to keep it all uncached. Instead, it would align the destination to 8 bytes using a byte-at-a-time loop, and then do a 8-byte 'movnti' for the final 8 bytes. The main caller that cares is __copy_user_flushcache(), which knows about this insanity, and has odd cases for it all. But I just can't deal with looking at this kind of "it does one case right, and another related case entirely wrong". And the code really wasn't fixable without hard drugs, which I try to avoid. So instead, rewrite it in a form that hopefully not only gets this right, but is a bit more maintainable. Knock wood. Signed-off-by: Linus Torvalds commit 081abcacaf0a9505c0d4cc9780b12e6ce5d33630 Author: Vlad Buslov Date: Thu Apr 13 15:06:59 2023 +0200 Revert "net/mlx5e: Don't use termination table when redundant" This reverts commit 14624d7247fcd0f3114a6f5f17b3c8d1020fbbb7. The termination table usage is requires for DMFS steering mode as firmware doesn't support mixed table destinations list which causes following syndrome with hairpin rules: [81922.283225] mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 25977): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xaca205), err(-22) Fixes: 14624d7247fc ("net/mlx5e: Don't use termination table when redundant") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 1b540decd03acd736693aabb6cb46c71fca38ae6 Author: Aya Levin Date: Sun Mar 12 16:37:36 2023 +0200 net/mlx5e: Nullify table pointer when failing to create On failing to create promisc flow steering table, the pointer is returned with an error. Nullify it so unloading the driver won't try to destroy a non existing table. Failing to create promisc table may happen over BF devices when the ARM side is going through a firmware tear down. The host side start a reload flow. While the driver unloads, it tries to remove the promisc table. Remove WARN in this state as it is a valid error flow. Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit dfad99750c0f83b0242572a573afa2c055f85b36 Author: Moshe Shemesh Date: Sun Apr 2 06:49:53 2023 +0300 net/mlx5: Use recovery timeout on sync reset flow Use the same timeout for sync reset flow and health recovery flow, since the former involves driver's recovery from firmware reset, which is similar to health recovery. Otherwise, in some cases, such as a firmware upgrade on the DPU, the firmware pre-init bit may not be ready within current timeout and the driver will abort loading back after reset. Signed-off-by: Moshe Shemesh Fixes: 37ca95e62ee2 ("net/mlx5: Increase FW pre-init timeout for health recovery") Reviewed-by: Maher Sanalla Signed-off-by: Saeed Mahameed commit 21608a2cf38e9f743636b5f86507ffbca18ecee7 Author: Moshe Shemesh Date: Sun Apr 9 10:44:31 2023 +0300 Revert "net/mlx5: Remove "recovery" arg from mlx5_load_one() function" This reverts commit 5977ac3910f1cbaf44dca48179118b25c206ac29. Revert this patch as we need the "recovery" arg back in mlx5_load_one() function. This arg will be used in the next patch for using recovery timeout during sync reset flow. Signed-off-by: Moshe Shemesh Reviewed-by: Maher Sanalla Signed-off-by: Saeed Mahameed commit 0a6b069cc60d68d33b4f6e7dd7f1adc3ec749766 Author: Roi Dayan Date: Wed Mar 29 15:24:32 2023 +0300 net/mlx5e: Fix error flow in representor failing to add vport rx rule On representor init rx error flow the flow steering pointer is being released so mlx5e_attach_netdev() doesn't have a valid fs pointer in its error flow. Make sure the pointer is nullified when released and add a check in mlx5e_fs_cleanup() to verify fs is not null as representor cleanup callback would be called anyway. Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer") Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 4fbef0f8ea6350eaea89b1e3175f9325252913ac Author: Chris Mi Date: Tue Apr 4 03:45:04 2023 +0300 net/mlx5: Release tunnel device after tc update skb The cited commit causes a regression. Tunnel device is not released after tc update skb if skb needs to be freed. The following error message will be printed: unregister_netdevice: waiting for vxlan1 to become free. Usage count = 11 Fix it by releasing tunnel device if skb needs to be freed. Fixes: 93a1ab2c545b ("net/mlx5: Refactor tc miss handling to a single function") Signed-off-by: Chris Mi Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 4c8189302567f75099a336b0efcff8291ec86ff4 Author: Chris Mi Date: Fri Mar 10 09:56:08 2023 +0200 net/mlx5: E-switch, Don't destroy indirect table in split rule Source port rewrite (forward to ovs internal port or statck device) isn't supported in the rule of split action. So there is no indirect table in split rule. The cited commit destroyes indirect table in split rule. The indirect table for other rules will be destroyed wrongly. It will cause traffic loss. Fix it by removing the destroy function in split rule. And also remove the destroy function in error flow. Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading") Signed-off-by: Chris Mi Reviewed-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit fd745f4c0abe41ebb09d11bf622b054a0f3e7b49 Author: Chris Mi Date: Fri Mar 10 11:06:48 2023 +0200 net/mlx5: E-switch, Create per vport table based on devlink encap mode Currently when creating per vport table, create flags are hardcoded. Devlink encap mode is set based on user input and HW capability. Create per vport table based on devlink encap mode. Fixes: c796bb7cd230 ("net/mlx5: E-switch, Generalize per vport table API") Signed-off-by: Chris Mi Reviewed-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 8ac04a28144cfa89b61be518268233742c23d88d Author: Vlad Buslov Date: Fri Mar 24 17:52:17 2023 +0100 net/mlx5e: Release the label when replacing existing ct entry Cited commit doesn't release the label mapping when replacing existing ct entry which leads to following memleak report: unreferenced object 0xffff8881854cf280 (size 96): comm "kworker/u48:74", pid 23093, jiffies 4296664564 (age 175.944s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002722d368>] __kmalloc+0x4b/0x1c0 [<00000000cc44e18f>] mapping_add+0x6e8/0xc90 [mlx5_core] [<000000003ad942a7>] mlx5_get_label_mapping+0x66/0xe0 [mlx5_core] [<00000000266308ac>] mlx5_tc_ct_entry_create_mod_hdr+0x1c4/0xf50 [mlx5_core] [<000000009a768b4f>] mlx5_tc_ct_entry_add_rule+0x16f/0xaf0 [mlx5_core] [<00000000a178f3e5>] mlx5_tc_ct_block_flow_offload_add+0x10cb/0x1f90 [mlx5_core] [<000000007b46c496>] mlx5_tc_ct_block_flow_offload+0x14a/0x630 [mlx5_core] [<00000000a9a18ac5>] nf_flow_offload_tuple+0x1a3/0x390 [nf_flow_table] [<00000000d0881951>] flow_offload_work_handler+0x257/0xd30 [nf_flow_table] [<000000009e4935a4>] process_one_work+0x7c2/0x13e0 [<00000000f5cd36a7>] worker_thread+0x59d/0xec0 [<00000000baed1daf>] kthread+0x28f/0x330 [<0000000063d282a4>] ret_from_fork+0x1f/0x30 Fix the issue by correctly releasing the label mapping. Fixes: 94ceffb48eac ("net/mlx5e: Implement CT entry update") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit e9fce818fe003b6c527f25517b9ac08eb4661b5d Author: Vlad Buslov Date: Wed Mar 22 09:52:26 2023 +0100 net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5e_clone_flow_attr_for_post_act(). Creating another copy in mlx5e_tc_post_act_add() is a erroneous leftover from original implementation. Instead, assign handle->attribute to post_attr provided by the caller. Note that cloning the attribute second time is not just wasteful but also causes issues like second copy not being properly updated in neigh update code which leads to following use-after-free: Feb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0 Feb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22) Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22 Feb 21 09:02:00 c-237-177-40-045 kernel: Call Trace: Feb 21 09:02:00 c-237-177-40-045 kernel: Feb 21 09:02:00 c-237-177-40-045 kernel: dump_stack_lvl+0x57/0x7d Feb 21 09:02:00 c-237-177-40-045 kernel: print_report+0x170/0x471 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: ? __module_address.part.0+0x62/0x200 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: ? __raw_spin_lock_init+0x3b/0x110 Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: add_rule_fg+0xe80/0x19c0 [mlx5_core] -- Feb 21 09:02:00 c-237-177-40-045 kernel: Allocated by task 13476: Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: post_process_attr+0x305/0xa30 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core] -- Feb 21 09:02:00 c-237-177-40-045 kernel: Freed by task 8833: Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0 Feb 21 09:02:00 c-237-177-40-045 kernel: __kmem_cache_free+0x1de/0x400 Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_packet_reformat_dealloc+0xad/0x100 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_encap_flows_del+0x3c0/0x500 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_update_flows+0x40c/0xa80 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_neigh_update+0x473/0x7a0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: process_one_work+0x7c2/0x1310 Feb 21 09:02:00 c-237-177-40-045 kernel: worker_thread+0x59d/0xec0 Feb 21 09:02:00 c-237-177-40-045 kernel: kthread+0x28f/0x330 Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit f9c895a72a390656f9582e048fdcc3d2cec1dd7c Author: Roi Dayan Date: Wed Mar 22 10:21:46 2023 +0200 net/mlx5: Update op_mode to op_mod for port selection To be consistent with the other enum keys use OP_MOD instead of OP_MODE. Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 38d9a740f68d8bbe92029cdd9eb6259e3974e52a Author: Roi Dayan Date: Tue Mar 21 15:40:02 2023 +0200 net/mlx5: E-Switch, Remove unused mlx5_esw_offloads_vport_metadata_set() Remove unused function which also seems a duplicate of esw_port_metadata_set(). Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 8ca52ada6267fb67d31a5bf7d568a54d793c759e Author: Roi Dayan Date: Tue Mar 21 10:32:03 2023 +0200 net/mlx5: E-Switch, Remove redundant dev arg from mlx5_esw_vport_alloc() The passded esw->dev is redundant as esw being passed and esw->dev being used inside. Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 45e261b7b821139556d039b69c9101207c152a50 Author: Eli Cohen Date: Sun Apr 2 15:17:09 2023 +0300 net/mlx5: Include linux/pci.h for pci_msix_can_alloc_dyn() Add include directive to assure pci_msix_can_alloc_dyn() prototype. Fixes: 3354822cde5a ("net/mlx5: Use dynamic msix vectors allocation") Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202303291328.sNmTyyWF-lkp@intel.com/ Signed-off-by: Eli Cohen Signed-off-by: Saeed Mahameed commit a880f814739c84fa11e17ac87c91fb711c185610 Author: Dragos Tatulea Date: Thu Apr 13 17:14:05 2023 +0300 net/mlx5e: RX, Hook NAPIs to page pools Linking the NAPI to the rq page_pool to improve page_pool cache usage during skb recycling. Here are the observed improvements for a iperf single stream test case: - For 1500 MTU and legacy rq, seeing a 20% improvement of cache usage. - For 9K MTU, seeing 33-40 % page_pool cache usage improvements for both striding and legacy rq (depending if the application is running on the same core as the rq or not). Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 40afb3b14496afb01d5b3d028444e09d29b95559 Author: Dragos Tatulea Date: Mon Apr 3 20:03:11 2023 +0300 net/mlx5e: RX, Fix XDP_TX page release for legacy rq nonlinear case When the XDP handler marks the data for transmission (XDP_TX), it is incorrect to release the page fragment. Instead, the fragments should be marked as MLX5E_WQE_FRAG_SKIP_RELEASE because XDP will release the page directly to the page_pool (page_pool_put_defragged_page) after TX completion. The linear case already does this. This patch fixes the nonlinear part as well. Also, the looping over the fragments was incorrect: When handling pages after XDP_TX in the legacy rq nonlinear case, the loop was skipping the first wqe fragment. Fixes: 3f93f82988bc ("net/mlx5e: RX, Defer page release in legacy rq for better recycling") Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit c8e9090233a70b8bbd8a73521a7a81856695732f Author: Dragos Tatulea Date: Thu Mar 30 19:37:00 2023 +0300 net/mlx5e: RX, Fix releasing page_pool pages twice for striding RQ mlx5e_free_rx_descs is responsible for calling the dealloc_wqe op which returns pages to the page_pool. This can happen during flush or close. For XSK, the regular RQ is flushed (when replaced by the XSK RQ) and also closed later. This is normally not a problem as the wqe list is empty on a second call to mlx5e_free_rx_descs. However, for striding RQ, the previously released wqes from the list will appear as missing and will be released a second time by mlx5e_free_rx_missing_descs. This patch sets the no release bits on the striding RQ wqes in the dealloc_wqe op to prevent releasing the pages a second time. Please note that the bits are set only in the control path during close and not in the data path. Fixes: 4c2a13236807 ("net/mlx5e: RX, Defer page release in striding rq for better recycling") Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit cf14af140a5ad0937d385ce693100f33f02e9c54 Author: Maher Sanalla Date: Tue Mar 21 13:33:00 2023 +0200 net/mlx5e: Add vnic devlink health reporter to representors Create a new devlink health reporter for representor interface, which reports the values of representor vnic diagnostic counters when diagnosed. This patch will allow admins to monitor VF diagnostic counters through the representor-interface vnic reporter. Example of usage: $ devlink health diagnose pci/0000:08:00.0/65537 reporter vnic vNIC env counters: total_error_queues: 0 send_queue_priority_update_flow: 0 comp_eq_overrun: 0 async_eq_overrun: 0 cq_overrun: 0 invalid_command: 0 quota_exceeded_command: 0 nic_receive_steering_discard: 0 Signed-off-by: Maher Sanalla Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit b0bc615df488abd0e95107e4a9ecefb9bf8c250a Author: Maher Sanalla Date: Tue Mar 21 00:10:16 2023 +0200 net/mlx5: Add vnic devlink health reporter to PFs/VFs Create a vnic devlink health reporter for PFs/VFs interfaces. The reporter's diagnose callback displays the values of vNIC/vport transport debug counters of PFs/VFs, as follows: $ devlink health diagnose pci/0000:08:00.0 reporter vnic vNIC env counters: total_error_queues: 0 send_queue_priority_update_flow: 0 comp_eq_overrun: 0 async_eq_overrun: 0 cq_overrun: 0 invalid_command: 0 quota_exceeded_command: 0 nic_receive_steering_discard: 0 Moreover, add documentation on the reporter functionality and the counters description. While at it, expose the vNIC counters diagnose function to be used by the downstream patch, which will reveal the counters for representor interfaces. Signed-off-by: Maher Sanalla Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 0a431418f685e100c45ff150efaf4a5afa6f1982 Author: Maher Sanalla Date: Mon Mar 20 19:43:47 2023 +0200 Revert "net/mlx5: Expose vnic diagnostic counters for eswitch managed vports" This reverts commit 606e6a72e29dff9e3341c4cc9b554420e4793f401 which exposes the vnic diagnostic counters via debugfs. Instead, The upcoming series will expose the same counters through devlink health reporter. Signed-off-by: Maher Sanalla Signed-off-by: Saeed Mahameed commit e267b8a52ca5d5e8434929a5e9f5574aed141024 Author: Maher Sanalla Date: Mon Mar 20 19:43:27 2023 +0200 Revert "net/mlx5: Expose steering dropped packets counter" This reverts commit 4fe1b3a5f8fe2fdcedcaba9561e5b0ae5cb1d15b, which exposes the steering dropped packets counter via debugfs. The upcoming series will expose the counter via devlink health reporter instead of debugfs. Signed-off-by: Maher Sanalla Signed-off-by: Saeed Mahameed commit 57295e069cd8f7ac79f03d732ac17afb9f790ba5 Author: Yevgeny Kliteynik Date: Wed Nov 9 01:39:32 2022 +0200 net/mlx5: DR, Add memory statistics for domain object Add counters for number of buddies that are currently in use per domain per buddy type (STE, MODIFY-HEADER, MODIFY-PATTERN). Signed-off-by: Erez Shitrit Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit cedb6665bc331054a3477ac29ccac5e399c972da Author: Yevgeny Kliteynik Date: Wed Nov 9 01:35:24 2022 +0200 net/mlx5: DR, Add more info in domain dbg dump Add additinal items to domain info dump: Linux version and device name. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 72b2cff68405e91ee5e772385b68eb4442bcbf43 Author: Yevgeny Kliteynik Date: Tue Nov 8 17:45:03 2022 +0200 net/mlx5: DR, Calculate sync threshold of each pool according to its type When certain ICM chunk is no longer needed, it needs to be freed. Fully freeing ICM memory involves issuing FW SYNC_STEERING command. This is very time consuming, and it is impractical to do it for every freed chunk. Instead, we manage these 'freed' chunks in hot list (list of chunks that are not required by SW any more, but HW might still access them). When size of the hot list reaches certain threshold, we purge it and issue SYNC_STEERING FW command. There is one threshold for all the different ICM types, which is not optimal, as different ICM types require different approach: STEs pool is very large, and it is very 'dynamic' in its nature, so letting hot list to become too large will result in a significant perf hiccup when purging the hot list. Modify action is much smaller and less dynamic, so we can let the hot list to grow to almost the size of the whole pool. This patch fixes this problem: instead of having same hot memory threshold for all the pools, sync operation will be triggered in accordance with the ICM type. Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 075056005d8cceecbbb8e054d8e3cd2b7519d9c6 Author: Yevgeny Kliteynik Date: Sun Jan 1 00:20:53 2023 +0200 net/mlx5: DR, Fix dumping of legacy modify_hdr in debug dump The steering dump parser expects to see 0 as rewrite num of actions in case pattern/args aren't supported - parsing of legacy modify header is based on this assumption. Fix this to align to parser's expectation. Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 54d85d6966ca1dafa0b05f163a425060e8be3120 Author: Brian Masney Date: Tue Apr 11 15:21:53 2023 -0400 docs: clk: add documentation to log which clocks have been disabled The existing clk documentation has a section that talks about the clk_ignore_unused kernel parameter. Add additional documentation that describes how to log which clocks the kernel disables on bootup. This will log messages like the following to the console on bootup: [ 1.268115] clk: Disabling unused clocks [ 1.272167] clk_disable: gcc_usb_clkref_en [ 1.276389] clk_disable: gcc_usb30_sec_sleep_clk [ 1.281131] clk_disable: gcc_usb30_prim_sleep_clk ... Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20230411192153.289688-1-bmasney@redhat.com [jc: turned parameters into a literal block] Signed-off-by: Jonathan Corbet commit c9b951c3136fb04a9bb89deef5bba8e262410f68 Author: Lin Yu Chen Date: Wed Apr 12 11:37:39 2023 -0700 docs: trace: Fix typo in ftrace.rst There is a typo in the sentence "A kernel developer must be conscience ...". The word conscience should be conscious. This patch fixes it. Signed-off-by: Lin Yu Chen Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20230412183739.89894-1-starpt.official@gmail.com Signed-off-by: Jonathan Corbet commit c0d747a5b226f36cebdce6da3a3c54ba5a301455 Author: Krzysztof Kozlowski Date: Thu Apr 13 18:55:01 2023 +0200 Documentation/process: always CC responsible lists The "Select the recipients for your patch" part about CC-ing mailing lists is a bit vague and might be understood that only some lists should be Cc-ed. That's not what most of the maintainers expect. For given code, associated mailing list must always be CC-ed, because the list is used for reviewing and testing patches. Example are the Devicetree bindings patches, which are tested iff Devicetree mailing list is CC-ed. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230413165501.47442-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Corbet commit a110f8eb6a56d2796f59f6ced9b79d55bfd56839 Author: Lukas Bulwahn Date: Fri Apr 14 08:12:41 2023 +0200 docs: kmemleak: adjust to config renaming Commit c87db8ca0902 ("kmemleak-test: fix kmemleak_test.c build logic") essentially renames the config DEBUG_KMEMLEAK_TEST to SAMPLE_KMEMLEAK, but misses to adjust the documentation. Adjust kmemleak documentation to this config renaming. Signed-off-by: Lukas Bulwahn Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20230414061241.12754-1-lukas.bulwahn@gmail.com Signed-off-by: Jonathan Corbet commit 5c2c34a49be8fa534379c64579671feea52432b9 Author: Alexey Dobriyan Date: Sat Apr 15 20:37:29 2023 +0300 ELF: document some de-facto PT_* ABI quirks Turns out rules about PT_INTERP, PT_GNU_STACK and PT_GNU_PROPERTY program headers are slightly different. Signed-off-by: Alexey Dobriyan Link: https://lore.kernel.org/r/88d3f1bb-f4e0-4c40-9304-3843513a1262@p183 Signed-off-by: Jonathan Corbet commit 4de3790a6313dd6596ba7d0391ade94a21ee10b5 Author: Alain Volmat Date: Sun Apr 16 20:53:48 2023 +0200 Documentation: arm: remove stih415/stih416 related entries ST's STiH415 and STiH416 platforms support have been removed since a long time already. This commit updates the sti related documentation overview to remove related entries and update the sti part to add STiH407/STiH410 and STiH418 platforms which are still actively supported. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20230416185349.18156-1-avolmat@me.com Signed-off-by: Jonathan Corbet commit eaae75754d8192623a33a2d29bf1892c12965113 Author: Jonathan Corbet Date: Thu Apr 20 09:34:35 2023 -0600 docs: turn off "smart quotes" in the HTML build We have long disabled the "html_use_smartypants" option to prevent Sphinx from mangling "--" sequences (among others). Unfortunately, Sphinx changed that option to "smartquotes" in the 1.6.6 release, and seemingly didn't see fit to warn about the use of the obsolete option, resulting in the aforementioned mangling returning. Disable this behavior again and hope that the option name stays stable for a while. Reported-by: Zipeng Zhang Link: https://lore.kernel.org/lkml/tencent_CB1A298D31FD221496FF657CD7EF406E6605@qq.com Reviewed-by: Miguel Ojeda Signed-off-by: Jonathan Corbet commit 267a6e4e7870beb8896c192da175800e47c82407 Merge: 4b7ef71ac9778 cbb110bc6672f Author: Alexei Starovoitov Date: Thu Apr 20 16:49:17 2023 -0700 Merge branch 'fix __retval() being always ignored' Eduard Zingerman says: ==================== Florian Westphal found a bug in test_loader.c processing of __retval tag. Because of this bug the function test_loader.c:do_prog_test_run() never executed and all __retval test tags were ignored. See [1]. Fix for this bug uncovers two additional bugs: - During test_verifier tests migration to inline assembly (see [2]) I missed the fact that some tests require maps to contain mock values; - Some issue with a new refcounted_kptr test, which causes kernel to produce dead lock and refcount saturation warnings when subject to libbpf's bpf_test_run_opts(). This series fixes the bug in __retval() processing, and address the issue with test maps not being populated. The issue in refcounted_kptr is not addressed, __retval tags in those tests are commented out. I found that the following tests depend on test maps being populated: - progs/verifier_array_access.c - verifier/value_ptr_arith.c (planned for migration to inline assembly) Given the small amount of these tests I decided to opt for simple non-generic solution (see patch #4). [1] https://lore.kernel.org/bpf/f4c4aee644425842ee6aa8edf1da68f0a8260e7c.camel@gmail.com/T/ [2] https://lore.kernel.org/bpf/20230325025524.144043-1-eddyz87@gmail.com/ ==================== Signed-off-by: Alexei Starovoitov commit cbb110bc6672f785cab2cb308e9cfefee07af861 Author: Eduard Zingerman Date: Fri Apr 21 02:23:17 2023 +0300 selftests/bpf: populate map_array_ro map for verifier_array_access test Two test cases: - "valid read map access into a read-only array 1" and - "valid read map access into a read-only array 2" Expect that map_array_ro map is filled with mock data. This logic was not taken into acount during initial test conversion. This commit modifies prog_tests/verifier.c entry point for this test to fill the map. Fixes: a3c830ae0209 ("selftests/bpf: verifier/array_access.c converted to inline assembly") Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230420232317.2181776-5-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 5b22f4d1436b2693c7176a76be0ba6d30503bf7c Author: Eduard Zingerman Date: Fri Apr 21 02:23:16 2023 +0300 selftests/bpf: add pre bpf_prog_test_run_opts() callback for test_loader When a test case is annotated with __retval tag the test_loader engine would use libbpf's bpf_prog_test_run_opts() to do a test run of the program and compare retvals. This commit allows to perform arbitrary actions on bpf object right before test loader invokes bpf_prog_test_run_opts(). This could be used to setup some state for program execution, e.g. fill some maps. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230420232317.2181776-4-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 7cdddb99e4a69c26881d279472f1487cd67740c4 Author: Eduard Zingerman Date: Fri Apr 21 02:23:15 2023 +0300 selftests/bpf: fix __retval() being always ignored Florian Westphal found a bug in and suggested a fix for test_loader.c processing of __retval tag. Because of this bug the function test_loader.c:do_prog_test_run() never executed and all __retval test tags were ignored. If this bug is fixed a number of test cases from progs/verifier_array_access.c fail with retval not matching the expected value. This test was recently converted to use test_loader.c and inline assembly in [1]. When doing the conversion I missed the important detail of test_verifier.c operation: when it creates fixup_map_array_ro, fixup_map_array_wo and fixup_map_array_small it populates these maps with a dummy record. Disabling the __retval checks for the affected verifier_array_access in this commit to avoid false-postivies in any potential bisects. The issue is addressed in the next patch. I verified that the __retval tags are now respected by changing expected return values for all tests annotated with __retval, and checking that these tests started to fail. [1] https://lore.kernel.org/bpf/20230325025524.144043-1-eddyz87@gmail.com/ Fixes: 19a8e06f5f91 ("selftests/bpf: Tests execution support for test_loader.c") Reported-by: Florian Westphal Link: https://lore.kernel.org/bpf/f4c4aee644425842ee6aa8edf1da68f0a8260e7c.camel@gmail.com/T/ Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230420232317.2181776-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 7c4b96c00043f3b2cad50653f085c178fda92e62 Author: Eduard Zingerman Date: Fri Apr 21 02:23:14 2023 +0300 selftests/bpf: disable program test run for progs/refcounted_kptr.c Florian Westphal found a bug in test_loader.c processing of __retval tag. Because of this bug the function test_loader.c:do_prog_test_run() never executed and all __retval test tags were ignored. This hid an issue with progs/refcounted_kptr.c tests. When __retval tag bug is fixed and refcounted_kptr.c tests are run kernel reports various issues and eventually hangs. Shortest reproducer is the following command run a few times: $ for i in $(seq 1 4); do (./test_progs --allow=refcounted_kptr &); done Commenting out __retval tags for these tests until this issue is resolved. Reported-by: Florian Westphal Link: https://lore.kernel.org/bpf/f4c4aee644425842ee6aa8edf1da68f0a8260e7c.camel@gmail.com/T/ Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230420232317.2181776-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 4b7ef71ac977899cf7bdb09d66052926c7d249ff Author: Quentin Monnet Date: Thu Apr 20 01:33:33 2023 +0100 bpftool: Replace "__fallthrough" by a comment to address merge conflict The recent support for inline annotations in control flow graphs generated by bpftool introduced the usage of the "__fallthrough" macro in a switch/case block in btf_dumper.c. This change went through the bpf-next tree, but resulted in a merge conflict in linux-next, because this macro has been renamed "fallthrough" (no underscores) in the meantime. To address the conflict, we temporarily switch to a simple comment instead of a macro. Related: commit f7a858bffcdd ("tools: Rename __fallthrough to fallthrough") Fixes: 9fd496848b1c ("bpftool: Support inline annotations when dumping the CFG of a program") Reported-by: Sven Schnelle Reported-by: Thomas Richter Suggested-by: Daniel Borkmann Signed-off-by: Quentin Monnet Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/all/yt9dttxlwal7.fsf@linux.ibm.com/ Link: https://lore.kernel.org/bpf/20230412123636.2358949-1-tmricht@linux.ibm.com/ Link: https://lore.kernel.org/bpf/20230420003333.90901-1-quentin@isovalent.com commit b488ae52ef9f74155ab358f8c68e74327b45e0e1 Author: Michal Schmidt Date: Wed Apr 12 10:19:29 2023 +0200 ice: sleep, don't busy-wait, in the SQ send retry loop 10 ms is a lot of time to spend busy-waiting. Sleeping is clearly allowed here, because we have just returned from ice_sq_send_cmd(), which takes a mutex. On kernels with HZ=100, this msleep may be twice as long, but I don't think it matters. I did not actually observe any retries happening here. Signed-off-by: Michal Schmidt Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Simon Horman Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 43a630e37e259fee83ab3fd769c42e2fed97ca81 Author: Michal Schmidt Date: Wed Apr 12 10:19:28 2023 +0200 ice: remove unused buffer copy code in ice_sq_send_cmd_retry() The 'buf_cpy'-related code in ice_sq_send_cmd_retry() looks broken. 'buf' is nowhere copied into 'buf_cpy'. The reason this does not cause problems is that all commands for which 'is_cmd_for_retry' is true go with a NULL buf. Let's remove 'buf_cpy'. Add a WARN_ON in case the assumption no longer holds in the future. Signed-off-by: Michal Schmidt Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Simon Horman Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit f86d6f9c49f67b05d117495dc440aaa18c66a9da Author: Michal Schmidt Date: Wed Apr 12 10:19:27 2023 +0200 ice: sleep, don't busy-wait, for ICE_CTL_Q_SQ_CMD_TIMEOUT The driver polls for ice_sq_done() with a 100 µs period for up to 1 s and it uses udelay to do that. Let's use usleep_range instead. We know sleeping is allowed here, because we're holding a mutex (cq->sq_lock). To preserve the total max waiting time, measure the timeout in jiffies. ICE_CTL_Q_SQ_CMD_TIMEOUT is used also in ice_release_res(), but there the polling period is 1 ms (i.e. 10 times longer). Since the timeout was expressed in terms of the number of loops, the total timeout in this function is 10 s. I do not know if this is intentional. This patch keeps it. The patch lowers the CPU usage of the ice-gnss- kernel thread on my system from ~8 % to less than 1 %. I received a report of high CPU usage with ptp4l where the busy-waiting in ice_sq_send_cmd dominated the profile. This patch has been tested in that usecase too and it made a huge improvement there. Tested-by: Brent Rowsell Signed-off-by: Michal Schmidt Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Simon Horman Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 84817ab66fd0d9cde371fcb020f610ba808585bb Author: Michal Schmidt Date: Wed Apr 12 10:19:26 2023 +0200 ice: remove ice_ctl_q_info::sq_cmd_timeout sq_cmd_timeout is initialized to ICE_CTL_Q_SQ_CMD_TIMEOUT and never changed, so just use the constant directly. Suggested-by: Simon Horman Signed-off-by: Michal Schmidt Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Simon Horman Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0ec636e571f59b741d1eca47d439181f29f7f083 Author: Michal Schmidt Date: Wed Apr 12 10:19:25 2023 +0200 ice: increase the GNSS data polling interval to 20 ms Double the GNSS data polling interval from 10 ms to 20 ms. According to Karol Kolacinski from the Intel team, they have been planning to make this change. Signed-off-by: Michal Schmidt Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Simon Horman Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 2f8fdcb0a73a1831cc4f205f23493a17c0e5536f Author: Michal Schmidt Date: Wed Apr 12 10:19:24 2023 +0200 ice: do not busy-wait to read GNSS data The ice-gnss- kernel thread, which reads data from the u-blox GNSS module, keep a CPU core almost 100% busy. The main reason is that it busy-waits for data to become available. A simple improvement would be to replace the "mdelay(10);" in ice_gnss_read() with sleeping. A better fix is to not do any waiting directly in the function and just requeue this delayed work as needed. The advantage is that canceling the work from ice_gnss_exit() becomes immediate, rather than taking up to ~2.5 seconds (ICE_MAX_UBX_READ_TRIES * 10 ms). This lowers the CPU usage of the ice-gnss- thread on my system from ~90 % to ~8 %. I am not sure if the larger 0.1 s pause after inserting data into the gnss subsystem is really necessary, but I'm keeping that as it was. Of course, ideally the driver would not have to poll at all, but I don't know if the E810 can watch for GNSS data availability over the i2c bus by itself and notify the driver. Signed-off-by: Michal Schmidt Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Simon Horman Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 681c5b51dc6b8ff1ec05555243eccf64a08cb2fd Merge: e315e7b83a220 0f2a4af27b649 Author: Jakub Kicinski Date: Thu Apr 20 16:27:33 2023 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Adjacent changes: net/mptcp/protocol.h 63740448a32e ("mptcp: fix accept vs worker race") 2a6a870e44dd ("mptcp: stops worker on unaccepted sockets at listener close") ddb1a072f858 ("mptcp: move first subflow allocation at mpc access time") Signed-off-by: Jakub Kicinski commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 Author: Joe Damato Date: Sun Apr 16 19:12:23 2023 +0000 ixgbe: Enable setting RSS table to default values ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported by RSS. The driver should return the smaller of either: - The maximum number of RSS queues the device supports, OR - The number of RX queues configured Prior to this change, running `ethtool -X $iface default` fails if the number of queues configured is larger than the number supported by RSS, even though changing the queue count correctly resets the flowhash to use all supported queues. Other drivers (for example, i40e) will succeed but the flow hash will reset to support the maximum number of queues supported by RSS, even if that amount is smaller than the configured amount. Prior to this change: $ sudo ethtool -L eth1 combined 20 $ sudo ethtool -x eth1 RX flow hash indirection table for eth1 with 20 RX ring(s): 0: 0 1 2 3 4 5 6 7 8: 8 9 10 11 12 13 14 15 16: 0 1 2 3 4 5 6 7 24: 8 9 10 11 12 13 14 15 32: 0 1 2 3 4 5 6 7 ... You can see that the flowhash was correctly set to use the maximum number of queues supported by the driver (16). However, asking the NIC to reset to "default" fails: $ sudo ethtool -X eth1 default Cannot set RX flow hash configuration: Invalid argument After this change, the flowhash can be reset to default which will use all of the available RSS queues (16) or the configured queue count, whichever is smaller. Starting with eth1 which has 10 queues and a flowhash distributing to all 10 queues: $ sudo ethtool -x eth1 RX flow hash indirection table for eth1 with 10 RX ring(s): 0: 0 1 2 3 4 5 6 7 8: 8 9 0 1 2 3 4 5 16: 6 7 8 9 0 1 2 3 ... Increasing the queue count to 48 resets the flowhash to distribute to 16 queues, as it did before this patch: $ sudo ethtool -L eth1 combined 48 $ sudo ethtool -x eth1 RX flow hash indirection table for eth1 with 16 RX ring(s): 0: 0 1 2 3 4 5 6 7 8: 8 9 10 11 12 13 14 15 16: 0 1 2 3 4 5 6 7 ... Due to the other bugfix in this series, the flowhash can be set to use queues 0-5: $ sudo ethtool -X eth1 equal 5 $ sudo ethtool -x eth1 RX flow hash indirection table for eth1 with 16 RX ring(s): 0: 0 1 2 3 4 0 1 2 8: 3 4 0 1 2 3 4 0 16: 1 2 3 4 0 1 2 3 ... Due to this bugfix, the flowhash can be reset to default and use 16 queues: $ sudo ethtool -X eth1 default $ sudo ethtool -x eth1 RX flow hash indirection table for eth1 with 16 RX ring(s): 0: 0 1 2 3 4 5 6 7 8: 8 9 10 11 12 13 14 15 16: 0 1 2 3 4 5 6 7 ... Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls") Signed-off-by: Joe Damato Reviewed-by: Sridhar Samudrala Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 Author: Joe Damato Date: Sun Apr 16 19:12:22 2023 +0000 ixgbe: Allow flow hash to be set via ethtool ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool because the ethtool code in the kernel passes a non-zero value for hfunc that ixgbe should allow. When ethtool is called with `ETHTOOL_SRXFHINDIR`, `ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted. When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should also be accepted. Before this patch: $ sudo ethtool -L eth1 combined 10 $ sudo ethtool -X eth1 default Cannot set RX flow hash configuration: Invalid argument After this patch: $ sudo ethtool -L eth1 combined 10 $ sudo ethtool -X eth1 default $ sudo ethtool -x eth1 RX flow hash indirection table for eth1 with 10 RX ring(s): 0: 0 1 2 3 4 5 6 7 8: 8 9 0 1 2 3 4 5 16: 6 7 8 9 0 1 2 3 24: 4 5 6 7 8 9 0 1 ... Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh") Signed-off-by: Joe Damato Reviewed-by: Sridhar Samudrala Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 9c318a1d9b5000c77527011f158a75c5483510f5 Author: Long Li Date: Thu Apr 20 15:49:06 2023 -0700 Drivers: hv: move panic report code from vmbus to hv early init code The panic reporting code was added in commit 81b18bce48af ("Drivers: HV: Send one page worth of kmsg dump over Hyper-V during panic") It was added to the vmbus driver. The panic reporting has no dependence on vmbus, and can be enabled at an earlier boot time when Hyper-V is initialized. This patch moves the panic reporting code out of vmbus. There is no functionality changes. During moving, also refactored some cleanup functions into hv_kmsg_dump_unregister(). Signed-off-by: Long Li Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1682030946-6372-1-git-send-email-longli@linuxonhyperv.com Signed-off-by: Wei Liu commit 6ea5aa08857a81be7114b3c21d6aa6db0bc95f99 Author: Wedson Almeida Filho Date: Tue Apr 11 02:45:31 2023 -0300 rust: sync: introduce `LockClassKey` It is a wrapper around C's `lock_class_key`, which is used by the synchronisation primitives that are checked with lockdep. This is in preparation for introducing Rust abstractions for these primitives. Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Will Deacon Cc: Waiman Long Reviewed-by: Martin Rodriguez Reboredo Co-developed-by: Boqun Feng Signed-off-by: Boqun Feng Signed-off-by: Wedson Almeida Filho Reviewed-by: Gary Guo Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20230411054543.21278-1-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda commit b0cf5d50210df982878df53ab465e4377ea07065 Author: Miguel Ojeda Date: Thu Apr 13 00:18:22 2023 +0200 MAINTAINERS: add Benno Lossin as Rust reviewer Benno has been involved with the Rust for Linux project for the better part of a year now. He has been working on solving the safe pinned initialization problem [1], which resulted in the pin-init API patch series [2] that allows to reduce the need for `unsafe` code in the kernel. He is also working on the field projection RFC for Rust [3] to bring pin-init as a language feature. His expertise with the language will be very useful to have around in the future if Rust grows within the kernel, thus add him to the `RUST` entry as reviewer. Link: https://rust-for-linux.com/the-safe-pinned-initialization-problem [1] Link: https://lore.kernel.org/rust-for-linux/20230408122429.1103522-1-y86-dev@protonmail.com/ [2] Link: https://github.com/rust-lang/rfcs/pull/3318 [3] Cc: Benno Lossin Reviewed-by: Alex Gaynor Link: https://lore.kernel.org/r/20230412221823.830135-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 52a7f2deb4be8706bcbd16bba1d70eb2b5735d19 Author: Benno Lossin Date: Thu Apr 13 10:02:17 2023 +0000 rust: init: broaden the blanket impl of `Init` This makes it possible to use `T` as a `impl Init` for every error type `E` instead of just `Infallible`. Signed-off-by: Benno Lossin Reviewed-by: Gary Guo Reviewed-by: Martin Rodriguez Reboredo Link: https://lore.kernel.org/r/20230413100157.740697-1-benno.lossin@proton.me Signed-off-by: Miguel Ojeda commit 66ae0535167660e427f9fcadeee5d05646e2bb22 Author: Rob Herring Date: Mon Mar 27 12:01:53 2023 -0500 dt-bindings: rng: Drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Reviewed-by: Neil Armstrong Reviewed-by: Krzysztof Kozlowski Acked-by: Florian Fainelli #brcm,iproc-rng200 Link: https://lore.kernel.org/r/20230327170153.4105594-1-robh@kernel.org Signed-off-by: Rob Herring commit 09a8e5f01dfb30667a8f05e35c1cc073cb4fd134 Merge: fe15c26ee26ef ab072a3bfa0e9 Author: Bjorn Helgaas Date: Thu Apr 20 16:19:37 2023 -0500 Merge branch 'pci/controller/kconfig' - Use uniform language in Kconfig menu entries (Bjorn Helgaas) - Sort controller Kconfig entries by vendor (Bjorn Helgaas) * pci/controller/kconfig: PCI: xilinx: Drop obsolete dependency on COMPILE_TEST PCI: mobiveil: Sort Kconfig entries by vendor PCI: dwc: Sort Kconfig entries by vendor PCI: Sort controller Kconfig entries by vendor PCI: Use consistent controller Kconfig menu entry language PCI: xilinx-nwl: Add 'Xilinx' to Kconfig prompt PCI: hv: Add 'Microsoft' to Kconfig prompt PCI: meson: Add 'Amlogic' to Kconfig prompt PCI: Use of_property_present() for testing DT property presence PCI/PM: Extend D3hot delay for NVIDIA HDA controllers dt-bindings: PCI: qcom: Document msi-map and msi-map-mask properties PCI: qcom: Add SM8550 PCIe support dt-bindings: PCI: qcom: Add SM8550 compatible PCI: qcom: Add support for SDX55 SoC dt-bindings: PCI: qcom-ep: Fix the unit address used in example dt-bindings: PCI: qcom: Add SDX55 SoC dt-bindings: PCI: qcom: Update maintainers entry PCI: qcom: Enable async probe by default PCI: qcom: Add support for system suspend and resume PCI/PM: Drop pci_bridge_wait_for_secondary_bus() timeout parameter PCI/PM: Increase wait time after resume PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock PCI: Fix up L1SS capability for Intel Apollo Lake Root Port PCI: qcom: Expose link transition counts via debugfs dt-bindings: PCI: qcom: Add "mhi" register region to supported SoCs PCI: qcom: Rename qcom_pcie_config_sid_sm8250() to reflect IP version PCI: qcom: Use macros for defining total no. of clocks & supplies PCI: qcom: Use bulk reset APIs for handling resets for IP rev 2.4.0 PCI: qcom: Use bulk reset APIs for handling resets for IP rev 2.3.3 PCI: qcom: Use bulk clock APIs for handling clocks for IP rev 2.3.3 PCI: qcom: Use bulk clock APIs for handling clocks for IP rev 2.3.2 PCI: qcom: Use bulk clock APIs for handling clocks for IP rev 1.0.0 PCI: qcom: Use bulk reset APIs for handling resets for IP rev 2.1.0 PCI: qcom: Use lower case for hex PCI: qcom: Add missing macros for register fields PCI: qcom: Use bitfield definitions for register fields PCI: qcom: Sort and group registers and bitfield definitions PCI: qcom: Remove PCIE20_ prefix from register definitions PCI: qcom: Fix the incorrect register usage in v2.7.0 config PCI/EDR: Add edr_handle_event() comments PCI/EDR: Clear Device Status after EDR error recovery efi/cper: Remove unnecessary aer.h include dt-bindings: imx6q-pcie: Restruct i.MX PCIe schema PCI/P2PDMA: Fix pci_p2pmem_find_many() kernel-doc EISA: Drop unused pci_bus_for_each_resource() index argument PCI: Make pci_bus_for_each_resource() index optional PCI: Document pci_bus_for_each_resource() PCI: Introduce pci_dev_for_each_resource() PCI: Introduce pci_resource_n() PCI: ixp4xx: Use PCI_CONF1_ADDRESS() macro PCI: mt7621: Use dev_info() to log PCIe card detection PCI: imx6: Install the fault handler only on compatible match PCI: layerscape: Add EP mode support for ls1028a PCI: rcar: Avoid defines prefixed with CONFIG dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema PCI: kirin: Select REGMAP_MMIO commit ab072a3bfa0e9f3747c22ff869541f11263b636c Author: Jean Delvare Date: Fri Apr 7 19:08:43 2023 +0200 PCI: xilinx: Drop obsolete dependency on COMPILE_TEST Since commit 0166dc11be91 ("of: make CONFIG_OF user selectable"), it is possible to test-build any driver which depends on OF on any architecture by explicitly selecting OF. Therefore depending on COMPILE_TEST as an alternative is no longer needed. Link: https://lore.kernel.org/r/20230407190843.529caf19@endymion.delvare Signed-off-by: Jean Delvare Signed-off-by: Bjorn Helgaas Cc: Lorenzo Pieralisi Cc: Rob Herring Cc: "Krzysztof Wilczyński" commit 9f3c35bfc54b309a60721b1edbbf20a5b4e663de Author: Bjorn Helgaas Date: Tue Apr 18 12:43:36 2023 -0500 PCI: mobiveil: Sort Kconfig entries by vendor Sort Kconfig entries by vendor so they appear in alphabetical order in menuconfig. Link: https://lore.kernel.org/r/20230418174336.145585-8-helgaas@kernel.org Signed-off-by: Bjorn Helgaas commit c39819c044be495abe6a6041f4a49cc58340e2a7 Author: Bjorn Helgaas Date: Tue Apr 18 12:43:35 2023 -0500 PCI: dwc: Sort Kconfig entries by vendor Sort Kconfig entries by vendor so they appear in alphabetical order in menuconfig. Link: https://lore.kernel.org/r/20230418174336.145585-7-helgaas@kernel.org Signed-off-by: Bjorn Helgaas commit 81c362e798d41592efa053b25b053621727319d1 Author: Bjorn Helgaas Date: Tue Apr 18 12:43:34 2023 -0500 PCI: Sort controller Kconfig entries by vendor Sort Kconfig entries by vendor so they appear in alphabetical order in menuconfig. Link: https://lore.kernel.org/r/20230418174336.145585-6-helgaas@kernel.org Signed-off-by: Bjorn Helgaas commit 80c170d7b13d0a46a46f869774baf3c02d775654 Author: Bjorn Helgaas Date: Tue Apr 18 12:43:33 2023 -0500 PCI: Use consistent controller Kconfig menu entry language Use "PCIe controller" consistently instead of "host bridge", "bus driver", etc. Annotate with "(host mode)" or "(endpoint mode)" as needed. Link: https://lore.kernel.org/r/20230418174336.145585-5-helgaas@kernel.org Signed-off-by: Bjorn Helgaas commit bf909c57567ec6385a2edccbadf56eb822186b29 Author: Bjorn Helgaas Date: Tue Apr 18 12:43:32 2023 -0500 PCI: xilinx-nwl: Add 'Xilinx' to Kconfig prompt Add the "Xilinx" vendor name to the CONFIG_PCIE_XILINX_NWL Kconfig prompt so it matches other drivers. Rename from "PCIe Core" to "PCIe controller". Link: https://lore.kernel.org/r/20230418174336.145585-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Acked-by: Michal Simek commit 7f5441c1789c178f4db47cd08b558048ba58ea4e Author: Bjorn Helgaas Date: Tue Apr 18 12:43:31 2023 -0500 PCI: hv: Add 'Microsoft' to Kconfig prompt Add the "Microsoft" vendor name to the CONFIG_PCI_HYPERV_INTERFACE Kconfig prompt so it matches other PCIe drivers and other Hyper-V prompts. Link: https://lore.kernel.org/r/20230418174336.145585-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Acked-by: Wei Liu Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: Dexuan Cui commit 6ba4ce6b2ef6fe4be102cefeb89b3979af130983 Author: Bjorn Helgaas Date: Tue Apr 18 12:43:30 2023 -0500 PCI: meson: Add 'Amlogic' to Kconfig prompt Add the "Amlogic" vendor name to the CONFIG_PCI_MESON Kconfig prompt to match other PCIe drivers. Capitalize "Meson" to match other Meson Kconfig prompts. Link: https://lore.kernel.org/r/20230418174336.145585-2-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Cc: Yue Wang commit 30dc83a92275201af08596df5d5a38b15b95ce86 Merge: 5c5dd8839fc02 727de4c087683 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:38 2023 -0500 Merge branch 'pci/controller/rcar' - Rename internal #defines without "CONFIG_" prefix to avoid confusion (Lukas Bulwahn) * pci/controller/rcar: PCI: rcar: Avoid defines prefixed with CONFIG commit 5c5dd8839fc02fa9b9558005a32ce4d7d86fd774 Merge: b4c85e7bf423b c025c7e5dbf47 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:38 2023 -0500 Merge branch 'pci/controller/qcom' - Use correct PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2 register for v2.7.0 (Manivannan Sadhasivam) - Remove "PCIE20_" prefix from register definitions (Manivannan Sadhasivam) - Sort registers and bitfield declarations (Manivannan Sadhasivam) - Convert to GENMASK and FIELD_PREP (Manivannan Sadhasivam) - Use bulk APIs for clocks of IP 1.0.0, 2.3.2, 2.3.3 (Manivannan Sadhasivam) - Use bulk APIs for reset of IP 2.1.0, 2.3.3, 2.4.0 (Manivannan Sadhasivam) - Rename qcom_pcie_config_sid_sm8250() to be non SM8250-specific (Manivannan Sadhasivam) - Add DT "mhi" register region for supported SoCs (Manivannan Sadhasivam) - Expose link transition counts via debugfs to help debug low power issues (Manivannan Sadhasivam) - Support system suspend and resume; reduce interconnect bandwidth and turn off clock and PHY if there are no active devices (Manivannan Sadhasivam) - Enable async probe by default to reduce boot time (Manivannan Sadhasivam) - Add Manivannan Sadhasivam as qcom DT binding maintainer, replacing Stanimir Varbanov (Manivannan Sadhasivam) - Add DT binding and driver support for Qcom SDX55 SoC (Manivannan Sadhasivam) - Add DT binding and driver support for SM8550 SoC (Abel Vesa) - Document msi-map and msi-map-mask DT properties (Manivannan Sadhasivam) * pci/controller/qcom: dt-bindings: PCI: qcom: Document msi-map and msi-map-mask properties PCI: qcom: Add SM8550 PCIe support dt-bindings: PCI: qcom: Add SM8550 compatible PCI: qcom: Add support for SDX55 SoC dt-bindings: PCI: qcom-ep: Fix the unit address used in example dt-bindings: PCI: qcom: Add SDX55 SoC dt-bindings: PCI: qcom: Update maintainers entry PCI: qcom: Enable async probe by default PCI: qcom: Add support for system suspend and resume PCI: qcom: Expose link transition counts via debugfs dt-bindings: PCI: qcom: Add "mhi" register region to supported SoCs PCI: qcom: Rename qcom_pcie_config_sid_sm8250() to reflect IP version PCI: qcom: Use macros for defining total no. of clocks & supplies PCI: qcom: Use bulk reset APIs for handling resets for IP rev 2.4.0 PCI: qcom: Use bulk reset APIs for handling resets for IP rev 2.3.3 PCI: qcom: Use bulk clock APIs for handling clocks for IP rev 2.3.3 PCI: qcom: Use bulk clock APIs for handling clocks for IP rev 2.3.2 PCI: qcom: Use bulk clock APIs for handling clocks for IP rev 1.0.0 PCI: qcom: Use bulk reset APIs for handling resets for IP rev 2.1.0 PCI: qcom: Use lower case for hex PCI: qcom: Add missing macros for register fields PCI: qcom: Use bitfield definitions for register fields PCI: qcom: Sort and group registers and bitfield definitions PCI: qcom: Remove PCIE20_ prefix from register definitions PCI: qcom: Fix the incorrect register usage in v2.7.0 config commit b4c85e7bf423b9790cae50bb62663e8f5b5443e3 Merge: d7493f273b4ab 50233e105a033 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:37 2023 -0500 Merge branch 'pci/controller/mt7621' - Log empty slots with dev_info(), not dev_err() (Sergio Paracuellos) * pci/controller/mt7621: PCI: mt7621: Use dev_info() to log PCIe card detection commit d7493f273b4ab70a3fb72161bf6762b8df63c33d Merge: 2ad2e01914fde be567c6cbc08e Author: Bjorn Helgaas Date: Thu Apr 20 16:16:37 2023 -0500 Merge branch 'pci/controller/layerscape' - Add ls1028a endpoint mode support (Xiaowei Bao) * pci/controller/layerscape: PCI: layerscape: Add EP mode support for ls1028a commit 2ad2e01914fdee7f4ccda0a837e3ab62bddd0d4d Merge: 73af737eea9e7 3a2776e8a0e15 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:36 2023 -0500 Merge branch 'pci/controller/kirin' - Select CONFIG_REGMAP_MMIO so kirin driver links correctly (Josh Triplett) * pci/controller/kirin: PCI: kirin: Select REGMAP_MMIO commit 73af737eea9e7ff5a99d10e709f7f1ad7c6abe36 Merge: 0c78d418e95ff 6c6fa1f3f7715 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:36 2023 -0500 Merge branch 'pci/controller/ixp4xx' - Use the PCI_CONF1_ADDRESS() macro to simplify config space address computation (Pali Rohár) * pci/controller/ixp4xx: PCI: ixp4xx: Use PCI_CONF1_ADDRESS() macro commit 0c78d418e95ff12ac53446effe9a042e73b406e3 Merge: 580b8bce6bd88 5f5ac460dfe7f Author: Bjorn Helgaas Date: Thu Apr 20 16:16:35 2023 -0500 Merge branch 'pci/controller/dwc' - Install i.MX6 PCI abort handler only when DT contains a PCI controller claimed by the imx6 driver (H. Nikolaus Schaller) * pci/controller/dwc: PCI: imx6: Install the fault handler only on compatible match commit 580b8bce6bd8817e220d2539ad2e14710fe5d8b2 Merge: 1c03b5bfc59ec b10f82380eeb4 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:35 2023 -0500 Merge branch 'pci/controller/dt' - Convert Amlogic Meson AXG DWC PCIe SoC controller bindings to dt-schema (Neil Armstrong) - Restructure i.MX schema to extract common properties to be shared by Root Complex and Endpoint schema (Richard Zhu) * pci/controller/dt: dt-bindings: imx6q-pcie: Restruct i.MX PCIe schema dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema commit 1c03b5bfc59ec1c36c68c0a26c69dee81369e8fa Merge: 43ca31e00254f e34a6ba53e80d Author: Bjorn Helgaas Date: Thu Apr 20 16:16:34 2023 -0500 Merge branch 'pci/resource' - Add pci_dev_for_each_resource() and pci_bus_for_each_resource() iterators to simplify loops (Andy Shevchenko) * pci/resource: EISA: Drop unused pci_bus_for_each_resource() index argument PCI: Make pci_bus_for_each_resource() index optional PCI: Document pci_bus_for_each_resource() PCI: Introduce pci_dev_for_each_resource() PCI: Introduce pci_resource_n() commit 43ca31e00254fe2ee0712afdad2a6681e2eb34ae Merge: cc8a983d0fce6 a5a6dd2624698 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:33 2023 -0500 Merge branch 'pci/reset' - Wait longer for devices to become ready after resume (as we do for reset) to accommodate Intel Titan Ridge xHCI devices (Mika Westerberg) - Drop pci_bridge_wait_for_secondary_bus() timeout parameter since all callers pass the same value (Mika Westerberg) - Extend D3hot delay for NVIDIA HDA controllers to avoid unrecoverable devices after a bus reset (Alex Williamson) * pci/reset: PCI/PM: Extend D3hot delay for NVIDIA HDA controllers PCI/PM: Drop pci_bridge_wait_for_secondary_bus() timeout parameter PCI/PM: Increase wait time after resume commit cc8a983d0fce68fc147743ef25114b2870368a3e Merge: 8745c3d542769 5376ced54ce31 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:33 2023 -0500 Merge branch 'pci/p2pdma' - Fix pci_p2pmem_find_many() kernel-doc (Cai Huoqing) * pci/p2pdma: PCI/P2PDMA: Fix pci_p2pmem_find_many() kernel-doc commit 8745c3d542769c93fe6c88ffc927f02ce7cc0085 Merge: 66d3d0d0e860f f5eff5591b8f9 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:33 2023 -0500 Merge branch 'pci/hotplug' - Fix pciehp AB-BA deadlock between reset_lock and device_lock (Lukas Wunner) * pci/hotplug: PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock commit 66d3d0d0e860f06ec40304e792c2270e70617008 Merge: 90d66d4d86aee 9195ee1a1f760 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:32 2023 -0500 Merge branch 'pci/enumeration' - Use of_property_present(), instead of lower-level functions like of_get_property(), for testing DT property presence (Rob Herring) * pci/enumeration: PCI: Use of_property_present() for testing DT property presence commit 90d66d4d86aee7a6a429081c9d95e663463ab436 Merge: 1a65a3271dad3 606012dddebbc Author: Bjorn Helgaas Date: Thu Apr 20 16:16:32 2023 -0500 Merge branch 'pci/aspm' - Work around Chromebook firmware issue that corrupts Extended Capability list (including L1 PM Substates capability) on D3cold -> D0 transitions (Ron Lee) * pci/aspm: PCI: Fix up L1SS capability for Intel Apollo Lake Root Port commit 1a65a3271dad3a03eb4d34e1ff6a3ad6c3ffb761 Merge: fe15c26ee26ef 774820b362b07 Author: Bjorn Helgaas Date: Thu Apr 20 16:16:32 2023 -0500 Merge branch 'pci/aer' - Remove unnecessary includes (Bjorn Helgaas) - Clear Device Status after EDR error recovery. Firmware collects EDR error information, but the OS is responsible for clearing it (Kuppuswamy Sathyanarayanan) * pci/aer: PCI/EDR: Add edr_handle_event() comments PCI/EDR: Clear Device Status after EDR error recovery efi/cper: Remove unnecessary aer.h include commit 6032aca0deb9c138df122192f8ef02de1fdccf25 Author: Johannes Berg Date: Fri Apr 14 15:46:39 2023 +0200 um: make stub data pages size tweakable There's a lot of code here that hard-codes that the data is a single page, and right now that seems to be sufficient, but to make it easier to change this in the future, add a new STUB_DATA_PAGES constant and use it throughout the code. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit fc54a4f15988e228cf88f888483e985c5f35031e Author: Johannes Berg Date: Fri Feb 10 22:05:11 2023 +0100 um: prevent user code in modules By not doing the user code cflags mangling we can simply break the build for any user code sneaking into modules. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 5d90cf6dcc6a4cb85a51ffe007a8e34375799164 Author: Johannes Berg Date: Fri Feb 10 22:05:10 2023 +0100 um: further clean up user_syms Make some cleanups, add and fix some comments and document here that we shouldn't export (libc) symbols for "_user.c" code, rather such should work like hostfs does now. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 6d708d1a0d81fe85a114766ff6beb3037fa77429 Author: Johannes Berg Date: Fri Feb 10 22:05:09 2023 +0100 um: don't export printf() Since printf() cannot be used in kernel threads (it uses too much stack space) don't export it for modules either. This should leave us exporting only things that are absolutely critical (such as memset and friends) and things that are injected by the compiler (stack guard and similar.) Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 8c6174503c7b7134c22072b45f92724c8a959f06 Author: Johannes Berg Date: Fri Feb 10 22:05:08 2023 +0100 um: hostfs: define our own API boundary Instead of exporting the set of functions provided by glibc that are needed for hostfs_user.c, just build that into the kernel image whenever hostfs is built, and then export _those_ functions cleanly, to be independent of the libc implementation. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit ce1831fe2febf7a3a03fda43b41d7589caa022cd Author: Johannes Berg Date: Sun Feb 12 20:32:04 2023 +0100 um: add __weak for exported functions If the exported glibc functions don't exist, we get link failures. Avoid that by adding __weak so they're allowed to not exist. Reported-by: Randy Dunlap Signed-off-by: Johannes Berg Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Richard Weinberger commit 4b71ed9fb2a55bc5dd375a45e0c04827c683c8d5 Author: Rob Herring Date: Wed Mar 22 12:34:59 2023 -0500 dt-bindings: arm/soc: mediatek: Drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Matthias Brugger Link: https://lore.kernel.org/r/20230322173501.3970991-1-robh@kernel.org Signed-off-by: Rob Herring commit 2961ab0568258537983deabb7fdc5048724ccf0e Author: Rob Herring Date: Mon Mar 27 12:02:04 2023 -0500 dt-bindings: soc: qcom: Drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230327170205.4106310-1-robh@kernel.org Signed-off-by: Rob Herring commit 98530c34d0e149456258359f5bb3bb17fbdfd83b Author: Rob Herring Date: Tue Apr 18 10:06:42 2023 -0500 dt-bindings: i2c: samsung: Fix 'deprecated' value 'deprecated' is a boolean type which should have a value of 'true' rather than 'yes'. Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230418150643.1529895-1-robh@kernel.org Signed-off-by: Rob Herring commit ed3d8f3efa128756508c80cf4fbc7f20fbec5755 Author: Rob Herring Date: Tue Apr 18 10:06:57 2023 -0500 dt-bindings: display: Fix lvds.yaml references The trailing "/" in "lvds.yaml/#" is not a valid JSON pointer. The existing jsonschema package allows it, but coming changes make allowed "$ref" URIs stricter. Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20230418150658.1535120-1-robh@kernel.org Signed-off-by: Rob Herring commit 55793ea54d77719a071b1ccc05a05056e3b5e009 Author: Zhong Jinghua Date: Mon Feb 6 22:58:05 2023 +0800 nbd: fix incomplete validation of ioctl arg We tested and found an alarm caused by nbd_ioctl arg without verification. The UBSAN warning calltrace like below: UBSAN: Undefined behaviour in fs/buffer.c:1709:35 signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long long int' CPU: 3 PID: 2523 Comm: syz-executor.0 Not tainted 4.19.90 #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78 show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x170/0x1dc lib/dump_stack.c:118 ubsan_epilogue+0x18/0xb4 lib/ubsan.c:161 handle_overflow+0x188/0x1dc lib/ubsan.c:192 __ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:206 __block_write_full_page+0x94c/0xa20 fs/buffer.c:1709 block_write_full_page+0x1f0/0x280 fs/buffer.c:2934 blkdev_writepage+0x34/0x40 fs/block_dev.c:607 __writepage+0x68/0xe8 mm/page-writeback.c:2305 write_cache_pages+0x44c/0xc70 mm/page-writeback.c:2240 generic_writepages+0xdc/0x148 mm/page-writeback.c:2329 blkdev_writepages+0x2c/0x38 fs/block_dev.c:2114 do_writepages+0xd4/0x250 mm/page-writeback.c:2344 The reason for triggering this warning is __block_write_full_page() -> i_size_read(inode) - 1 overflow. inode->i_size is assigned in __nbd_ioctl() -> nbd_set_size() -> bytesize. We think it is necessary to limit the size of arg to prevent errors. Moreover, __nbd_ioctl() -> nbd_add_socket(), arg will be cast to int. Assuming the value of arg is 0x80000000000000001) (on a 64-bit machine), it will become 1 after the coercion, which will return unexpected results. Fix it by adding checks to prevent passing in too large numbers. Signed-off-by: Zhong Jinghua Reviewed-by: Yu Kuai Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20230206145805.2645671-1-zhongjinghua@huawei.com Signed-off-by: Jens Axboe commit 9be6ab181b7b8d6114e225ae3c7c01bb6380cf8a Author: Ian Rogers Date: Thu Apr 20 10:18:12 2023 -0700 libperf rc_check: Enable implicitly with sanitizers If using leak sanitizer then implicitly enable reference count checking. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230420171812.561603-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 0bdd95cede51d725c7f29c9787e62b77bfb0f034 Merge: 44295af5019f1 f41e1442ac5bd Author: Rafael J. Wysocki Date: Thu Apr 20 19:30:01 2023 +0200 Merge tag 'cpufreq-arm-updates-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull cpufreq/ARM updates for 6.4 from Viresh Kumar: "- Add opp and bandwidth support to tegra194 cpufreq driver (Sumit Gupta). - Use of_property_present() for testing DT property presence (Rob Herring). - Remove MODULE_LICENSE in non-modules (Nick Alcock). - Add SM7225 to cpufreq-dt-platdev blocklist (Luca Weiss). - Optimizations and fixes for qcom-cpufreq-hw driver (Krzysztof Kozlowski, Konrad Dybcio, and Bjorn Andersson). - DT binding updates for qcom-cpufreq-hw driver (Konrad Dybcio and Bartosz Golaszewski). - Updates and fixes for mediatek driver (Jia-Wei Chang and AngeloGioacchino Del Regno)." commit ddd66d63473513bb013928245b6482969b97de05 Author: Mario Limonciello Date: Mon Apr 17 10:27:08 2023 -0500 platform/x86/intel/pmc: core: Report duration of time in HW sleep state intel_pmc_core displays a warning when the module parameter `warn_on_s0ix_failures` is set and a suspend didn't get to a HW sleep state. Report this to the standard kernel reporting infrastructure so that userspace software can query after the suspend cycle is done. Reviewed-by: Hans de Goede Suggested-by: Ilpo Järvinen Reviewed-by: David E. Box Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit e2348afe702e9431f428e230be7f4ef8a1778b19 Author: Mario Limonciello Date: Mon Apr 17 10:27:07 2023 -0500 platform/x86/intel/pmc: core: Always capture counters on suspend Currently counters are only captured during suspend when the warn_on_s0ix_failures module parameter is set. In order to relay this counter information to the kernel reporting infrastructure adjust it so that the counters are always captured. warn_on_s0ix_failures will be utilized solely for messaging by the driver instead. Reviewed-by: Hans de Goede Reviewed-by: David E. Box Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit 09f5df3fb82fd444296e248f90dd29288e82d3a3 Author: Mario Limonciello Date: Mon Apr 17 10:27:06 2023 -0500 platform/x86/amd: pmc: Report duration of time in hw sleep state amd_pmc displays a warning when a suspend didn't get to the deepest state and a dynamic debugging message with the duration if it did. Rather than logging to dynamic debugging the duration spent in the deepest state, report this to the standard kernel reporting infrastructure so that userspace software can query after the suspend cycle is done. Reviewed-by: Hans de Goede Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit b52124a78ab34eb0754e32edc0c9996937779176 Author: Mario Limonciello Date: Mon Apr 17 10:27:05 2023 -0500 PM: Add sysfs files to represent time spent in hardware sleep state Userspace can't easily discover how much of a sleep cycle was spent in a hardware sleep state without using kernel tracing and vendor specific sysfs or debugfs files. To make this information more discoverable, introduce 3 new sysfs files: 1) The time spent in a hw sleep state for last cycle. 2) The time spent in a hw sleep state since the kernel booted 3) The maximum time that the hardware can report for a sleep cycle. All of these files will be present only if the system supports s2idle. Reviewed-by: Hans de Goede Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit eeb3557cc188e42ae7f7bef2d6dc5bf0e078412e Merge: 9772b7f07499b bbd329fe723d1 Author: Will Deacon Date: Thu Apr 20 18:03:07 2023 +0100 Merge branch 'for-next/sysreg' into for-next/core * for-next/sysreg: arm64/sysreg: Convert HFGITR_EL2 to automatic generation arm64/idreg: Don't disable SME when disabling SVE arm64/sysreg: Update ID_AA64PFR1_EL1 for DDI0601 2022-12 arm64/sysreg: Convert HFG[RW]TR_EL2 to automatic generation arm64/sysreg: allow *Enum blocks in SysregFields blocks commit 9772b7f07499b71482276cb5a8e4aa23bfca6b27 Merge: 9651f00eb422a de1702f65feb5 Author: Will Deacon Date: Thu Apr 20 18:03:02 2023 +0100 Merge branch 'for-next/stacktrace' into for-next/core * for-next/stacktrace: arm64: move PAC masks to arm64: use XPACLRI to strip PAC arm64: avoid redundant PAC stripping in __builtin_return_address() arm64: stacktrace: always inline core stacktrace functions arm64: stacktrace: move dump functions to end of file arm64: stacktrace: recover return address for first entry commit 9651f00eb422a0a4c8f5cf5d920c80869e6ab5e5 Merge: 1bb31cc7afe6b 87727ba2bb05c Author: Will Deacon Date: Thu Apr 20 18:02:56 2023 +0100 Merge branch 'for-next/perf' into for-next/core * for-next/perf: (24 commits) KVM: arm64: Ensure CPU PMU probes before pKVM host de-privilege drivers/perf: hisi: add NULL check for name drivers/perf: hisi: Remove redundant initialized of pmu->name perf/arm-cmn: Fix port detection for CMN-700 arm64: pmuv3: dynamically map PERF_COUNT_HW_BRANCH_INSTRUCTIONS perf/arm-cmn: Validate cycles events fully Revert "ARM: mach-virt: Select PMUv3 driver by default" drivers/perf: apple_m1: Add Apple M2 support dt-bindings: arm-pmu: Add PMU compatible strings for Apple M2 cores perf: arm_cspmu: Fix variable dereference warning perf/amlogic: Fix config1/config2 parsing issue drivers/perf: Use devm_platform_get_and_ioremap_resource() kbuild, drivers/perf: remove MODULE_LICENSE in non-modules perf: qcom: Use devm_platform_get_and_ioremap_resource() perf: arm: Use devm_platform_get_and_ioremap_resource() perf/arm-cmn: Move overlapping wp_combine field ARM: mach-virt: Select PMUv3 driver by default ARM: perf: Allow the use of the PMUv3 driver on 32bit ARM ARM: Make CONFIG_CPU_V7 valid for 32bit ARMv8 implementations perf: pmuv3: Change GENMASK to GENMASK_ULL ... commit 3288ee5844b74cebb94ed15bc9b5b9d3223ae038 Merge: d2a158d113cbf b100722a777f6 Author: Kalle Valo Date: Thu Apr 20 19:43:45 2023 +0300 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath.git patches for v6.4. Major changes: wcn36xx * support for pronto v3 hardware ath11k * PCIe DeviceTree bindings * WCN6750: enable SAR support ath10k * convert DeviceTree bindings to YAML commit 5584785080045e6cd3ebc1aac49b9c0ec57f136a Author: Wu Bo Date: Fri Apr 14 18:43:08 2023 +0800 f2fs: allocate trace path buffer from names_cache It would be better to use the dedicated slab to store path. Signed-off-by: Wu Bo Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 87727ba2bb05cc3cb4233231faa7ab4c7eeb6c73 Author: Will Deacon Date: Thu Apr 20 13:33:56 2023 +0100 KVM: arm64: Ensure CPU PMU probes before pKVM host de-privilege Although pKVM supports CPU PMU emulation for non-protected guests since 722625c6f4c5 ("KVM: arm64: Reenable pmu in Protected Mode"), this relies on the PMU driver probing before the host has de-privileged so that the 'kvm_arm_pmu_available' static key can still be enabled by patching the hypervisor text. As it happens, both of these events hang off device_initcall() but the PMU consistently won the race until 7755cec63ade ("arm64: perf: Move PMUv3 driver to drivers/perf"). Since then, the host will fail to boot when pKVM is enabled: | hw perfevents: enabled with armv8_pmuv3_0 PMU driver, 7 counters available | kvm [1]: nVHE hyp BUG at: [] __kvm_nvhe_handle_host_mem_abort+0x270/0x284! | kvm [1]: Cannot dump pKVM nVHE stacktrace: !CONFIG_PROTECTED_NVHE_STACKTRACE | kvm [1]: Hyp Offset: 0xfffea41fbdf70000 | Kernel panic - not syncing: HYP panic: | PS:a00003c9 PC:0000dbe04b0c66e0 ESR:00000000f2000800 | FAR:fffffbfffddfcf00 HPFAR:00000000010b0bf0 PAR:0000000000000000 | VCPU:0000000000000000 | CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7-00083-g0bce6746d154 #1 | Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 | Call trace: | dump_backtrace+0xec/0x108 | show_stack+0x18/0x2c | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | panic+0x13c/0x33c | nvhe_hyp_panic_handler+0x10c/0x190 | aarch64_insn_patch_text_nosync+0x64/0xc8 | arch_jump_label_transform+0x4c/0x5c | __jump_label_update+0x84/0xfc | jump_label_update+0x100/0x134 | static_key_enable_cpuslocked+0x68/0xac | static_key_enable+0x20/0x34 | kvm_host_pmu_init+0x88/0xa4 | armpmu_register+0xf0/0xf4 | arm_pmu_acpi_probe+0x2ec/0x368 | armv8_pmu_driver_init+0x38/0x44 | do_one_initcall+0xcc/0x240 Fix the race properly by deferring the de-privilege step to device_initcall_sync(). This will also be needed in future when probing IOMMU devices and allows us to separate the pKVM de-privilege logic from the core hypervisor initialisation path. Cc: Oliver Upton Cc: Fuad Tabba Cc: Marc Zyngier Fixes: 7755cec63ade ("arm64: perf: Move PMUv3 driver to drivers/perf") Tested-by: Fuad Tabba Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230420123356.2708-1-will@kernel.org Signed-off-by: Will Deacon commit 8a46df7cd135fe576c18efa418cd1549e51f2732 Author: Nico Boehr Date: Wed Feb 22 16:55:02 2023 +0100 KVM: s390: pci: fix virtual-physical confusion on module unload/load When the kvm module is unloaded, zpci_setup_aipb() perists some data in the zpci_aipb structure in s390 pci code. Note that this struct is also passed to firmware in the zpci_set_irq_ctrl() call and thus the GAIT must be a physical address. On module re-insertion, the GAIT is restored from this structure in zpci_reset_aipb(). But it is a physical address, hence this may cause issues when the kvm module is unloaded and loaded again. Fix virtual vs physical address confusion (which currently are the same) by adding the necessary physical-to-virtual-conversion in zpci_reset_aipb(). Signed-off-by: Nico Boehr Reviewed-by: Matthew Rosato Signed-off-by: Janosch Frank Link: https://lore.kernel.org/r/20230222155503.43399-1-nrb@linux.ibm.com Message-Id: <20230222155503.43399-1-nrb@linux.ibm.com> commit 7be3e3392335131b2234fa3e6feda3e989cb837c Author: Pierre Morel Date: Tue Feb 14 13:28:41 2023 +0100 KVM: s390: vsie: clarifications on setting the APCB The APCB is part of the CRYCB. The calculation of the APCB origin can be done by adding the APCB offset to the CRYCB origin. Current code makes confusing transformations, converting the CRYCB origin to a pointer to calculate the APCB origin. Let's make things simpler and keep the CRYCB origin to make these calculations. Signed-off-by: Pierre Morel Reviewed-by: Claudio Imbrenda Acked-by: David Hildenbrand Acked-by: Janosch Frank Signed-off-by: Janosch Frank Link: https://lore.kernel.org/r/20230214122841.13066-2-pmorel@linux.ibm.com Message-Id: <20230214122841.13066-2-pmorel@linux.ibm.com> commit 2f2c0911b950794dbf394ee2d784138fbf714dbd Author: Nico Boehr Date: Thu Feb 23 17:22:36 2023 +0100 KVM: s390: interrupt: fix virtual-physical confusion for next alert GISA We sometimes put a virtual address in next_alert, which should always be a physical address, since it is shared with hardware. This currently works, because virtual and physical addresses are the same. Add phys_to_virt() to resolve the virtual-physical confusion. Signed-off-by: Nico Boehr Reviewed-by: Janosch Frank Reviewed-by: Michael Mueller Signed-off-by: Janosch Frank Link: https://lore.kernel.org/r/20230223162236.51569-1-nrb@linux.ibm.com Message-Id: <20230223162236.51569-1-nrb@linux.ibm.com> commit 19bcff7e2777c7337caeef5532ad6f93f3d24d64 Author: Linus Walleij Date: Fri Apr 14 16:06:22 2023 +0200 pinctrl: qcom ssbi-gpio: Convert to immutable irq_chip Convert the driver to immutable irq-chip with a bit of intuition. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230414-immutable-irqchips-2-v1-6-6b59a5186b00@linaro.org commit 5e75e24eb111245b1a1fd08496fc012d5e1f9e7f Author: Linus Walleij Date: Fri Apr 14 16:06:21 2023 +0200 pinctrl: qcom ssbi-mpp: Convert to immutable irq_chip Convert the driver to immutable irq-chip with a bit of intuition. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230414-immutable-irqchips-2-v1-5-6b59a5186b00@linaro.org commit 9890a043b3d755f796f6ae14aa66cc9cecd15a68 Author: Linus Walleij Date: Fri Apr 14 16:06:20 2023 +0200 pinctrl: qcom spmi-mpp: Convert to immutable irq_chip Convert the driver to immutable irq-chip with a bit of intuition. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230414-immutable-irqchips-2-v1-4-6b59a5186b00@linaro.org commit 35d008679a5af05dcca4fac5c0e8491196a6ffdf Author: Linus Walleij Date: Fri Apr 14 16:06:19 2023 +0200 pinctrl: plgpio: Convert to immutable irq_chip Convert the driver to immutable irq-chip with a bit of intuition. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230414-immutable-irqchips-2-v1-3-6b59a5186b00@linaro.org commit 33c56e5ca01b85d235f464572a640ef657d53fca Author: Linus Walleij Date: Fri Apr 14 16:06:18 2023 +0200 pinctrl: pistachio: Convert to immutable irq_chip Convert the driver to immutable irq-chip with a bit of intuition. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230414-immutable-irqchips-2-v1-2-6b59a5186b00@linaro.org commit a0a53f1bf1f712b6a52eae21a2f82cf44a7cfe5c Author: Linus Walleij Date: Fri Apr 14 16:06:17 2023 +0200 pinctrl: pic32: Convert to immutable irq_chip Convert the driver to immutable irq-chip with a bit of intuition. Switch some call to use irqd_to_hwirq() in the process. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230414-immutable-irqchips-2-v1-1-6b59a5186b00@linaro.org commit 57fbfb3b0b6526c9fd9c32383720ff550ace4919 Author: Alexander Dahl Date: Tue Apr 18 13:34:02 2023 +0200 docs: leds: ledtrig-oneshot: Fix spelling mistake It's no comparison, but a "first this, then that" situation. Signed-off-by: Alexander Dahl Acked-by: Pavel Machek Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230418113402.188391-1-ada@thorsis.com commit 389b01aba302c4504930cd6089d1910995e870af Merge: efd090c040f2a 6d0a21dd95c34 Author: Mark Brown Date: Thu Apr 20 14:49:35 2023 +0100 ASoC: SOF: pcm/Intel: Pause-resume improvements for Merge series from Peter Ujfalusi : Last minute patch for correct the pasue/resume operation with IPC4. The issues are hardto reproduce and needs extended stress testing to be hit, in which case the audio breaks due to DMA errors. commit efd090c040f2ab68b7be79f6c0e94ac8c30d70f1 Merge: 0d587f354dcf3 367fd6ffa294c Author: Mark Brown Date: Thu Apr 20 14:49:29 2023 +0100 ASoC: SOF: add no_reply IPC calls Merge series from Pierre-Louis Bossart : Simplify IPC messages to avoid passing a reply structure that is not used later. commit 0d587f354dcf3616542d6ec3239fb65ed7187735 Merge: a9e42d9e8b4be dc5a3e60a4b59 Author: Mark Brown Date: Thu Apr 20 14:49:22 2023 +0100 ASoC: Intel: boards: updates for 6.4 Merge series from Pierre-Louis Bossart : Preparation of ALC712 support with different types of SoundWire devices per link, new RaptorLake SoundWire device, better error handling for Cirrus devices and cosmetic changes for Max98373. Bard Liao (3): ASoC: Intel: sof_sdw: set codec_num = 1 if the device is not aggregated ASoC: Intel: sof_sdw: support different devices on the same sdw link ASoC: Intel: sof_sdw: append codec type to dai link name Curtis Malainey (1): ASoC: Intel: sof_cirrus_common: Guard against missing buses Yong Zhi (2): ASoC: Intel: sof_sdw: remove late_probe flag in struct sof_sdw_codec_info ASoC: Intel: sof_sdw_max98373: change sof_sdw_mx8373_late_probe to static call apoorv (1): ASoC: Intel: soc-acpi: Add entry for rt711-sdca-sdw at link 2 in RPL match table sound/soc/intel/boards/sof_cirrus_common.c | 7 +- sound/soc/intel/boards/sof_sdw.c | 181 ++++++++++++------ sound/soc/intel/boards/sof_sdw_common.h | 3 - sound/soc/intel/boards/sof_sdw_max98373.c | 22 +-- .../intel/common/soc-acpi-intel-rpl-match.c | 17 +- 5 files changed, 152 insertions(+), 78 deletions(-) -- 2.37.2 commit 538bc0f40b364f2c7b81f11aa163f723b138b40f Author: Ard Biesheuvel Date: Tue Apr 18 15:49:51 2023 +0200 efi/zboot: Set forward edge CFI compat header flag if supported Add some plumbing to the zboot EFI header generation to set the newly introduced DllCharacteristicsEx flag associated with forward edge CFI enforcement instructions (BTI on arm64, IBT on x86) x86 does not currently uses the zboot infrastructure, so let's wire it up only for arm64. Signed-off-by: Ard Biesheuvel commit bca2f3a9406b89961fbc6c92c52c6fc1fd91d35f Author: Ard Biesheuvel Date: Tue Apr 18 15:49:50 2023 +0200 efi/zboot: Add BSS padding before compression We don't really care about the size of the decompressed image - what matters is how much space needs to be allocated for the image to execute, and this includes space for BSS that is not part of the loadable image and so it is not accounted for in the decompressed size. So let's add some zero padding to the end of the image: this compresses well, and it ensures that BSS is accounted for, and as a bonus, it will be zeroed before launching the image. Since all architectures that implement support for EFI zboot carry this value in the header in the same location, we can just grab it from the binary that is being compressed. Signed-off-by: Ard Biesheuvel commit 8358098b9787caab8bbc93fd78d046afaed43c16 Author: Ard Biesheuvel Date: Tue Apr 18 15:49:48 2023 +0200 arm64: efi: Enable BTI codegen and add PE/COFF annotation UEFI heavily relies on so-called protocols, which are essentially tables populated with pointers to executable code, and these are invoked indirectly using BR or BLR instructions. This makes the EFI execution context vulnerable to attacks on forward edge control flow, and so it would help if we could enable hardware enforcement (BTI) on CPUs that implement it. So let's no longer disable BTI codegen for the EFI stub, and set the newly introduced PE/COFF header flag when the kernel is built with BTI landing pads. Signed-off-by: Ard Biesheuvel Reviewed-by: Mark Brown commit 038585573d0544bc717cdc5b3be4e95206d3ee3d Author: Ard Biesheuvel Date: Tue Apr 18 15:49:47 2023 +0200 efi/pe: Import new BTI/IBT header flags from the spec The latest version of your favorite fork of the PE/COFF spec includes a new type of header flag that is intended to be used in the context of EFI firmware to indicate to the image loader that the executable regions of an image can be mapped with BTI/IBT enforcement enabled. So let's import these definitions so we can use them in subsequent patches. Signed-off-by: Ard Biesheuvel commit e315e7b83a22043bffee450437d7089ef373cbf6 Author: Zhengchao Shao Date: Tue Apr 18 14:54:50 2023 +0800 net: libwx: fix memory leak in wx_setup_rx_resources When wx_alloc_page_pool() failed in wx_setup_rx_resources(), it doesn't release DMA buffer. Add dma_free_coherent() in the error path to release the DMA buffer. Fixes: 850b971110b2 ("net: libwx: Allocate Rx and Tx resources") Signed-off-by: Zhengchao Shao Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230418065450.2268522-1-shaozhengchao@huawei.com Signed-off-by: Paolo Abeni commit 7c75661c42a06fe35e1774373194f646b5a9e5c9 Author: Ming Lei Date: Thu Apr 20 17:11:04 2023 +0800 ublk: don't return 0 in case of any failure Commit 2d786e66c966 ("block: ublk: switch to ioctl command encoding") starts to reset local variable of 'ret' as zero, then if any failure happens when handling the three IO commands, 0 can be returned to ublk server. Fix it by returning -EINVAL in case of command handling failure. Cc: Christoph Hellwig Fixes: 2d786e66c966 ("block: ublk: switch to ioctl command encoding") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230420091104.1092972-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit d2a158d113cbfe37a5dd3f44dc96d008dd910a81 Merge: 6c6d62ae8271b 3b522cadedfe6 Author: Kalle Valo Date: Thu Apr 20 15:53:58 2023 +0300 Merge tag 'mt76-for-kvalo-2023-04-18' of https://github.com/nbd168/wireless mt76 patches for 6.4 - fixes - connac code unification - mt7921 p2p support - mt7996 mesh a-msdu support - mt7996 eht support - mt7996 coredump support commit 654d0310007146fae87b0c1a68f81e53ad519b14 Author: Etienne Carriere Date: Thu Apr 20 09:49:23 2023 +0200 optee: fix uninited async notif value Fixes an uninitialized variable in irq_handler() that could lead to unpredictable behavior in case OP-TEE fails to handle SMC function ID OPTEE_SMC_GET_ASYNC_NOTIF_VALUE. This change ensures that in that case get_async_notif_value() properly reports there are no notification event. Reported-by: kernel test robot Link: https://lore.kernel.org/r/202304200755.OoiuclDZ-lkp@intel.com/ Reported-by: Dan Carpenter Link: https://lore.kernel.org/all/d9b7f69b-c737-4cb3-8e74-79fe00c934f9@kili.mountain/ Fixes: 6749e69c4dad ("optee: add asynchronous notifications") Signed-off-by: Etienne Carriere Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 3c85cc43c8e7855d202da184baf00c7b8eeacf71 Author: Jens Axboe Date: Wed Apr 19 14:16:03 2023 -0600 Revert "io_uring/rsrc: disallow multi-source reg buffers" This reverts commit edd478269640b360c6f301f2baa04abdda563ef3. There's really no specific need to disallow multiple sources of buffers, and io_uring really should not be mandating this by itself. We should be able to solely rely on GUP making these decisions. As this also stands in the way of a cleanup where io_uring is the odd one out, kill it. Link: https://lore.kernel.org/all/61ded378-51a8-1dcb-b631-fda1903248a9@gmail.com/ Signed-off-by: Jens Axboe commit ec274aff21b6a94c7973384ca80a503c1bc3b173 Author: Petr Tesarik Date: Thu Apr 20 11:58:58 2023 +0200 swiotlb: Omit total_used and used_hiwater if !CONFIG_DEBUG_FS The tracking of used_hiwater adds an atomic operation to the hot path. This is acceptable only when debugging the kernel. To make sure that the fields can never be used by mistake, do not even include them in struct io_tlb_mem if CONFIG_DEBUG_FS is not set. The build fails after doing that. To fix it, it is necessary to remove all code specific to debugfs and instead provide a stub implementation of swiotlb_create_debugfs_files(). As a bonus, this change allows to remove one __maybe_unused attribute. Signed-off-by: Petr Tesarik Signed-off-by: Christoph Hellwig commit 6c6d62ae8271bd4b55dd2ba4b7ed552162823880 Author: Simon Horman Date: Tue Apr 18 13:29:22 2023 +0200 wifi: rtw88: Update spelling in main.h Update spelling in comments in main.h Found by inspection. Signed-off-by: Simon Horman Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230418-rtw88-starspell-v1-1-70e52a23979b@kernel.org commit 09be55585d2785d354b2375e9cf2acdc140d65cb Author: Arnd Bergmann Date: Mon Apr 17 22:51:24 2023 +0200 wifi: airo: remove ISA_DMA_API dependency This driver does not actually use the ISA DMA API, it is purely PIO based, so remove the dependency. Signed-off-by: Arnd Bergmann Reviewed-by: Simon Horman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230417205131.1560074-1-arnd@kernel.org commit c8bc3760277965c8eaa90155acea2b16215ebb8a Author: Bitterblue Smith Date: Mon Apr 17 20:08:20 2023 +0300 wifi: rtl8xxxu: Simplify setting the initial gain The goal of writing 0x6954341e / 0x6955341e to REG_OFDM0_XA_AGC_CORE1 appears to be setting the initial gain, which is stored in bits 0..6. Bits 7..31 are the same as what the phy init tables write. Modify only bits 0..6 so that we don't have to care about the values of the others. This way we don't have to add another "else if" for the RTL8192FU. Why we need to change the initial gain from the default 0x20 to 0x1e? Not sure. Some of the vendor drivers change it to 0x1e before scanning and then restore it to the original value after. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/cf91ca69-70e3-4c20-c0b1-e59d452356a1@gmail.com commit cd85c8b059c54b00e3b509e83fb36c2798f50128 Author: Bitterblue Smith Date: Mon Apr 17 20:07:09 2023 +0300 wifi: rtl8xxxu: Add rtl8xxxu_write{8,16,32}_{set,clear} Also add rtl8xxxu_write32_mask, rtl8xxxu_write_rfreg_mask. These helper functions make it easier to modify only parts of a register by eliminating the call to the register reading function and the bit manipulations. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/9430b841-1048-b27c-14ec-fca447dc32af@gmail.com commit af8678e6c5bd37d99fa37c06a158a263da42efa1 Author: Bitterblue Smith Date: Mon Apr 17 20:05:43 2023 +0300 wifi: rtl8xxxu: Don't print the vendor/product/serial Most devices have a vendor name, product name, and serial number in the efuse, but it's pretty useless. It duplicates the information already printed by the USB subsystem: usb 1-4: New USB device found, idVendor=0bda, idProduct=8178, bcdDevice= 2.00 usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-4: Product: 802.11n WLAN Adapter usb 1-4: Manufacturer: Realtek usb 1-4: SerialNumber: 00e04c000001 -> usb 1-4: Vendor: Realtek -> usb 1-4: Product: 802.11n WLAN Adapter usb 1-4: New USB device found, idVendor=0bda, idProduct=818b, bcdDevice= 2.00 usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-4: Product: 802.11n NIC usb 1-4: Manufacturer: Realtek usb 1-4: SerialNumber: 00e04c000001 -> usb 1-4: Vendor: Realtek -> usb 1-4: Product: 802.11n NIC -> usb 1-4: Serial not available. usb 1-4: New USB device found, idVendor=0bda, idProduct=f179, bcdDevice= 0.00 usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-4: Product: 802.11n usb 1-4: Manufacturer: Realtek usb 1-4: SerialNumber: 002E2DC0041F -> usb 1-4: Vendor: Realtek -> usb 1-4: Product: 802.11n usb 1-4: New USB device found, idVendor=0bda, idProduct=8179, bcdDevice= 0.00 usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-4: Product: 802.11n NIC usb 1-4: Manufacturer: Realtek usb 1-4: SerialNumber: 00E04C0001 -> usb 1-4: Vendor: Realtek -> usb 1-4: Product: 802.11n NIC -> usb 1-4: Serial: 00E04C0001 Also, that data is not interpreted correctly in all cases: usb 3-1.1.2: New USB device found, idVendor=0bda, idProduct=8179, bcdDevice= 0.00 usb 3-1.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 3-1.1.2: Product: 802.11n NIC usb 3-1.1.2: Manufacturer: Realtek usb 3-1.1.2: Vendor: Realtek usb 3-1.1.2: Product: \x03802.11n NI usb 3-1.1.2: Serial: \xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff Link: https://bugzilla.kernel.org/show_bug.cgi?id=217231 Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/a2a7d9df-0529-7890-3522-48dce613753f@gmail.com commit 59a3a312009723e3e5082899655fdcc420e2b47a Author: Larry Finger Date: Mon Apr 17 11:03:31 2023 -0500 wifi: rtw88: Fix memory leak in rtw88_usb Kmemleak shows the following leak arising from routine in the usb probe routine: unreferenced object 0xffff895cb29bba00 (size 512): comm "(udev-worker)", pid 534, jiffies 4294903932 (age 102751.088s) hex dump (first 32 bytes): 77 30 30 30 00 00 00 00 02 2f 2d 2b 30 00 00 00 w000...../-+0... 02 00 2a 28 00 00 00 00 ff 55 ff ff ff 00 00 00 ..*(.....U...... backtrace: [] kmalloc_trace+0x26/0x90 [] rtw_usb_probe+0x2f1/0x680 [rtw_usb] [] usb_probe_interface+0xdd/0x2e0 [usbcore] [] really_probe+0x18e/0x3d0 [] __driver_probe_device+0x78/0x160 [] driver_probe_device+0x1f/0x90 [] __driver_attach+0xbf/0x1b0 [] bus_for_each_dev+0x70/0xc0 [] bus_add_driver+0x10e/0x210 [] driver_register+0x55/0xf0 [] usb_register_driver+0x88/0x140 [usbcore] [] do_one_initcall+0x43/0x210 [] do_init_module+0x4a/0x200 [] __do_sys_finit_module+0xac/0x120 [] do_syscall_64+0x56/0x80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 The leak was verified to be real by unloading the driver, which resulted in a dangling pointer to the allocation. The allocated memory is freed in rtw_usb_intf_deinit(). Signed-off-by: Larry Finger Cc: Sascha Hauer Cc: Ping-Ke Shih Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230417160331.23071-1-Larry.Finger@lwfinger.net commit 172591baa2cc1ec04869a0d798821a6ca9a2f4b4 Author: Sascha Hauer Date: Mon Apr 17 16:03:58 2023 +0200 wifi: rtw88: call rtw8821c_switch_rf_set() according to chip variant We have to call rtw8821c_switch_rf_set() with SWITCH_TO_WLG or SWITCH_TO_BTG according to the chip variant as denoted in rfe_option. The information which argument to use for which variant has been taken from the vendor driver. Signed-off-by: Sascha Hauer Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230417140358.2240429-5-s.hauer@pengutronix.de commit 97c75e1adeda78b3794936c617d8b86e9ebd54f5 Author: Sascha Hauer Date: Mon Apr 17 16:03:57 2023 +0200 wifi: rtw88: set pkg_type correctly for specific rtw8821c variants According to the vendor driver the pkg_type has to be set to '1' for some rtw8821c variants. As the pkg_type has been hardcoded to '0', add a field for it in struct rtw_hal and set this correctly in the rtw8821c part. With this parsing of a rtw_table is influenced and check_positive() in phy.c returns true for some cases here. The same is done in the vendor driver. However, this has no visible effect on the driver here. Signed-off-by: Sascha Hauer Reviewed-by: Ping-Ke Shih Signed-off-by: Sascha Hauer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230417140358.2240429-4-s.hauer@pengutronix.de commit 14705f969d98187a1cc2682e0c9bd2e230b8098f Author: Sascha Hauer Date: Mon Apr 17 16:03:56 2023 +0200 wifi: rtw88: rtw8821c: Fix rfe_option field width On my RTW8821CU chipset rfe_option reads as 0x22. Looking at the vendor driver suggests that the field width of rfe_option is 5 bit, so rfe_option should be masked with 0x1f. Without this the rfe_option comparisons with 2 further down the driver evaluate as false when they should really evaluate as true. The effect is that 2G channels do not work. rfe_option is also used as an array index into rtw8821c_rfe_defs[]. rtw8821c_rfe_defs[34] (0x22) was added as part of adding USB support, likely because rfe_option reads as 0x22. As this now becomes 0x2, rtw8821c_rfe_defs[34] is no longer used and can be removed. Note that this might not be the whole truth. In the vendor driver there are indeed places where the unmasked rfe_option value is used. However, the driver has several places where rfe_option is tested with the pattern if (rfe_option == 2 || rfe_option == 0x22) or if (rfe_option == 4 || rfe_option == 0x24), so that rfe_option BIT(5) has no influence on the code path taken. We therefore mask BIT(5) out from rfe_option entirely until this assumption is proved wrong by some chip variant we do not know yet. Signed-off-by: Sascha Hauer Tested-by: Alexandru gagniuc Tested-by: Larry Finger Tested-by: ValdikSS Cc: stable@vger.kernel.org Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230417140358.2240429-3-s.hauer@pengutronix.de commit a6f187f92bcc2b17821538b4a11d61764e68b091 Author: Sascha Hauer Date: Mon Apr 17 16:03:55 2023 +0200 wifi: rtw88: usb: fix priority queue to endpoint mapping The RTW88 chipsets have four different priority queues in hardware. For the USB type chipsets the packets destined for a specific priority queue must be sent through the endpoint corresponding to the queue. This was not fully understood when porting from the RTW88 USB out of tree driver and thus violated. This patch implements the qsel to endpoint mapping as in get_usb_bulkout_id_88xx() in the downstream driver. Without this the driver often issues "timed out to flush queue 3" warnings and often TX stalls completely. Signed-off-by: Sascha Hauer Tested-by: ValdikSS Tested-by: Alexandru gagniuc Tested-by: Larry Finger Cc: stable@vger.kernel.org Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230417140358.2240429-2-s.hauer@pengutronix.de commit d16836cdcc3b17734f6aae165268d2f1777a4f74 Author: Po-Hao Huang Date: Fri Apr 14 20:13:31 2023 +0800 wifi: rtw88: 8822c: add iface combination Allow 8822c to operate two interface concurrently, only 1 AP mode plus 1 station mode under same frequency is supported. Combination of other types will not be added until requested. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414121331.18062-1-pkshih@realtek.com commit 96fbb84de4ffce76d54de8656efe0a580081c037 Author: Po-Hao Huang Date: Fri Apr 14 20:13:23 2023 +0800 wifi: rtw88: handle station mode concurrent scan with AP mode This patch allows vifs sharing same hardware with the AP mode vif to do scan, do note that this could lead to packet loss or disconnection of the AP's clients. Since we don't have chanctx, update scan info upon set channel so bandwidth changes won't go unnoticed and get misconfigured after scan. Download beacon just before scan starts to allow hardware to get proper content to do beaconing. Last, beacons should only be transmitted in AP's operating channel. Turn related beacon functions off while we're in other channels so the receiving stations won't get confused. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414121323.18008-1-pkshih@realtek.com commit a1b8015da57a783b3ceebd8e114afbe07536bd54 Author: Po-Hao Huang Date: Fri Apr 14 20:13:12 2023 +0800 wifi: rtw88: prevent scan abort with other VIFs Only abort scan with current scanning VIF. If we have more than one interface, we could call rtw_hw_scan_abort() with the wrong VIF as input. This avoids potential null pointer being accessed when actually the other VIF is scanning. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414121312.17954-1-pkshih@realtek.com commit 982f4a2004f712ce7aed7f7e69fa64e4c06eee7d Author: Po-Hao Huang Date: Fri Apr 14 20:13:00 2023 +0800 wifi: rtw88: refine reserved page flow for AP mode Only gather reserved pages from AP interface after it has started. Or else ieee80211_beacon_get_*() returns NULL and causes other VIFs' reserved pages fail to download. Update location of current reserved page after beacon renews so offsets changed by beacon can be recognized. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414121300.17900-1-pkshih@realtek.com commit 5ec69129f195f340acb15b8535cb372ccdbcf5d7 Author: Po-Hao Huang Date: Fri Apr 14 20:11:31 2023 +0800 wifi: rtw88: disallow PS during AP mode Firmware can't support PS mode during AP mode, so disallow this case. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414121135.17828-5-pkshih@realtek.com commit ffa71c5477793f41bc7537a60aa54ac40275ab78 Author: Po-Hao Huang Date: Fri Apr 14 20:11:30 2023 +0800 wifi: rtw88: 8822c: extend reserved page number Extend 8822c's reserved page number to accommodate additional required pages. Reserved page is an area of memory in the FIFO dedicated for special purposes. Previously only one interface is supported so 8 pages should suffice, extend it so we can support 2 interfaces concurrently. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414121135.17828-4-pkshih@realtek.com commit ccf73f6e69c0244a979e97eb6c38f80cd6cbc116 Author: Po-Hao Huang Date: Fri Apr 14 20:11:29 2023 +0800 wifi: rtw88: add port switch for AP mode Switch port settings if AP mode does not start on port 0 because of hardware limitation. For some ICs, beacons on ports other than zero could misbehave and do not issue properly, to fix this we change AP VIFs to port zero when multiple interfaces is active. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414121135.17828-3-pkshih@realtek.com commit f0e741e4ddbc01610ca87167a123702b3fdac51f Author: Po-Hao Huang Date: Fri Apr 14 20:11:28 2023 +0800 wifi: rtw88: add bitmap for dynamic port settings In order to support multiple interfaces, multiple port settings will be required. Current code always uses port 0 and should be changed. Declare a bitmap with size equal to hardware port number to record the current usage. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414121135.17828-2-pkshih@realtek.com commit eaddda248483ff78c4d26f1bf420e5f2af436a74 Author: Ping-Ke Shih Date: Fri Apr 14 16:22:28 2023 +0800 wifi: rtw89: mac: use regular int as return type of DLE buffer request The function to request DLE (data link engine) buffer uses 'u16' as return value that mixes error code, so change it to 'int' as regular error code. Also, treat invalid register value (0xfff) as an error. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230414082228.30766-1-pkshih@realtek.com commit 046b6a171009e1ed9ede02194025e9ccd709beb2 Author: Guenter Roeck Date: Wed Apr 19 09:41:27 2023 -0700 device property: make device_property functions take const device * device_property functions do not modify the device pointer passed to them. The underlying of_device and fwnode_ functions actually already take const * arguments. Mark the parameter constant to simplify conversion from of_property to device_property functions, and to let the calling code use const device pointers where possible. Cc: Chris Packham Reviewed-by: Chris Packham Reviewed-by: Sakari Ailus Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20230419164127.3773278-1-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman commit 2025b2ca8004c04861903d076c67a73a0ec6dfca Author: Rodríguez Barbarin, José Javier Date: Tue Apr 11 10:33:29 2023 +0200 mcb-lpc: Reallocate memory region to avoid memory overlapping mcb-lpc requests a fixed-size memory region to parse the chameleon table, however, if the chameleon table is smaller that the allocated region, it could overlap with the IP Cores' memory regions. After parsing the chameleon table, drop/reallocate the memory region with the actual chameleon table size. Co-developed-by: Jorge Sanjuan Garcia Signed-off-by: Jorge Sanjuan Garcia Signed-off-by: Javier Rodriguez Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20230411083329.4506-4-jth@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9be24faadd085c284890c3afcec7a0184642315a Author: Rodríguez Barbarin, José Javier Date: Tue Apr 11 10:33:28 2023 +0200 mcb-pci: Reallocate memory region to avoid memory overlapping mcb-pci requests a fixed-size memory region to parse the chameleon table, however, if the chameleon table is smaller that the allocated region, it could overlap with the IP Cores' memory regions. After parsing the chameleon table, drop/reallocate the memory region with the actual chameleon table size. Co-developed-by: Jorge Sanjuan Garcia Signed-off-by: Jorge Sanjuan Garcia Signed-off-by: Javier Rodriguez Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20230411083329.4506-3-jth@kernel.org Signed-off-by: Greg Kroah-Hartman commit a889c276d33d333ae96697510f33533f6e9d9591 Author: Rodríguez Barbarin, José Javier Date: Tue Apr 11 10:33:27 2023 +0200 mcb: Return actual parsed size when reading chameleon table The function chameleon_parse_cells() returns the number of cells parsed which has an undetermined size. This return value is only used for error checking but the number of cells is never used. Change return value to be number of bytes parsed to allow for memory management improvements. Co-developed-by: Jorge Sanjuan Garcia Signed-off-by: Jorge Sanjuan Garcia Signed-off-by: Javier Rodriguez Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20230411083329.4506-2-jth@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4daa669efcfa5147e4bd5ecb3f1e10c0c96eef27 Author: John Stultz Date: Tue Apr 11 18:04:09 2023 +0000 kernel/configs: Drop Android config fragments In the old days where each device had a custom kernel, the android config fragments were useful to provide the required and reccomended options expected by userland. However, these days devices are expected to use the GKI kernel, so these config fragments no longer needed, and out of date, so they seem to only cause confusion. So lets drop them. If folks are curious what configs are expected by the Android environment, check out the gki_defconfig file in the latest android common kernel tree. Cc: Rob Herring Cc: Amit Pundir Cc: Signed-off-by: John Stultz Link: https://lore.kernel.org/r/20230411180409.1706067-1-jstultz@google.com Signed-off-by: Greg Kroah-Hartman commit 32118bdc9471f6d28dbf3d55b2bf0f912be0c62b Author: Deming Wang Date: Wed Apr 12 03:30:41 2023 -0400 virt: acrn: Replace obsolete memalign() with posix_memalign() memalign() is obsolete according to its manpage. Replace memalign() with posix_memalign() and remove malloc.h include that was there for memalign(). As a pointer is passed into posix_memalign(), initialize *p to NULL to silence a warning about the function's return value being used as uninitialized (which is not valid anyway because the error is properly checked before p is returned). Signed-off-by: Deming Wang Link: https://lore.kernel.org/r/20230412073041.2168-1-wangdeming@inspur.com Signed-off-by: Greg Kroah-Hartman commit 11a96703943fc4293f50f554b9e33c79ef4f5d8d Author: Wedson Almeida Filho Date: Thu Apr 6 01:54:35 2023 -0300 driver core: update comments in device_rename() Document that some subsystems are still going to use device_rename for the time being, so it is not a good idea to assume it's not used. Also remove mentions of a plan to stop renaming net devices. Signed-off-by: Wedson Almeida Filho Link: https://lore.kernel.org/r/20230406045435.19452-1-wedsonaf@gmail.com Signed-off-by: Greg Kroah-Hartman commit e2f06aa885081e1391916367f53bad984714b4db Author: Stephen Boyd Date: Wed Apr 12 15:58:42 2023 -0700 driver core: Don't require dynamic_debug for initcall_debug probe timing Don't require the use of dynamic debug (or modification of the kernel to add a #define DEBUG to the top of this file) to get the printk message about driver probe timing. This printk is only emitted when initcall_debug is enabled on the kernel commandline, and it isn't immediately obvious that you have to do something else to debug boot timing issues related to driver probe. Add a comment too so it doesn't get converted back to pr_debug(). Fixes: eb7fbc9fb118 ("driver core: Add missing '\n' in log messages") Cc: stable Cc: Christophe JAILLET Cc: Brian Norris Reviewed-by: Brian Norris Acked-by: Randy Dunlap Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20230412225842.3196599-1-swboyd@chromium.org Signed-off-by: Greg Kroah-Hartman commit b56eef3e16d888883fefab47425036de80dd38fc Author: Jishnu Prakash Date: Thu Apr 13 15:38:34 2023 -0700 spmi: Add a check for remove callback when removing a SPMI driver When removing a SPMI driver, there can be a crash due to NULL pointer dereference if it does not have a remove callback defined. This is one such call trace observed when removing the QCOM SPMI PMIC driver: dump_backtrace.cfi_jt+0x0/0x8 dump_stack_lvl+0xd8/0x16c panic+0x188/0x498 __cfi_slowpath+0x0/0x214 __cfi_slowpath+0x1dc/0x214 spmi_drv_remove+0x16c/0x1e0 device_release_driver_internal+0x468/0x79c driver_detach+0x11c/0x1a0 bus_remove_driver+0xc4/0x124 driver_unregister+0x58/0x84 cleanup_module+0x1c/0xc24 [qcom_spmi_pmic] __do_sys_delete_module+0x3ec/0x53c __arm64_sys_delete_module+0x18/0x28 el0_svc_common+0xdc/0x294 el0_svc+0x38/0x9c el0_sync_handler+0x8c/0xf0 el0_sync+0x1b4/0x1c0 If a driver has all its resources allocated through devm_() APIs and does not need any other explicit cleanup, it would not require a remove callback to be defined. Hence, add a check for remove callback presence before calling it when removing a SPMI driver. Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()") Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI") Signed-off-by: Jishnu Prakash Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 80c606a842e6b6b6f4a2b53a734a9d3be2cdddff Author: Randy Dunlap Date: Thu Apr 13 15:38:33 2023 -0700 spmi: fix W=1 kernel-doc warnings Fix all W=1 kernel-doc warnings in drivers/spmi/: drivers/spmi/spmi.c:414: warning: expecting prototype for spmi_controller_alloc(). Prototype was for spmi_device_alloc() instead drivers/spmi/spmi.c:592: warning: expecting prototype for spmi_driver_register(). Prototype was for __spmi_driver_register() instead drivers/spmi/spmi.c:592: warning: Function parameter or member 'owner' not described in '__spmi_driver_register' drivers/spmi/spmi-pmic-arb.c:155: warning: cannot understand function prototype: 'struct spmi_pmic_arb ' drivers/spmi/spmi-pmic-arb.c:203: warning: cannot understand function prototype: 'struct pmic_arb_ver_ops ' drivers/spmi/spmi-pmic-arb.c:219: warning: expecting prototype for struct pmic_arb_ver. Prototype was for struct pmic_arb_ver_ops instead Link: https://lore.kernel.org/r/20230113064040.26801-1-rdunlap@infradead.org Cc: Stephen Boyd Signed-off-by: Randy Dunlap Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20230413223834.4084793-6-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 77982a7f4970dcabf4bbcbcae9d1dc85a731ce6b Author: Krzysztof Kozlowski Date: Thu Apr 13 15:38:32 2023 -0700 spmi: mtk-pmif: Drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it is not relevant here). drivers/spmi/spmi-mtk-pmif.c:517:34: error: ‘mtk_spmi_match_table’ defined but not used [-Werror=unused-const-variable=] Link: https://lore.kernel.org/r/20230310222857.315629-2-krzysztof.kozlowski@linaro.org Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20230413223834.4084793-5-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 019fe19bd4079bc9775fb034e49da68b1b8db06a Author: Uwe Kleine-König Date: Thu Apr 13 15:38:31 2023 -0700 spmi: pmic-arb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/r/20230306073446.2194048-4-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20230413223834.4084793-4-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 75fbbd8b53b46fa1c36d055854d7c0c849abf9ff Author: Uwe Kleine-König Date: Thu Apr 13 15:38:30 2023 -0700 spmi: mtk-pmif: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/r/20230306073446.2194048-3-u.kleine-koenig@pengutronix.de Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Uwe Kleine-König Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20230413223834.4084793-3-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 15f44da0ab041e6f4d2218468eec792ebfa25665 Author: Uwe Kleine-König Date: Thu Apr 13 15:38:29 2023 -0700 spmi: hisi-spmi-controller: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/r/20230306073446.2194048-2-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20230413223834.4084793-2-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4ccb0fc2a212d11e5491a4a1e705d6d84463c3a5 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:43:04 2023 +0200 w1: gpio: remove unnecessary ENOMEM messages Core already prints detailed reports on out of memory: WARNING: Possible unnecessary 'out of memory' message Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-16-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 1e5d6652154aca23da856ac7926f23217239ea60 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:43:03 2023 +0200 w1: omap-hdq: remove unnecessary ENOMEM messages Core already prints detailed reports on out of memory: WARNING: Possible unnecessary 'out of memory' message Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-15-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 752144d8939a5b303b753da8528e14d14c2a235c Author: Krzysztof Kozlowski Date: Sat Apr 15 12:43:02 2023 +0200 w1: omap-hdq: add SPDX tag Replace GPLv2 license text with SPDX and drop unnecessary file name in comment to fix checkpatch warnings: WARNING: Missing or malformed SPDX-License-Identifier tag in line 1 WARNING: It's generally not useful to have the filename in the file Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-14-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 0cb90771913922e4b34c296e96d80d451766d942 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:43:01 2023 +0200 w1: omap-hdq: allow compile testing omap-hdq does not depend on anything from ARCH_OMAP for building. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-13-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 4f4129e4e28fb5f5e84a2d9719666968049d95e3 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:43:00 2023 +0200 w1: matrox: remove unnecessary ENOMEM messages Core already prints detailed reports on out of memory: WARNING: Possible unnecessary 'out of memory' message Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-12-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 115ddc758bfbd24e077e2e96b307d174622e1584 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:59 2023 +0200 w1: matrox: use inline over __inline__ Switch to inline as preferred by coding style: WARNING: plain inline is preferred over __inline__ Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-11-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 01bc199b42594e31e5c4fe335f4feb40f976db1f Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:58 2023 +0200 w1: matrox: switch from asm to linux header linux/io.h is preferred over asm/io.h: WARNING: Use #include instead of Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-10-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 787e19ae1fa96cfbbb943e647253e966b4d53407 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:57 2023 +0200 w1: ds2482: do not use assignment in if condition Assignments in if condition are less readable and error-prone. Fixes also checkpatch warning: ERROR: do not use assignment in if condition Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-9-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 076909c24ffa747a56d9c0167c74ee167dd81cd1 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:56 2023 +0200 w1: ds2482: drop unnecessary header linux/delay.h is already included, so drop asm header to also fix checkpatch: WARNING: Use #include instead of Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-8-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 39bbfdacaebbe2576fb0f591e218e76a117886cf Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:55 2023 +0200 w1: ds2433: do not use assignment in if condition Assignments in if condition are less readable and error-prone. Fixes also checkpatch warning: ERROR: do not use assignment in if condition Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-7-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 921e0f2fb09d8decfa8f19eae01f0b68e322363e Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:54 2023 +0200 w1: use octal for file permissions Improve code readability and checkpatch warnings: WARNING: Symbolic permissions 'S_IRUGO' are not preferred. Consider using octal permissions '0444'. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-6-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit ad9c36be1f78f2990310cdcf902eba64cd2b2cf3 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:52 2023 +0200 w1: minor white-space and code style fixes Correct several coding convention violations around white-spaces: ERROR: spaces required around that '=' (ctx:VxV) WARNING: Missing a blank line after declarations ERROR: "foo* bar" should be "foo *bar" ERROR: "(foo*)" should be "(foo *)" WARNING: Block comments use * on subsequent lines WARNING: Block comments use a trailing */ on a separate line WARNING: please, no space before tabs WARNING: Missing a blank line after declarations ERROR: open brace '{' following struct go on the same line ERROR: that open brace { should be on the previous line Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-4-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit a2809664ca296ca89c6c8cc52ce728c1088d5af1 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:51 2023 +0200 w1: ds28e04: correct kerneldoc annotation Correct kerneldoc comments (or drop annotation) to fix: w1_ds28e04.c:57: warning: This comment starts with '/**', but isn't a kernel-doc comment. w1_ds28e04.c:149: warning: This comment starts with '/**', but isn't a kernel-doc comment. Reviewed-by: Randy Dunlap Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-3-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit a866ce3b4fde3d0fb399cb5a81fd12cc3ff6e5c1 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:50 2023 +0200 w1: ds2433: correct kerneldoc annotation Correct kerneldoc comments (or drop annotation) to fix: w1_ds2433.c:46: warning: This comment starts with '/**', but isn't a kernel-doc comment. w1_ds2433.c:141: warning: This comment starts with '/**', but isn't a kernel-doc comment. Reviewed-by: Randy Dunlap Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-2-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 45c85d974f60aa519769c1933859e84aa96fa3f1 Author: Krzysztof Kozlowski Date: Sat Apr 15 12:42:49 2023 +0200 w1: ds2408: drop kerneldoc annotation Drop kerneldoc annotation from comment which is not a kerneldoc to fix: w1_ds2408.c:210: warning: This comment starts with '/**', but isn't a kernel-doc comment Reviewed-by: Randy Dunlap Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415104304.104134-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 58ecb03fc74a5ec4b8c8222c5b4bac572a264c47 Author: Stefan Wahren Date: Thu Apr 6 12:31:37 2023 +0200 w1: ds2482: add i2c id for DS2484 The DS2484 is compatible to the DS2482-100, but also supports a pin-controlled power-saving sleep mode. Link: https://www.analog.com/media/en/technical-documentation/data-sheets/DS2484.pdf Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20230406103137.6092-3-stefan.wahren@chargebyte.com Signed-off-by: Greg Kroah-Hartman commit 22ab6c515d9602e5ddf41998ce5352e8887f4543 Author: Stefan Wahren Date: Thu Apr 6 12:31:36 2023 +0200 dt-bindings: w1: Add DS2482/DS2484 I2C to 1-W bridges This adds a dedicated devicetree binding for the Maxim DS2482/DS2484 I2C to 1-W bridges, which can be extended later for further features (e.g. sleep mode control GPIO). Since one wire is a bus, child nodes needs to be allowed here. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20230406103137.6092-2-stefan.wahren@chargebyte.com Signed-off-by: Greg Kroah-Hartman commit 6f36ff32809aeaa7276d5f663d7adf9298a8bf5c Author: Krzysztof Kozlowski Date: Sat Apr 15 11:38:56 2023 +0200 MAINTAINERS: w1: add Krzysztof Kozlowski as maintainer Evgeniy wrote that he no longer takes patches for 1-Wire/W1 subsystem, so add Krzysztof Kozlowski to help reviewing and handling these. Link: https://lore.kernel.org/all/bdcf41d5-cd61-1e95-0b21-b8fe401644bd@ioremap.net/ Cc: Evgeniy Polyakov Cc: Arnd Bergmann Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230415093856.41948-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 2b3174c96696cde676393474f0e01d0d108462f5 Author: Ilpo Järvinen Date: Tue Apr 11 19:45:32 2023 +0300 n_gsm: Use array_index_nospec() with index that comes from userspace dc.channel used for indexing comes directly from copy_from_user(). Use array_index_nospec() to mitigate speculative side-channel. Link: https://lore.kernel.org/linux-serial/64306d13.ONswMlyWlVKLGkKR%25lkp@intel.com/ Cc: stable Fixes: afe3154ba87e ("tty: n_gsm: add ioctl for DLC config via ldisc handle") Reported-by: kernel test robot Reviewed-by: Daniel Starke Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20230411164532.64175-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 3fac2397f562eb669ddc2f45867a253f3fc26184 Author: Philipp Hortmann Date: Tue Apr 18 22:02:01 2023 +0200 staging: rtl8192e: Fix W_DISABLE# does not work after stop/start When loading the driver for rtl8192e, the W_DISABLE# switch is working as intended. But when the WLAN is turned off in software and then turned on again the W_DISABLE# does not work anymore. Reason for this is that in the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is checked and returned when true. bfirst_after_down is set true when switching the WLAN off in software. But it is not set to false again when WLAN is turned on again. Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix above described bug. Fixes: 94a799425eee ("From: wlanfae [PATCH 1/8] rtl8192e: Import new version of driver from realtek") Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710 Signed-off-by: Greg Kroah-Hartman commit 4de65f2b975fc0eb17629242db09e5895003edbe Author: Philipp Hortmann Date: Sun Apr 16 09:20:25 2023 +0200 staging: rtl8192e: Remove unchanged variables bfsync_processing and more Remove unchanged variable bfsync_processing and rfc_txpowertrackingindex_real to shorten code. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/cb609f904d988febaa579526514586877b1dabf7.1681627603.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit 548534d95b1dd7f9a51ac0ce06f1435be1e8ca33 Author: Philipp Hortmann Date: Sun Apr 16 09:20:19 2023 +0200 staging: rtl8192e: Remove unchanged variable frame_sync_monitor Remove unchanged variable frame_sync_monitor and equations that have always the same result to shorten code. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/0c4bdca5f5dbb93bb05c6b7f32136d4dfb3b0e4b.1681627603.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit dc8aaa4f327b17603165c0b6f8d40f297f5f94c0 Author: Philipp Hortmann Date: Sun Apr 16 09:20:12 2023 +0200 staging: rtl8192e: Remove unchanged variable chan_forced Remove unchanged variable chan_forced and equations that have always the same result to shorten code. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/3f218531a9d31c399d1351d3da7f9ca13d20df0c.1681627603.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit 93bf41cc8afbcc2988be881c4bb569fe9a8c36e1 Author: Philipp Hortmann Date: Sun Apr 16 09:20:06 2023 +0200 staging: rtl8192e: Remove set to true while true of bfirst_after_down Remove set to true while true of bfirst_after_down to shorten code. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/053ab341e80909e81867e42ec4c077e76b762051.1681627603.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit bfc1bb7866f8c91ae829eadbc1bc7c81b5f6f623 Author: Philipp Hortmann Date: Sun Apr 16 09:19:58 2023 +0200 staging: rtl8192e: Remove second initialization of bActuallySet Remove second initialization of bActuallySet to shorten code. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/ebf51fbd56bad4f8fd7fb51fe031f376c3ab6d2c.1681627603.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit b0e60e96afa0719afddd483d9492a11851c2d9cf Author: Philipp Hortmann Date: Sun Apr 16 09:19:52 2023 +0200 staging: rtl8192e: Remove unused macro RT_SET_PS_LEVEL Remove unused macro RT_SET_PS_LEVEL to shorten code. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/0d397210830f77ad3231c3b4a0465ae89aacb962.1681627603.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit 88b81bddf1f3c2b4b23c687e27a5b6e0a6a63795 Author: Philipp Hortmann Date: Sun Apr 16 09:19:45 2023 +0200 staging: rtl8192e: Remove unused function rtl92e_disable_nic Remove unused function rtl92e_disable_nic to shorten code. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/5ce2ef58f66e25d7db7432c56c7b7c37a2b15fc1.1681627603.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8020247877ebdf40416cb24bdfc47cba6c499412 Author: Philipp Hortmann Date: Sun Apr 16 09:19:37 2023 +0200 staging: rtl8192e: Remove unchanged variable RegRfPsLevel Remove unchanged variable RegRfPsLevel and equations that have always the same result to shorten code. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/49162b0041db33c6c43c4126839baed69c76cb89.1681627603.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit be3206e8906e7a93df673ab2e96d69304a008edc Author: Dhruva Gole Date: Thu Apr 20 11:12:57 2023 +0530 spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS Using this macro makes the code more readable. It also inits the members of dev_pm_ops in the following manner without us explicitly needing to: .suspend = cqspi_suspend, \ .resume = cqspi_resume, \ .freeze = cqspi_suspend, \ .thaw = cqspi_resume, \ .poweroff = cqspi_suspend, \ .restore = cqspi_resume Also get rid of conditional compilation based on CONFIG_PM_SLEEP because it introduces build issues with certain configs when CQSPI_DEV_PM_OPS is just NULL. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304191900.2fARFQW9-lkp@intel.com/ Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") Signed-off-by: Dhruva Gole Link: https://lore.kernel.org/r/20230420054257.925092-1-d-gole@ti.com Signed-off-by: Mark Brown commit a9e42d9e8b4be36a1e0dde0285a9ff36b2e06a46 Author: Simon Trimmer Date: Thu Apr 20 11:20:43 2023 +0100 ASoC: cs35l56: Remove duplicate mbox log messages cs35l56_mbox_send() logs a warning when sending a mbox command fails so the callers can be simplified. Signed-off-by: Simon Trimmer Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20230420102043.1151830-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 2cc3fdcddc86644c070223c522e418416cb7b1a2 Author: Mark Brown Date: Wed Apr 19 19:45:06 2023 +0100 ASoC: es8316: Don't use ranges based register lookup for a single register The es8316 driver uses a register range to specify the single volatile register it has. While the cost will be in the noise this is a bunch of overhead compared to just having a volatile_reg() callback so switch to the callback. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230419-asoc-es8316-volatile-v1-1-2074ec93d8f1@kernel.org Signed-off-by: Mark Brown commit 996b07efe49620325332081afdb0dc0bd6fe5cd0 Author: Ranjani Sridharan Date: Thu Apr 20 13:47:14 2023 +0300 ASoC: SOF: Intel: Split the set_power_op for IPC3 and IPC4 Suspending to S0iX with IPC3 requires the PM_GATE IPC to be sent again to stop the DMA trace. But with IPC4, this is not needed as the trace is stopped with the LARGE_CONFIG_SET IPC. Also, sending the MOD_D0IX IPC to set the D0I3 state again when the DSP is in D0I3 already results in an imbalance in PM runtime states in the firmware. So split the set_power_state ops for IPC3 and IPC4 to avoid sending the MOD_D0IX IPC when the DSP is already in D0I3 with IPC4. Signed-off-by: Ranjani Sridharan Reviewed-by: Rander Wang Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Pierre-Louis Bossart Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230420104714.29573-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 6d0a21dd95c349bbe3663a4870ff7e70ddc6c9b6 Author: Ranjani Sridharan Date: Thu Apr 20 14:41:37 2023 +0300 ASoC: SOF: pcm: Add an option to skip platform trigger during stop In the case of IPC4, a pipeline is only paused during STOP/PAUSE/SUSPEND triggers and the FW keeps the host DMA running when a pipeline is paused. The start/stop tests iterate through STOP/START triggers without involving a hw_free. This means that the pipeline state will only toggle between PAUSED (during the STOP trigger) and RUNNING (during the START trigger). So this test should be treated in the same way as a PAUSE_PUSH/PAUSE_RELEASE test and the DMA should be kept running when toggling the pipeline states between PAUSED and RUNNING. Since there is no way to tell if a STOP trigger will be followed by hw_free or not, this patch proposes to always skip DMA stop during the STOP trigger and handle it later during hw_free. Introduce a new flag in struct sof_ipc_pcm_ops, delayed_platform_trigger, that will be used to ensure that the host DMA will not be stopped during the STOP/PAUSE/RELEASE triggers and set it for IPC4. The platform_trigger call to stop the DMA will be invoked during PCM hw_free instead when the pipeline is reset. Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230420114137.27613-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3e94369729ea8a825cf8bf304bfb1749de62ebf4 Author: Ranjani Sridharan Date: Thu Apr 20 14:41:36 2023 +0300 ASoC: SOF: Intel: hda: Do not stop/start DMA during pause/release The FW does not pause/stop the host DMA during pause and stopping the host DMA from the driver could result in an unknown behaviour. So, skip triggering the HD-Audio host DMA during pause/release. Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230420114137.27613-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit dc5a3e60a4b5974a0cb5bf2c5df70a490dce9df2 Author: Bard Liao Date: Wed Apr 19 14:55:24 2023 -0500 ASoC: Intel: sof_sdw: append codec type to dai link name The existing sdw_sof machine driver constructs two SoundWire interfaces by direction and sdw link id. It means that we will have exactly the same dai link name if two dai links are on the same sdw link with the same direction. The new Realtek codec has two SoundWire interfaces for jack and DMIC functions and they are treated as different codecs. To create two dai links for jack and DMIC, we need to have different dai link names. This patch suggests to append codec type if there are two or more different types of devices on the same sdw bus. Signed-off-by: Bard Liao Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Link: https://lore.kernel.org/r/20230419195524.46995-8-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit c8db7b50128b8cc61a5ca6e4717cf8158fca302a Author: Bard Liao Date: Wed Apr 19 14:55:23 2023 -0500 ASoC: Intel: sof_sdw: support different devices on the same sdw link The existing code assumes all devices on the same soundwire link are the same devices. eg. all rt1316. This commit removes the assumption and supports different devices on the same soundwire link. Signed-off-by: Bard Liao Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Link: https://lore.kernel.org/r/20230419195524.46995-7-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 16373f30777f45823fa68e850b230fa2ef9d7e92 Author: Bard Liao Date: Wed Apr 19 14:55:22 2023 -0500 ASoC: Intel: sof_sdw: set codec_num = 1 if the device is not aggregated We assume adr_link->num_adr = 1 if a device is not aggregated. However, the assumption is not valid if there are different type devices on the same soundwire link. Signed-off-by: Bard Liao Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Link: https://lore.kernel.org/r/20230419195524.46995-6-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit e9fcbaff5fb871f1a10f09d7d1a4cd13c923e280 Author: Yong Zhi Date: Wed Apr 19 14:55:21 2023 -0500 ASoC: Intel: sof_sdw_max98373: change sof_sdw_mx8373_late_probe to static call sof_sdw_mx8373_late_probe is only used in sof_sdw_max98373, so it should be static and rename it to 'mx8373_sdw_late_probe'. Signed-off-by: Yong Zhi Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20230419195524.46995-5-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 06b830bd73ec66b9316b899ae37b1d5b83d16a32 Author: Yong Zhi Date: Wed Apr 19 14:55:20 2023 -0500 ASoC: Intel: sof_sdw: remove late_probe flag in struct sof_sdw_codec_info Just use codec_card_late_probe ptr in struct sof_sdw_codec_info for validation check and drop late_probe variable. Signed-off-by: Yong Zhi Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20230419195524.46995-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit f5460a155ecb961463f6ff766c7d3092f07e6642 Author: apoorv Date: Wed Apr 19 14:55:19 2023 -0500 ASoC: Intel: soc-acpi: Add entry for rt711-sdca-sdw at link 2 in RPL match table RT711 sdca sdw is added with SDW2 link for RPL-P CRB platform. Signed-off-by: apoorv Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20230419195524.46995-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 058924644f9596b8c55fc81f01f741d628eed940 Author: Curtis Malainey Date: Wed Apr 19 14:55:18 2023 -0500 ASoC: Intel: sof_cirrus_common: Guard against missing buses Even if we find a acpi device we can still be missing the physical node. Signed-off-by: Curtis Malainey Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20230419195524.46995-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 367fd6ffa294ca3346902aa0814fac31bb5a6059 Author: Curtis Malainey Date: Wed Apr 19 14:40:57 2023 -0500 ASoC: SOF: Use no_reply calls for TX Convert all existing calls that pass "NULL, 0" for reply data to the new no_reply calls. Also convert any calls that pass in data but don't actually parse the result. Signed-off-by: Curtis Malainey Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20230419194057.42205-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit ccb541a00b5bf87f1b7b9301373bf88a3257c688 Author: Curtis Malainey Date: Wed Apr 19 14:40:56 2023 -0500 ASoC: SOF: ipc: Add no reply inline calls 95% of the calls inside SOF to TX an IPC don't care about a reply. Yet the previous commit cleaned up a bunch of replies that were being populated and then thrown away. This adds some functions so users who do not need replies don't feel obligated to provide the space to the API. Signed-off-by: Curtis Malainey Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20230419194057.42205-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit f91cf1a30255d81cf1d8992974ec0a9c0fd4a771 Author: Jiri Slaby (SUSE) Date: Thu Apr 20 11:35:59 2023 +0200 tty: vt: drop checks for undefined VT_SINGLE_DRIVER VT_SINGLE_DRIVER is defined nowhere. Remove its checks. These were added long time ago and never used. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230420093559.13200-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 921234d78339b9ee67c2da4dc78aa6ecd47d76e1 Author: Jiri Slaby (SUSE) Date: Thu Apr 20 11:35:58 2023 +0200 tty: vt: distribute EXPORT_SYMBOL() There is a list of EXPORT_SYMBOL()s at the end of the file. Put them all by their definition. This is how we usually do that. give_up_console() lost its VT_SINGLE_DRIVER local ifndef protection as that whole code is under this check. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230420093559.13200-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 71ca6e4bf44f9a737f11e3f169430f81e9febd7b Author: Jiri Slaby (SUSE) Date: Thu Apr 20 11:35:57 2023 +0200 tty: vt: simplify some cases in tioclinux() There is no need to set "ret" variable and break. We can simply return from the cases. This makes the code much easier to follow, as many else branches are redundant. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230420093559.13200-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6b97370b2cc6ef75acb72d651ef57041c8f1ece9 Author: Jiri Slaby (SUSE) Date: Thu Apr 20 11:35:56 2023 +0200 tty: vt: reformat tioclinux() Reformat tioclinux() to what we are used to. That is: * format switch-case (one less indent level), * format comments (the same indent level), and * add a newline before return. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230420093559.13200-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit f06c2a9000ebecbb461196e59ce063f742272902 Author: Biju Das Date: Wed Apr 12 15:50:53 2023 +0100 tty: serial: sh-sci: Fix end of transmission on SCI We need to set TE to "0" (i.e., disable serial transmission) to get the expected behavior of the end of serial transmission. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230412145053.114847-6-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit d61ae331d6f35183b38e0c992bc01bf15d8591c3 Author: Biju Das Date: Wed Apr 12 15:50:52 2023 +0100 tty: serial: sh-sci: Add support for tx end interrupt handling As per the RZ/G2L users hardware manual (Rev.1.20 Sep, 2022), section 23.3.7 Serial Data Transmission (Asynchronous Mode), it is mentioned that, set the SCR.TIE bit to 0 and SCR.TEIE bit to 1, after the last data to be transmitted are written to the TDR. This will generate tx end interrupt and in the handler set SCR.TE and SCR.TEIE to 0. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230412145053.114847-5-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 1707ce2d1e4d701db28ba2250d9d72dcf762babc Author: Biju Das Date: Wed Apr 12 15:50:51 2023 +0100 tty: serial: sh-sci: Fix TE setting on SCI IP As per the RZ/G2L users hardware manual (Rev.1.20 Sep, 2022), section 23.3.7 Serial Data Transmission (Asynchronous Mode) it is mentioned that the TE (transmit enable) must be set after setting TIE (transmit interrupt enable) or these 2 bits are set to 1 simultaneously by a single instruction. So set these 2 bits in single instruction. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230412145053.114847-4-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit cf383d123869574d1de4304ed73771d3eb5a3d40 Author: Biju Das Date: Wed Apr 12 15:50:50 2023 +0100 tty: serial: sh-sci: Add RZ/G2L SCIFA DMA rx support SCIFA IP on RZ/G2L SoC has the same signal for both interrupt and DMA transfer request. Setting DMARS register for DMA transfer makes the signal to work as a DMA transfer request signal and subsequent interrupt requests to the interrupt controller are masked. Similarly clearing DMARS register makes signal to work as interrupt signal and subsequent interrupt requests to the interrupt controller are unmasked. Add SCIFA DMA rx support for RZ/G2L alike SoCs by disabling RXI line interrupt and setting DMARS registers by DMA api for DMA transfer request. Apart from this, we must set FIFO trigger to 1 for the expected behavior of the receive transmission. While at it replace the parameter irq to s->irqs[SCIx_RXI_IRQ] in disable_irq_nosync() to match enable_irq() in sci_dma_rx_reenable_irq(). Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230412145053.114847-3-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 8749061be196b41a874d71c073c03171bf2741b2 Author: Biju Das Date: Wed Apr 12 15:50:49 2023 +0100 tty: serial: sh-sci: Add RZ/G2L SCIFA DMA tx support SCIFA IP on RZ/G2L SoC has the same signal for both interrupt and DMA transfer request. Setting DMARS register for DMA transfer makes the signal to work as a DMA transfer request signal and subsequent interrupt requests to the interrupt controller are masked. Similarly clearing DMARS register makes signal to work as interrupt signal and subsequent interrupt requests to the interrupt controller are unmasked. Add SCIFA DMA tx support for RZ/G2L alike SoCs by disabling TXI line interrupt and setting DMARS registers by DMA api for DMA transfer request. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230412145053.114847-2-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 3f42b142ea1171967e40e10e4b0241c0d6d28d41 Author: Jan Kundrát Date: Wed Apr 5 22:14:23 2023 +0200 serial: max310x: fix IO data corruption in batched operations After upgrading from 5.16 to 6.1, our board with a MAX14830 started producing lots of garbage data over UART. Bisection pointed out commit 285e76fc049c as the culprit. That patch tried to replace hand-written code which I added in 2b4bac48c1084 ("serial: max310x: Use batched reads when reasonably safe") with the generic regmap infrastructure for batched operations. Unfortunately, the `regmap_raw_read` and `regmap_raw_write` which were used are actually functions which perform IO over *multiple* registers. That's not what is needed for accessing these Tx/Rx FIFOs; the appropriate functions are the `_noinc_` versions, not the `_raw_` ones. Fix this regression by using `regmap_noinc_read()` and `regmap_noinc_write()` along with the necessary `regmap_config` setup; with this patch in place, our board communicates happily again. Since our board uses SPI for talking to this chip, the I2C part is completely untested. Fixes: 285e76fc049c ("serial: max310x: use regmap methods for SPI batch operations") Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: Jan Kundrát Link: https://lore.kernel.org/r/79db8e82aadb0e174bc82b9996423c3503c8fb37.1680732084.git.jan.kundrat@cesnet.cz Signed-off-by: Greg Kroah-Hartman commit 63f4c34561718a349d321105adab028cbf212d57 Author: Tony Lindgren Date: Wed Apr 19 14:54:22 2023 +0300 serial: core: Disable uart_start() on uart_remove_one_port() While rebinding a uart device in a loop I noticed we may see a tx related race on uart_remove_one_port(): uart_write from n_tty_write n_tty_write from file_tty_write.constprop.0 file_tty_write.constprop.0 from vfs_write vfs_write from ksys_write ksys_write from ret_fast_syscall Let's disallow tx on port->UPF_DEAD. This flag gets set before we start tearing down the port in uart_remove_one_port(). Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20230419115423.59957-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 04e82793f068d2f0ffe62fcea03d007a8cdc16a7 Author: Tony Lindgren Date: Tue Apr 18 13:14:06 2023 +0300 serial: 8250: Reinit port->pm on port specific driver unbind When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see an oops about 10 seconds later. This can produce the following at least on some TI SoCs: Unhandled fault: imprecise external abort (0x1406) Internal error: : 1406 [#1] SMP ARM Turns out that we may still have the serial port hardware specific driver port->pm in use, and serial8250_pm() tries to call it after the port specific driver is gone: serial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base] uart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base] uart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c __tty_hangup.part.0 from disassociate_ctty+0x154/0x20c disassociate_ctty from do_exit+0x744/0xaac do_exit from do_group_exit+0x40/0x8c do_group_exit from __wake_up_parent+0x0/0x1c Let's fix the issue by calling serial8250_set_defaults() in serial8250_unregister_port(). This will set the port back to using the serial8250 default functions, and sets the port->pm to point to serial8250_pm. Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20230418101407.12403-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a Author: Florian Fainelli Date: Fri Apr 14 10:02:39 2023 -0700 serial: 8250: Add missing wakeup event reporting An 8250 UART configured as a wake-up source would not have reported itself through sysfs as being the source of wake-up, correct that. Fixes: b3b708fa2780 ("wake up from a serial port") Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com Signed-off-by: Greg Kroah-Hartman commit d57d56e4dddfb5c92cd81abf8922055bf0fb85a4 Author: Sherry Sun Date: Fri Apr 14 10:21:11 2023 +0800 tty: serial: fsl_lpuart: use UARTMODIR register bits for lpuart32 platform For lpuart32 platforms, UARTMODIR register is used instead of UARTMODEM. So here should configure the corresponding UARTMODIR register bits to avoid confusion. Reviewed-by: Ilpo Järvinen Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20230414022111.20896-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 Author: Shenwei Wang Date: Mon Apr 10 14:55:55 2023 -0500 tty: serial: fsl_lpuart: adjust buffer length to the intended size Based on the fls function definition provided below, we should not subtract 1 to obtain the correct buffer length: fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32. Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx") Signed-off-by: Shenwei Wang Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com Signed-off-by: Greg Kroah-Hartman commit 9e4f2a8004213339e9d837d891a59cc80e082966 Author: Johan Hovold Date: Wed Apr 12 14:48:11 2023 +0200 serial: fix TIOCSRS485 locking The RS485 multipoint addressing support for some reason added a new ADDRB termios cflag which is (only!) updated from one of the RS485 ioctls. Make sure to take the termios rw semaphore for the right ioctl (i.e. set, not get). Fixes: ae50bb275283 ("serial: take termios_rwsem for ->rs485_config() & pass termios as param") Cc: stable@vger.kernel.org # 6.0 Cc: Ilpo Järvinen Reviewed-by: Ilpo Järvinen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230412124811.11217-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit c6c01763f24c40ec1a5faeb260632fdf0824bb72 Author: Conor Dooley Date: Thu Apr 6 21:57:50 2023 +0100 serial: make SiFive serial drivers depend on ARCH_ symbols As part of converting RISC-V SOC_FOO symbols to ARCH_FOO to match the use of such symbols on other architectures, convert the SiFive serial driver Kconfig entries from the SOC_ symbols to ARCH_ instead. Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230406-carnival-aspirate-fcf69a30078c@spud Signed-off-by: Greg Kroah-Hartman commit ee13ea33e066507a374a0d091034f1150e9d0c07 Author: Jiri Slaby (SUSE) Date: Thu Apr 20 11:35:30 2023 +0200 tty: synclink_gt: don't allocate and pass dummy flags In synclinc_gt, the flag_buf is allocated, zeroed and passed to ldisc's receive_buf(). It is never written to, so it serves as a dummy buffer. That's unneeded because all ldiscs accept NULL as flags. That NULL resolves to the TTY_NORMAL flag. So drop all this nonsense. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230420093530.13133-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5c7e105cd156fc9adf5294a83623d7a40c15f9b9 Author: Jiri Slaby (SUSE) Date: Thu Apr 20 11:35:14 2023 +0200 tty: serial: simplify qcom_geni_serial_send_chunk_fifo() * use memcpy() instead of the loop (removes c variable) * use remaining parameter directly (removes chunk variable) The code is simpler and easier to follow. Cc: Andy Gross Cc: Bjorn Andersson Cc: Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230420093514.13055-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit f3ef9d668b8b1b0e3e91dd9ea532f9d60eb61704 Author: Christophe JAILLET Date: Sat Apr 15 18:27:11 2023 +0200 leds: pwm-multicolor: Simplify an error message dev_err_probe() already display the error code. There is no need to duplicate it explicitly in the error message. While at it, add a missing \n at the end of the message. Signed-off-by: Christophe JAILLET Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/07d35e221faaa380fd11cd4597e42354c8eb350c.1681576017.git.christophe.jaillet@wanadoo.fr commit 9f6ffd0da650f6ed264e124a3d6bb4e11a49f9f1 Author: Wadim Egorov Date: Wed Apr 12 16:05:51 2023 +0200 dt-bindings: leds: Convert PCA9532 to dtschema Convert the PCA9532 LED Dimmer to dtschema. While at it, update the example to match recommended node names and the link to the product datasheet. Also add GPIO properties since the driver allows to use unused pins as GPIOs. Signed-off-by: Wadim Egorov Acked-by: Pavel Machek Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230412140552.451527-1-w.egorov@phytec.de commit 254d5a59464eea1324353d84c0f614c413e8e54f Author: Daniel Starke Date: Thu Apr 20 10:50:09 2023 +0200 tty: n_gsm: fix redundant assignment of gsm->encoding The function gsmld_open() contains a redundant assignment of gsm->encoding. The same value of GSM_ADV_OPT is already assigned to it during the initialization of the struct in gsm_alloc_mux() a few lines earlier. Fix this by removing the redundant second assignment of gsm->encoding in gsmld_open(). Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Reviewed-by: Ilpo Järvinen Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20230420085017.7314-1-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman commit edd4cab2d492daa5e45bd45e44084a2b9880f224 Author: Ian Rogers Date: Wed Apr 19 20:04:30 2023 -0700 perf test: Fix maps use after put Fix a use after put reference count issue. maps is copied from leader, but the leader is put on line 79 and then maps is used to read the reference count below - so a use after put, with the put of maps happening within thread__put. Fix by reversing the order of puts so that the leader is put last. To explain the reference count checker, I wrote this up as a little example here: https://perf.wiki.kernel.org/index.php/Reference_Count_Checking Note, the bug was introduced by the committer and wasn't present in the original reference count patch set. Committer notes: Yes, the bug predated your patch and is detected by the reference count checking you contributed. This was just part of splitting up your series into smaller chunks, in this case either we fix the problem detected while developing this reference counting infrastructure before the patch introducing REFCNT_CHECKING or fix it later after the merged infrastructure, when built with EXTRA_CFLAGS="-DREFCNT_CHECKING=1" detects it when running 'perf test', which is what this patch does. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20230420030430.489243-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1bb31cc7afe6b1524d1cd74a1ed53c1add16fc73 Merge: 81444b77a4443 414c109bdf496 Author: Will Deacon Date: Thu Apr 20 11:22:33 2023 +0100 Merge branch 'for-next/mm' into for-next/core * for-next/mm: arm64: mm: always map fixmap at page granularity arm64: mm: move fixmap code to its own file arm64: add FIXADDR_TOT_{START,SIZE} Revert "Revert "arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()"" arm: uaccess: Remove memcpy_page_flushcache() mm,kfence: decouple kfence from page granularity mapping judgement commit 81444b77a4443e985b567310f19d601368ed4762 Merge: f8863bc8c1f9c b7b4ce84c830a Author: Will Deacon Date: Thu Apr 20 11:22:09 2023 +0100 Merge branch 'for-next/misc' into for-next/core * for-next/misc: arm64: kexec: include reboot.h arm64: delete dead code in this_cpu_set_vectors() arm64: kernel: Fix kernel warning when nokaslr is passed to commandline arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step arm64/sme: Fix some comments of ARM SME arm64/signal: Alloc tpidr2 sigframe after checking system_supports_tpidr2() arm64/signal: Use system_supports_tpidr2() to check TPIDR2 arm64: compat: Remove defines now in asm-generic arm64: kexec: remove unnecessary (void*) conversions arm64: armv8_deprecated: remove unnecessary (void*) conversions firmware: arm_sdei: Fix sleep from invalid context BUG commit f8863bc8c1f9cf4bc3bdc58a98c5a41d0b4c14c5 Merge: ea88dc925c3a2 504cae453f822 Author: Will Deacon Date: Thu Apr 20 11:22:04 2023 +0100 Merge branch 'for-next/kdump' into for-next/core * for-next/kdump: arm64: kdump: defer the crashkernel reservation for platforms with no DMA memory zones arm64: kdump: do not map crashkernel region specifically arm64: kdump : take off the protection on crashkernel memory region commit ea88dc925c3a24213abf6d428d8fc35f74ec10bd Merge: 31eb87cfd90e2 0f59dca63bf2c Author: Will Deacon Date: Thu Apr 20 11:21:56 2023 +0100 Merge branch 'for-next/ftrace' into for-next/core * for-next/ftrace: arm64: ftrace: Simplify get_ftrace_plt arm64: ftrace: Add direct call support ftrace: selftest: remove broken trace_direct_tramp ftrace: Make DIRECT_CALLS work WITH_ARGS and !WITH_REGS ftrace: Store direct called addresses in their ops ftrace: Rename _ftrace_direct_multi APIs to _ftrace_direct APIs ftrace: Remove the legacy _ftrace_direct API ftrace: Replace uses of _ftrace_direct APIs with _ftrace_direct_multi ftrace: Let unregister_ftrace_direct_multi() call ftrace_free_filter() commit 31eb87cfd90e27226e187e99a9ea3f62c6992f07 Merge: 0f6563a32c831 863da0bdb17b5 Author: Will Deacon Date: Thu Apr 20 11:21:45 2023 +0100 Merge branch 'for-next/cpufeature' into for-next/core * for-next/cpufeature: arm64/cpufeature: Use helper macro to specify ID register for capabilites arm64/cpufeature: Consistently use symbolic constants for min_field_value arm64/cpufeature: Pull out helper for CPUID register definitions commit 0f6563a32c83171277dbc1af020754ff4d1f8a0f Merge: 67eacd616ba4f 172420865b292 Author: Will Deacon Date: Thu Apr 20 11:21:39 2023 +0100 Merge branch 'for-next/asm' into for-next/core * for-next/asm: arm64: uaccess: remove unnecessary earlyclobber arm64: uaccess: permit put_{user,kernel} to use zero register arm64: uaccess: permit __smp_store_release() to use zero register arm64: atomics: lse: improve cmpxchg implementation commit 67eacd616ba4f6a5cd6fa236a0c8365bb91a718a Merge: e8d018dd0257f 858a56630a840 Author: Will Deacon Date: Thu Apr 20 11:21:31 2023 +0100 Merge branch 'for-next/acpi' into for-next/core * for-next/acpi: ACPI: AGDI: Improve error reporting for problems during .remove() commit 482c84e906e535072c55395acabd3a58e9443d12 Author: Mario Limonciello Date: Fri Apr 14 09:40:08 2023 -0500 i2c: designware: Add doorbell support for Mendocino Mendocino and later platform don't use the platform feature mailbox for communication for I2C arbitration, they rely upon ringing a doorbell. Detect the platform by the device ID of the root port and choose the appropriate method. Link: https://lore.kernel.org/linux-i2c/20220916131854.687371-3-jsd@semihalf.com/ Signed-off-by: Mario Limonciello Acked-by: Jarkko Nikula Reviewed-by: Mark Hasemeyer Tested-by: Mark Hasemeyer Acked-by: Wolfram Sang Signed-off-by: Herbert Xu commit 440da737cf8d35a1b2205678cc1879fa90948f7a Author: Mario Limonciello Date: Fri Apr 14 09:40:07 2023 -0500 i2c: designware: Use PCI PSP driver for communication Currently the PSP semaphore communication base address is discovered by using an MSR that is not architecturally guaranteed for future platforms. Also the mailbox that is utilized for communication with the PSP may have other consumers in the kernel, so it's better to make all communication go through a single driver. Signed-off-by: Mario Limonciello Reviewed-by: Mark Hasemeyer Acked-by: Jarkko Nikula Tested-by: Mark Hasemeyer Acked-by: Wolfram Sang Signed-off-by: Herbert Xu commit 1560541631a6f3215d27aeea182a5682644d33ba Author: Danny Tsen Date: Thu Apr 13 15:46:25 2023 -0400 powerpc: Move Power10 feature PPC_MODULE_FEATURE_P10 Move Power10 feature, PPC_MODULE_FEATURE_P10, definition to be in arch/powerpc/include/asm/cpufeature.h. Signed-off-by: Danny Tsen Acked-by: Michael Ellerman (powerpc) Signed-off-by: Herbert Xu commit 9c716e1bd369afa2d1c5038297e8ceda3f82db7d Author: Danny Tsen Date: Thu Apr 13 15:46:24 2023 -0400 crypto: p10-aes-gcm - Remove POWER10_CPU dependency Remove Power10 dependency in Kconfig and detect Power10 feature at runtime. Signed-off-by: Danny Tsen Acked-by: Michael Ellerman (powerpc) Signed-off-by: Herbert Xu commit ba24b8eb3ef676cb7d6cef4a2a53f3624f880d42 Author: David Howells Date: Thu Apr 13 16:40:18 2023 +0100 crypto: testmgr - Add some test vectors for cmac(camellia) Add some test vectors for 128-bit cmac(camellia) as found in draft-kato-ipsec-camellia-cmac96and128-01 section 6.2. The document also shows vectors for camellia-cmac-96, and for VK with a length greater than 16, but I'm not sure how to express those in testmgr. This also leaves cts(cbc(camellia)) untested, but I can't seem to find any tests for that that I could put into testmgr. Signed-off-by: David Howells cc: Herbert Xu cc: Chuck Lever cc: Scott Mayhew cc: linux-nfs@vger.kernel.org cc: linux-crypto@vger.kernel.org Link: https://datatracker.ietf.org/doc/pdf/draft-kato-ipsec-camellia-cmac96and128-01 Signed-off-by: Herbert Xu commit cfbda734d6678047fd3beb1f67d9682825773341 Author: Herbert Xu Date: Thu Apr 13 14:24:25 2023 +0800 crypto: cryptd - Add support for cloning hashes Allow cryptd hashes to be cloned. The underlying hash will be cloned. Signed-off-by: Herbert Xu commit 0303b7f5df603b91bc12e39c9309c094816ba6a9 Author: Herbert Xu Date: Thu Apr 13 14:24:23 2023 +0800 crypto: cryptd - Convert hash to use modern init_tfm/exit_tfm The cryptd hash template was still using the obsolete cra_init/cra_exit interface. Make it use the modern ahash init_tfm/exit_tfm instead. Signed-off-by: Herbert Xu Reviewed-by: Simon Horman Signed-off-by: Herbert Xu commit 8538e60d36d0c683d59eaeabea19f101a6cf1c66 Author: Herbert Xu Date: Thu Apr 13 14:24:21 2023 +0800 crypto: hmac - Add support for cloning Allow hmac to be cloned. The underlying hash can be used directly with a reference count. Signed-off-by: Herbert Xu commit ed3630b83e9394acef27041de7a2223f1e875e9a Author: Herbert Xu Date: Thu Apr 13 14:24:19 2023 +0800 crypto: hash - Add crypto_clone_ahash/shash This patch adds the helpers crypto_clone_ahash and crypto_clone_shash. They are the hash-specific counterparts of crypto_clone_tfm. This allows code paths that cannot otherwise allocate a hash tfm object to do so. Once a new tfm has been obtained its key could then be changed without impacting other users. Note that only algorithms that implement clone_tfm can be cloned. However, all keyless hashes can be cloned by simply reusing the tfm object. Signed-off-by: Herbert Xu Reviewed-by: Simon Horman Signed-off-by: Herbert Xu commit 3c3a24cb0ae46c9c45e4ce2272f84f0504831f59 Author: Herbert Xu Date: Thu Apr 13 14:24:17 2023 +0800 crypto: api - Add crypto_clone_tfm This patch adds the helper crypto_clone_tfm. The purpose is to allocate a tfm object with GFP_ATOMIC. As we cannot sleep, the object has to be cloned from an existing tfm object. This allows code paths that cannot otherwise allocate a crypto_tfm object to do so. Once a new tfm has been obtained its key could then be changed without impacting other users. Signed-off-by: Herbert Xu Reviewed-by: Simon Horman Signed-off-by: Herbert Xu commit ae131f4970f0778f35ed06aeb15bde2fbc1d9619 Author: Herbert Xu Date: Thu Apr 13 14:24:15 2023 +0800 crypto: api - Add crypto_tfm_get Add a crypto_tfm_get interface to allow tfm objects to be shared. They can still be freed in the usual way. This should only be done with tfm objects with no keys. You must also not modify the tfm flags in any way once it becomes shared. Signed-off-by: Herbert Xu Reviewed-by: Simon Horman Signed-off-by: Herbert Xu commit 94330fbe082acfd7ac9f2a348933944ba78b14dc Author: Ard Biesheuvel Date: Wed Apr 12 13:00:35 2023 +0200 crypto: x86/sha - Use local .L symbols for code Avoid cluttering up the kallsyms symbol table with entries that should not end up in things like backtraces, as they have undescriptive and generated identifiers. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 9ac589cf3cdf2344a5240d7df04ccb37070d7e96 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:34 2023 +0200 crypto: x86/crc32 - Use local .L symbols for code Avoid cluttering up the kallsyms symbol table with entries that should not end up in things like backtraces, as they have undescriptive and generated identifiers. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 1d4b0ff30c2d698c9755bf52d20c073d46bca025 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:33 2023 +0200 crypto: x86/aesni - Use local .L symbols for code Avoid cluttering up the kallsyms symbol table with entries that should not end up in things like backtraces, as they have undescriptive and generated identifiers. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit e4ab7680bb0c97656300cc77c79d85d445769d00 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:32 2023 +0200 crypto: x86/sha256 - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit c41672b9fdc3cbee289e85eb00900d467ec5f03f Author: Ard Biesheuvel Date: Wed Apr 12 13:00:31 2023 +0200 crypto: x86/ghash - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 3695536028442d4181ccf01ddabddef845ac1f86 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:30 2023 +0200 crypto: x86/des3 - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Co-developed-by: Thomas Garnier Signed-off-by: Thomas Garnier Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 3b519dc878a5d19593bbb1773abedbf39a619f66 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:29 2023 +0200 crypto: x86/crc32c - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 7f8ec316480bf68d88c4ecc6a948ad1e00fafc71 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:28 2023 +0200 crypto: x86/cast6 - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Co-developed-by: Thomas Garnier Signed-off-by: Thomas Garnier Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 0dcc7782dea65190a3d826d6329b6ff0f9d787bf Author: Ard Biesheuvel Date: Wed Apr 12 13:00:27 2023 +0200 crypto: x86/cast5 - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Co-developed-by: Thomas Garnier Signed-off-by: Thomas Garnier Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 24ff1e9d726001767c544bdee3aab8abc0a30199 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:26 2023 +0200 crypto: x86/camellia - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Co-developed-by: Thomas Garnier Signed-off-by: Thomas Garnier Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 52fc482a12af96a28a1200c9587d599055bff8b6 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:25 2023 +0200 crypto: x86/aria - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit c75962f1c439de1590b038cb18466a859d59f209 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:24 2023 +0200 crypto: x86/aesni - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. In the GCM case, we can get rid of the oversized permutation array entirely while at it. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 9d5aef1222337f593e52293bb94c5cf7139d4d83 Author: Ard Biesheuvel Date: Wed Apr 12 13:00:23 2023 +0200 crypto: x86/aegis128 - Use RIP-relative addressing Prefer RIP-relative addressing where possible, which removes the need for boot time relocation fixups. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 7fec65155494fb9817adbd584f813a3faec33797 Author: Anjelique Melendez Date: Fri Apr 7 15:38:49 2023 -0700 leds: rgb: leds-qcom-lpg: Add support for PMK8550 PWM Add support for pmk8550 compatible and lpg_data. Signed-off-by: Anjelique Melendez Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230407223849.17623-4-quic_amelende@quicinc.com commit b00d2ed37617b5f2f091c98acf542fbedefcbf9b Author: Anjelique Melendez Date: Fri Apr 7 15:38:48 2023 -0700 leds: rgb: leds-qcom-lpg: Add support for high resolution PWM Certain PMICs like PMK8550 have a high resolution PWM module which can support from 8-bit to 15-bit PWM. Add support for it. Signed-off-by: Anjelique Melendez Acked-by: Pavel Machek Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230407223849.17623-3-quic_amelende@quicinc.com commit 03a85ab3ac910bc29e23db744091c40c8ed3d3af Author: Anjelique Melendez Date: Fri Apr 7 15:38:47 2023 -0700 dt-bindings: leds-qcom-lpg: Add qcom,pmk8550-pwm compatible string Add qcom,pmk8550-pwm compatible string for the Qualcomm Technologies, Inc. PMK8550 PMIC which has two high resolution PWM channels. Signed-off-by: Anjelique Melendez Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230407223849.17623-2-quic_amelende@quicinc.com commit eb74bfcfa99415f1a65ce021b8ac2256b7ed50bc Author: Yingsha Xu Date: Wed Apr 19 18:45:47 2023 +0800 wifi: mac80211: remove return value check of debugfs_create_dir() Smatch complains that: debugfs_hw_add() warn: 'statsd' is an error pointer or valid Debugfs checks are generally not supposed to be checked for errors and it is not necessary here. Just delete the dead code. Signed-off-by: Yingsha Xu Reviewed-by: Dongliang Mu Link: https://lore.kernel.org/r/20230419104548.30124-1-ysxu@hust.edu.cn Signed-off-by: Johannes Berg commit 22b68fc6d693e7a2b1c0eb852463f4a72522fa08 Author: Avraham Stern Date: Tue Apr 18 12:28:14 2023 +0300 wifi: iwlwifi: mvm: fix RFKILL report when driver is going down When CSME takes ownership, the driver sets RFKILL on, and this triggers driver unload and sending the confirmation SAP message. However, when IWL_MVM_MEI_REPORT_RFKILL is set, RFKILL was not reported and as a result, the driver did not confirm the ownership transition. Fix it. Signed-off-by: Avraham Stern Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.29ac3cd3df73.I96b32bc274bfe1e3871e54d3fa29c7ac4f40446f@changeid Signed-off-by: Johannes Berg commit 06ce23ad57c8e378b86ef3f439b2e08bcb5d05eb Author: Avraham Stern Date: Tue Apr 18 12:28:13 2023 +0300 wifi: iwlwifi: mei: re-ask for ownership after it was taken by CSME When the host disconnects from the AP CSME takes ownership right away. Since the driver never asks for ownership again wifi is left in rfkill until CSME releases the NIC, although in many cases the host could re-connect shortly after the disconnection. To allow the host to recover from occasional disconnection, re-ask for ownership to let the host connect again. Allow one minute before re-asking for ownership to avoid too frequent ownership transitions. Signed-off-by: Avraham Stern Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.a6c6ebc48f2d.I8a17003b86e71b3567521cc69864b9cbe9553ea9@changeid Signed-off-by: Johannes Berg commit 85c78af4e65053defeca958503fcfb0ebc1939e6 Author: Avraham Stern Date: Tue Apr 18 12:28:12 2023 +0300 wifi: iwlwifi: mei: make mei filtered scan more aggressive When mei filtered scan is performed, it must find the AP on the first scan, otherwise CSME will take the ownership of the NIC. Make this scan more aggressive by scanning the channel the AP is supposed to be on (as reported by CSME) several times. Signed-off-by: Avraham Stern Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.47e383b10b18.I14340a118acdb19ecb7214e7ff413054c77bd99c@changeid Signed-off-by: Johannes Berg commit 0d2558838ee815540eb89feb9a468cb88b189661 Author: Avraham Stern Date: Tue Apr 18 12:28:11 2023 +0300 wifi: iwlwifi: modify scan request and results when in link protection When CSME is connected and has link protection set, the driver must connect to the same AP CSME is connected to. When in link protection, modify scan request parameters to include only the channel of the AP CSME is connected to and scan for the same SSID. In addition, filter the scan results to include only results from the same AP. This will make sure the driver will connect to the same AP and will do it fast enough to keep the session alive. Signed-off-by: Avraham Stern Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.c1b55de3d704.I3895eebe18b3b672607695c887d728e113fc85ec@changeid Signed-off-by: Johannes Berg commit 0120e6b3e33dac3d0812ed93677d872e00dd4564 Author: Gregory Greenman Date: Tue Apr 18 12:28:10 2023 +0300 wifi: iwlwifi: mvm: enable support for MLO APIs Enable driver's support for MLO APIs to unlock this functionality. Signed-off-by: Gregory Greenman Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20230418122405.0ae0dd6f0481.Iec993cf0f28eacb2483fb9d1e755b0b2fd62e163@changeid Signed-off-by: Johannes Berg commit 3e75668be54eff49c86d498623e3cf3d3a23169a Author: Johannes Berg Date: Tue Apr 18 12:28:09 2023 +0300 wifi: iwlwifi: mvm: prefer RCU_INIT_POINTER() For constant values we don't need rcu_assign_pointer(), use RCU_INIT_POINTER() instead. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.7b400d21a27f.Iccdef9d777677390a9881c88b06c0ed13a83d978@changeid Signed-off-by: Johannes Berg commit 457d7fb03e6c3d73fbb509bd85fc4b02d1ab405e Author: Johannes Berg Date: Tue Apr 18 12:28:08 2023 +0300 wifi: iwlwifi: mvm: fix potential memory leak If we do get multiple notifications from firmware, then we might have allocated 'notif', but don't free it. Fix that by checking for duplicates before allocation. Fixes: 4da46a06d443 ("wifi: iwlwifi: mvm: Add support for wowlan info notification") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.116758321cc4.I8bdbcbb38c89ac637eaa20dda58fa9165b25893a@changeid Signed-off-by: Johannes Berg commit f4d4ba4613dc92a58a8c051f7b6bcb0276b1fecc Author: Alon Giladi Date: Tue Apr 18 12:28:07 2023 +0300 wifi: iwlwifi: fw: fix argument to efi.get_variable We should pass the newly allocated data to fill. Signed-off-by: Alon Giladi Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.aaa6d8874442.I734841c71aad9564cb22c50f2737aaff489fadaf@changeid Signed-off-by: Johannes Berg commit 7b41a99ce2d494d01e8fcb25e7113f143a0f2155 Author: Johannes Berg Date: Tue Apr 18 12:28:06 2023 +0300 wifi: iwlwifi: mvm: fix MIC removal confusion The RADA/firmware collaborate on MIC stripping in the following way: - the firmware fills the IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK value for how many words need to be removed at the end of the frame, CRC and, if decryption was done, MIC - if the RADA is active, it will - remove that much from the end of the frame - zero the value in IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK As a consequence, the only thing the driver should need to do is to - unconditionally tell mac80211 that the MIC was removed if decryption was already done - remove as much as IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK says at the end of the frame, since either RADA did it and then the value is 0, or RADA was disabled and then the value is whatever should be removed to strip both CRC & MIC However, all this code was historically grown and getting a bit confused. Originally, we were indicating that the MIC was not stripped, which is the version of the code upstreamed in commit 780e87c29e77 ("iwlwifi: mvm: add 9000 series RX processing") which indicated RX_FLAG_DECRYPTED in iwl_mvm_rx_crypto(). We later had a commit to change that to also indicate that the MIC was stripped, adding RX_FLAG_MIC_STRIPPED. However, this was then "fixed" later to only do that conditionally on RADA being enabled, since otherwise RADA didn't strip the MIC bytes yet. At the time, we were also always including the FCS if the RADA was not enabled, so that was still broken wrt. the FCS if the RADA isn't enabled - but that's a pretty rare case. Notably though, it does happen for management frames, where we do need to remove the MIC and CRC but the RADA is disabled. Later, in commit 40a0b38d7a7f ("iwlwifi: mvm: Fix calculation of frame length"), we changed this again, upstream this was just a single commit, but internally it was split into first the correct commit and then an additional fix that reduced the number of bytes that are removed by crypt_len. Note that this is clearly wrong since crypt_len indicates the length of the PN header (always 8), not the length of the MIC (8 or 16 depending on algorithm). However, this additional fix mostly canceled the other bugs, apart from the confusion about the size of the MIC. To fix this correctly, remove all those additional workarounds. We really should always indicate to mac80211 the MIC was stripped (it cannot use it anyway if decryption was already done), and also always actually remove it and the CRC regardless of the RADA being enabled or not. That's simple though, the value indicated in the metadata is zeroed by the RADA if it's enabled and used the value, so there's no need to check if it's enabled or not. Notably then, this fixes the MIC size confusion, letting us receive GCMP-256 encrypted management frames correctly that would otherwise be reported to mac80211 8 bytes too short since the RADA is turned off for them, crypt_len is 8, but the MIC size is 16, so when we do the adjustment based on IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK (which indicates 20 bytes to remove) we remove 12 bytes but indicate then to mac80211 the MIC is still present, so mac80211 again removes the MIC of 16 bytes, for an overall removal of 28 rather than 20 bytes. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.81345b6ab0cd.Ibe0348defb6cce11c99929a1f049e60b5cfc150c@changeid Signed-off-by: Johannes Berg commit 3d90d2f4a018fe8cfd65068bc6350b6222be4852 Author: Johannes Berg Date: Tue Apr 18 12:28:05 2023 +0300 wifi: iwlwifi: fw: fix memory leak in debugfs Fix a memory leak that occurs when reading the fw_info file all the way, since we return NULL indicating no more data, but don't free the status tracking object. Fixes: 36dfe9ac6e8b ("iwlwifi: dump api version in yaml format") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.239e501b3b8d.I4268f87809ef91209cbcd748eee0863195e70fa2@changeid Signed-off-by: Johannes Berg commit c5050696588660226fe6cc90a360b62d52a87e32 Author: Mukesh Sisodiya Date: Tue Apr 18 12:28:04 2023 +0300 wifi: iwlwifi: Update support for b0 version Add support for B0 version of MAC of MR device Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230418122405.5dca1ea7a0cf.I87932e1e216a1940eeae8824071ecb777f4c034f@changeid Signed-off-by: Johannes Berg commit e1d6ca042e62c2a69513235f8629eb6e62ca79c5 Author: Dan Carpenter Date: Wed Apr 19 17:27:03 2023 +0300 firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe The svc_create_memory_pool() function returns error pointers. It never returns NULL. Fix the check. Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/5f9a8cb4-5a4f-460b-9cdc-2fae6c5b7922@kili.mountain Signed-off-by: Greg Kroah-Hartman commit b7b4ce84c830ae3ce6429fbbd70a62a4ae1ac78d Author: Simon Horman Date: Tue Apr 18 13:54:00 2023 +0200 arm64: kexec: include reboot.h Include reboot.h in machine_kexec.c for declaration of machine_crash_shutdown. gcc-12 with W=1 reports: arch/arm64/kernel/machine_kexec.c:257:6: warning: no previous prototype for 'machine_crash_shutdown' [-Wmissing-prototypes] 257 | void machine_crash_shutdown(struct pt_regs *regs) No functional changes intended. Compile tested only. Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20230418-arm64-kexec-include-reboot-v1-1-8453fd4fb3fb@kernel.org Signed-off-by: Will Deacon commit 460e70e2dc9af3128f69e533daf349635c421b0a Author: Dan Carpenter Date: Wed Apr 19 10:58:43 2023 +0300 arm64: delete dead code in this_cpu_set_vectors() The "slot" variable is an enum, and in this context it is an unsigned int. So the type means it can never be negative and also we never pass invalid data to this function. If something did pass invalid data then this check would be insufficient protection. Signed-off-by: Dan Carpenter Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/73859c9e-dea0-4764-bf01-7ae694fa2e37@kili.mountain Signed-off-by: Will Deacon commit 76e31045ba030e94e72105c01b2e98f543d175ac Author: Alan Stern Date: Mon Apr 10 15:40:05 2023 -0400 media: radio-shark: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the radio-shark2 driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:387 shark_write_reg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88 ... The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of these endpoints (and similarly for the radio-shark driver). Link: https://syzkaller.appspot.com/bug?extid=4b3f8190f6e13b3efd74 Reported-and-tested-by: syzbot+4b3f8190f6e13b3efd74@syzkaller.appspotmail.com Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/e2858ab4-4adf-46e5-bbf6-c56742034547@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit df05a9b05e466a46725564528b277d0c570d0104 Author: Alan Stern Date: Mon Apr 10 15:38:22 2023 -0400 USB: sisusbvga: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.2.0-rc5-syzkaller-00199-g5af6ce704936 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 6c 50 80 fb 48 8b 7c 24 18 e8 62 1a 01 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 60 b1 fa 8a e8 84 b0 be 03 <0f> 0b e9 58 f8 ff ff e8 3e 50 80 fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90000a1ed18 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888012783a80 RSI: ffffffff816680ec RDI: fffff52000143d95 RBP: ffff888079020000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888017d33370 R14: 0000000000000003 R15: ffff888021213600 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005592753a60b0 CR3: 0000000022899000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sisusb_bulkout_msg drivers/usb/misc/sisusbvga/sisusbvga.c:224 [inline] sisusb_send_bulk_msg.constprop.0+0x904/0x1230 drivers/usb/misc/sisusbvga/sisusbvga.c:379 sisusb_send_bridge_packet drivers/usb/misc/sisusbvga/sisusbvga.c:567 [inline] sisusb_do_init_gfxdevice drivers/usb/misc/sisusbvga/sisusbvga.c:2077 [inline] sisusb_init_gfxdevice+0x87b/0x4000 drivers/usb/misc/sisusbvga/sisusbvga.c:2177 sisusb_probe+0x9cd/0xbe2 drivers/usb/misc/sisusbvga/sisusbvga.c:2869 ... The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of the endpoints. Link: https://syzkaller.appspot.com/bug?extid=23be03b56c5259385d79 Reported-and-tested-by: syzbot+23be03b56c5259385d79@syzkaller.appspotmail.com Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/48ef98f7-51ae-4f63-b8d3-0ef2004bb60a@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 13890626501ffda22b18213ddaf7930473da5792 Author: Alan Stern Date: Mon Apr 10 15:37:07 2023 -0400 USB: core: Add routines for endpoint checks in old drivers Many of the older USB drivers in the Linux USB stack were written based simply on a vendor's device specification. They use the endpoint information in the spec and assume these endpoints will always be present, with the properties listed, in any device matching the given vendor and product IDs. While that may have been true back then, with spoofing and fuzzing it is not true any more. More and more we are finding that those old drivers need to perform at least a minimum of checking before they try to use any endpoint other than ep0. To make this checking as simple as possible, we now add a couple of utility routines to the USB core. usb_check_bulk_endpoints() and usb_check_int_endpoints() take an interface pointer together with a list of endpoint addresses (numbers and directions). They check that the interface's current alternate setting includes endpoints with those addresses and that each of these endpoints has the right type: bulk or interrupt, respectively. Although we already have usb_find_common_endpoints() and related routines meant for a similar purpose, they are not well suited for this kind of checking. Those routines find endpoints of various kinds, but only one (either the first or the last) of each kind, and they don't verify that the endpoints' addresses agree with what the caller expects. In theory the new routines could be more general: They could take a particular altsetting as their argument instead of always using the interface's current altsetting. In practice I think this won't matter too much; multiple altsettings tend to be used for transferring media (audio or visual) over isochronous endpoints, not bulk or interrupt. Drivers for such devices will generally require more sophisticated checking than these simplistic routines provide. Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/dd2c8e8c-2c87-44ea-ba17-c64b97e201c9@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit bedee105bf4a072294af068d89ec2d2bb5f457ae Author: Arnd Bergmann Date: Fri Apr 14 10:03:07 2023 +0200 firmware_loader: rework crypto dependencies The crypto dependencies for the firmwware loader are incomplete, in particular a built-in FW_LOADER fails to link against a modular crypto hash driver: ld.lld: error: undefined symbol: crypto_alloc_shash ld.lld: error: undefined symbol: crypto_shash_digest ld.lld: error: undefined symbol: crypto_destroy_tfm >>> referenced by main.c >>> drivers/base/firmware_loader/main.o:(fw_log_firmware_info) in archive vmlinux.a Rework this to use the usual 'select' from the driver module, to respect the built-in vs module dependencies, and add a more verbose crypto dependency to the debug option to prevent configurations that lead to a link failure. Fixes: 02fe26f25325 ("firmware_loader: Add debug message with checksum for FW file") Reviewed-by: Amadeusz Sławiński Acked-by: Herbert Xu Acked-by: Luis Chamberlain Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230414080329.76176-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 495ff36388e8b71eb49e9242c8e04e06c5609e74 Author: Florian Fainelli Date: Thu Apr 13 12:17:57 2023 -0700 firmware_loader: Strip off \n from customized path Having helped an user recently figure out why the customized path being specified was not taken into account landed on a subtle difference between using: echo "/xyz/firmware" > /sys/module/firmware_class/parameters/path which inserts an additional newline which is passed as is down to fw_get_filesystem_firmware() and ultimately kernel_read_file_from_path() and fails. Strip off \n from the customized firmware path such that users do not run into these hard to debug situations. Link: https://lore.kernel.org/all/20230402135423.3235-1-f.fainelli@gmail.com/ Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20230413191757.1949088-1-f.fainelli@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2a405f6bb3a5b2baaa74dfc5aaa0e1b99145bd1b Author: Heiko Carstens Date: Wed Apr 5 15:08:41 2023 +0200 s390/stackleak: provide fast __stackleak_poison() implementation Provide an s390 specific __stackleak_poison() implementation which is faster than the generic variant. For the original implementation with an enforced 4kb stackframe for the getpid() system call the system call overhead increases by a factor of 3 if the stackleak feature is enabled. Using the s390 mvc based variant this is reduced to an increase of 25% instead. This is within the expected area, since the mvc based implementation is more or less a memset64() variant which comes with similar results. See commit 0b77d6701cf8 ("s390: implement memset16, memset32 & memset64"). Reviewed-by: Vasily Gorbik Signed-off-by: Heiko Carstens Link: https://lore.kernel.org/r/20230405130841.1350565-3-hca@linux.ibm.com Signed-off-by: Vasily Gorbik commit 491a78663e039fabc58c892ca8f2c2e08caaf4f8 Author: Heiko Carstens Date: Wed Apr 5 15:08:40 2023 +0200 stackleak: allow to specify arch specific stackleak poison function Factor out the code that fills the stack with the stackleak poison value in order to allow architectures to provide a faster implementation. Acked-by: Vasily Gorbik Signed-off-by: Heiko Carstens Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20230405130841.1350565-2-hca@linux.ibm.com Signed-off-by: Vasily Gorbik commit ccf7c3fb61ed7f3019b5be9fe70ccc0ab782cf2e Author: Heiko Carstens Date: Wed Apr 19 15:17:02 2023 +0200 s390: select ARCH_USE_SYM_ANNOTATIONS All old style assembly annotations have been converted for s390. Select ARCH_USE_SYM_ANNOTATIONS to make sure the old macros like ENTRY() aren't available anymore. This prevents that new code which uses the old macros will be added again. This follows what has been done for x86 with commit 2ce0d7f9766f ("x86/asm: Provide a Kconfig symbol for disabling old assembly annotations") and for arm64 with commit 50479d58eaa3 ("arm64: Disable old style assembly annotations"). Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 34e4c79f3ba9e3d7de56be8ef1a514950915e0ee Author: Heiko Carstens Date: Fri Apr 14 14:30:46 2023 +0200 s390/mm: use VM_FLUSH_RESET_PERMS in module_alloc() Make use of the set_direct_map() calls for module allocations. In particular: - All changes to read-only permissions in kernel VA mappings are also applied to the direct mapping. Note that execute permissions are intentionally not applied to the direct mapping in order to make sure that all allocated pages within the direct mapping stay non-executable - module_alloc() passes the VM_FLUSH_RESET_PERMS to __vmalloc_node_range() to make sure that all implicit permission changes made to the direct mapping are reset when the allocated vm area is freed again Side effects: the direct mapping will be fragmented depending on how many vm areas with VM_FLUSH_RESET_PERMS and/or explicit page permission changes are allocated and freed again. For example, just after boot of a system the direct mapping statistics look like: $cat /proc/meminfo ... DirectMap4k: 111628 kB DirectMap1M: 16665600 kB DirectMap2G: 0 kB Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7608f70adcb1ea6957d7b9e1d5bd53584178fbbc Author: Heiko Carstens Date: Fri Apr 14 14:30:45 2023 +0200 s390: wire up memfd_secret system call s390 supports ARCH_HAS_SET_DIRECT_MAP, therefore wire up the memfd_secret system call, which depends on it. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 0490d6d7ba0a479fdd805da54ae25220ce5b514d Author: Heiko Carstens Date: Fri Apr 14 14:30:44 2023 +0200 s390/mm: enable ARCH_HAS_SET_DIRECT_MAP Implement the set_direct_map_*() API, which allows to invalidate and set default permissions to pages within the direct mapping. Note that kernel_page_present(), which is also supposed to be part of this API, is intentionally not implemented. The reason for this is that kernel_page_present() is only used (and currently only makes sense) for suspend/resume, which isn't supported on s390. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 17c51b1ba9c2d4b497349ac1622aafe67be16103 Author: Heiko Carstens Date: Fri Apr 14 14:30:43 2023 +0200 s390/mm: use BIT macro to generate SET_MEMORY bit masks Use BIT macro to generate SET_MEMORY bit masks, which is easier to maintain if bits get added, or removed. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 02435a739b81ae24aff5d6e930efef9458e2af3c Author: Wesley Cheng Date: Thu Apr 13 12:57:40 2023 -0700 usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive It was observed that there are hosts that may complete pending SETUP transactions before the stop active transfers and controller halt occurs, leading to lingering endxfer commands on DEPs on subsequent pullup/gadget start iterations. dwc3_gadget_ep_disable name=ep8in flags=0x3009 direction=1 dwc3_gadget_ep_disable name=ep4in flags=1 direction=1 dwc3_gadget_ep_disable name=ep3out flags=1 direction=0 usb_gadget_disconnect deactivated=0 connected=0 ret=0 The sequence shows that the USB gadget disconnect (dwc3_gadget_pullup(0)) routine completed successfully, allowing for the USB gadget to proceed with a USB gadget connect. However, if this occurs the system runs into an issue where: BUG: spinlock already unlocked on CPU spin_bug+0x0 dwc3_remove_requests+0x278 dwc3_ep0_out_start+0xb0 __dwc3_gadget_start+0x25c This is due to the pending endxfers, leading to gadget start (w/o lock held) to execute the remove requests, which will unlock the dwc3 spinlock as part of giveback. To mitigate this, resolve the pending endxfers on the pullup disable path by re-locating the SETUP phase check after stop active transfers, since that is where the DWC3_EP_DELAY_STOP is potentially set. This also allows for handling of a host that may be unresponsive by using the completion timeout to trigger the stall and restart for EP0. Fixes: c96683798e27 ("usb: dwc3: ep0: Don't prepare beyond Setup stage") Cc: stable@vger.kernel.org Acked-by: Thinh Nguyen Signed-off-by: Wesley Cheng Link: https://lore.kernel.org/r/20230413195742.11821-2-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 4a2f152af1c478d42bd4f535788d4dbec015704f Author: Stanley Chang Date: Wed Apr 19 10:00:43 2023 +0800 dt-bindings: usb: snps,dwc3: Add 'snps,parkmode-disable-hs-quirk' quirk Add a new 'snps,parkmode-disable-hs-quirk' DT quirk to dwc3 core for disable the high-speed parkmode. For some USB wifi devices, if enable this feature it will reduce the performance. Therefore, add an option for disabling HS park mode by device-tree. In Synopsys's dwc3 data book: In a few high speed devices when an IN request is sent within 900ns of the ACK of the previous packet, these devices send a NAK. When connected to these devices, if required, the software can disable the park mode if you see performance drop in your system. When park mode is disabled, pipelining of multiple packet is disabled and instead one packet at a time is requested by the scheduler. This allows up to 12 NAKs in a micro-frame and improves performance of these slow devices. Acked-by: Rob Herring Signed-off-by: Stanley Chang Link: https://lore.kernel.org/r/20230419020044.15475-2-stanley_chang@realtek.com Signed-off-by: Greg Kroah-Hartman commit d21a797a3eeb2b001e07ff943e5611eab67a71a3 Author: Stanley Chang Date: Wed Apr 19 10:00:42 2023 +0800 usb: dwc3: core: add support for disabling High-speed park mode Setting the PARKMODE_DISABLE_HS bit in the DWC3_USB3_GUCTL1. When this bit is set to '1' all HS bus instances in park mode are disabled For some USB wifi devices, if enable this feature it will reduce the performance. Therefore, add an option for disabling HS park mode by device-tree. In Synopsys's dwc3 data book: In a few high speed devices when an IN request is sent within 900ns of the ACK of the previous packet, these devices send a NAK. When connected to these devices, if required, the software can disable the park mode if you see performance drop in your system. When park mode is disabled, pipelining of multiple packet is disabled and instead one packet at a time is requested by the scheduler. This allows up to 12 NAKs in a micro-frame and improves performance of these slow devices. Acked-by: Thinh Nguyen Signed-off-by: Stanley Chang Link: https://lore.kernel.org/r/20230419020044.15475-1-stanley_chang@realtek.com Signed-off-by: Greg Kroah-Hartman commit a804a47658ced9e9cc6b6000846ddf208362f1b3 Author: Krzysztof Kozlowski Date: Thu Apr 20 08:50:51 2023 +0200 dt-bindings: usb: ci-hdrc-usb2: allow multiple PHYs Qualcomm MSM8974 comes with USB HS phy in two variants, although final DTS chooses only one. Allow such combination in the ChipIdea USB2 bindings and also disallow any other properties in the ulpi node. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230420065051.22994-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 41792870dc1cb8305ca04d563cabd63833e94762 Author: Chunfeng Yun Date: Mon Apr 17 10:52:03 2023 +0800 usb: mtu3: add optional clock xhci_ck and frmcnt_ck Add optional clock 'xhci_ck' which is usually the same as sys_ck, but some SoC use two separated clocks when the controller supports dual role mode; Add optional clock 'frmcnt_ck' used on 4nm or advanced process SoC. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230417025203.18097-7-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit d10cb206acb45b9a0aa83318f0101bb56c33b7de Author: Chunfeng Yun Date: Mon Apr 17 10:52:02 2023 +0800 dt-bindings: usb: mtu3: add two optional clocks Add optional clock 'xhci_ck' and 'frmcnt_ck'; Reviewed-by: Rob Herring Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230417025203.18097-6-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 976a5c256e34085207c0abf0941b5c967d8d1c18 Author: Chunfeng Yun Date: Mon Apr 17 10:52:01 2023 +0800 usb: mtu3: expose role-switch control to userspace The allow_userspace_control flag enables manual role switch from userspace, turn this feature on like several other USB DRD controller drivers. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230417025203.18097-5-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit ed50be81d536cdb25d00befe6ca21cd02f1c509d Author: Chunfeng Yun Date: Mon Apr 17 10:52:00 2023 +0800 usb: mtu3: unlock @mtu->lock just before giving back request No need unlock @mtu->lock when unmap request, unlock it just before giving back request, due to we do not lock this spinlock when map the request. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230417025203.18097-4-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 Author: Chunfeng Yun Date: Mon Apr 17 10:51:59 2023 +0800 usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it. e.g. qmu done irq on cpu0 thread running on cpu1 qmu_done_tx() handle gpd [0] mtu3_requ_complete() mtu3_gadget_ep_disable() unlock @mtu->lock give back request lock @mtu->lock mtu3_ep_disable() mtu3_gpd_ring_free() unlock @mtu->lock lock @mtu->lock get next gpd [1] [1]: goto [0] to handle next gpd, and next gpd may be NULL. Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format") Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230417025203.18097-3-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 3481769cd05b2ff3fa00d0aab526eb64de994fad Author: Chunfeng Yun Date: Mon Apr 17 10:51:58 2023 +0800 usb: mtu3: use boolean return value Prefer to use boolean value due to gpd_ring_empty() return true or false. See "16) Function return values and names" in coding-style.rst Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230417025203.18097-2-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit c507565aac2e8c4ca8dd36afcd40e15e4b459d93 Author: Chunfeng Yun Date: Mon Apr 17 10:51:57 2023 +0800 usb: mtu3: give back request when rx error happens When the Rx enconnter errors, currently, only print error logs, that may cause class driver's RX halt, shall give back the request with error status meanwhile. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230417025203.18097-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d Author: Yinhao Hu Date: Wed Apr 12 13:58:52 2023 +0800 usb: chipidea: fix missing goto in `ci_hdrc_probe` From the comment of ci_usb_phy_init, it returns an error code if usb_phy_init has failed, and it should do some clean up, not just return directly. Fix this by goto the error handling. Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core") Reviewed-by: Dongliang Mu Acked-by: Peter Chen Signed-off-by: Yinhao Hu Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn Signed-off-by: Greg Kroah-Hartman commit a3afbf5cc887fc3401f012fe629810998ed61859 Author: Badhri Jagan Sridharan Date: Fri Apr 7 03:07:41 2023 +0000 usb: gadget: udc: core: Prevent redundant calls to pullup usb_gadget_connect calls gadget->ops->pullup without checking whether gadget->connected was previously set. Make this symmetric to usb_gadget_disconnect by returning early if gadget->connected is already set. Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected") Cc: stable@vger.kernel.org Signed-off-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20230407030741.3163220-2-badhri@google.com Signed-off-by: Greg Kroah-Hartman commit 0db213ea8eed5534a5169e807f28103cbc9d23df Author: Badhri Jagan Sridharan Date: Fri Apr 7 03:07:40 2023 +0000 usb: gadget: udc: core: Invoke usb_gadget_connect only when started usb_udc_connect_control does not check to see if the udc has already been started. This causes gadget->ops->pullup to be called through usb_gadget_connect when invoked from usb_udc_vbus_handler even before usb_gadget_udc_start is called. Guard this by checking for udc->started in usb_udc_connect_control before invoking usb_gadget_connect. Guarding udc->vbus, udc->started, gadget->connect, gadget->deactivate related functions with connect_lock. usb_gadget_connect_locked, usb_gadget_disconnect_locked, usb_udc_connect_control_locked, usb_gadget_udc_start_locked, usb_gadget_udc_stop_locked are called with this lock held as they can be simulataneously invoked from different code paths. Adding an additional check to make sure udc is started(udc->started) before pullup callback is invoked. Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler") Cc: stable@vger.kernel.org Signed-off-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20230407030741.3163220-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman commit 511b74e7c0b8ecd78b8175f5ee84dc0b6e014c19 Author: Fabrice Gasnier Date: Wed Apr 12 18:17:34 2023 +0200 usb: typec: ucsi: don't print PPM init deferred errors ucsi_init() may be deferred as usb_role_sw may be deferred in ucsi_register_port(). This results in several PPM init failed (-517) messages maybe printed several times upon boot, like on stm32mp135f-dk board, until the role_switch driver gets probed. [ 19.880945] dwc2 49000000.usb: supply vusb_d not found, using dummy regulator [ 19.887136] dwc2 49000000.usb: supply vusb_a not found, using dummy regulator [ 19.975432] ucsi-stm32g0-i2c 0-0053: PPM init failed (-517) [ 20.155746] dwc2 49000000.usb: EPs: 9, dedicated fifos, 952 entries in SPRAM [ 20.175429] ucsi-stm32g0-i2c 0-0053: PPM init failed (-517) [ 20.184242] dwc2 49000000.usb: DWC OTG Controller Adopt dev_err_probe() instead of dev_err(), to only print other errors. Also print an error in case the wait count has expired. Reviewed-by: Heikki Krogerus Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20230412161734.3425090-1-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit dac3b192107b978198e89ec0f77375738352e0c8 Author: Frank Wang Date: Thu Mar 16 16:11:49 2023 +0800 usb: typec: tcpm: fix multiple times discover svids error PD3.0 Spec 6.4.4.3.2 say that only Responder supports 12 or more SVIDs, the Discover SVIDs Command Shall be executed multiple times until a Discover SVIDs VDO is returned ending either with a SVID value of 0x0000 in the last part of the last VDO or with a VDO containing two SVIDs with values of 0x0000. In the current implementation, if the last VDO does not find that the Discover SVIDs Command would be executed multiple times even if the Responder SVIDs are less than 12, and we found some odd dockers just meet this case. So fix it. Acked-by: Heikki Krogerus Signed-off-by: Frank Wang Link: https://lore.kernel.org/r/20230316081149.24519-1-frank.wang@rock-chips.com Signed-off-by: Greg Kroah-Hartman commit 9a4d7dd1990383df8ffa09d6879cecb0534405e1 Author: Johan Hovold Date: Tue Apr 4 09:25:24 2023 +0200 USB: dwc3: clean up probe declarations Clean up the probe variable declarations by removing the stray newlines. Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-12-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit bd82857424d37897ad994381f7c580dacf2e2988 Author: Johan Hovold Date: Tue Apr 4 09:25:23 2023 +0200 USB: dwc3: refactor clock lookups The probe callback has become unwieldy so break out the clock lookups into a new helper function to improve readability. Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-11-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 1d72fab476567a0e4f51ee0a93882208ba28dc54 Author: Johan Hovold Date: Tue Apr 4 09:25:22 2023 +0200 USB: dwc3: refactor phy handling Refactor the PHY handling using four new helpers to initialise, deinitialise, power on and power off all the PHYs. Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-10-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit d2f197822d5807d48bf27e713e2fd569e7017610 Author: Johan Hovold Date: Tue Apr 4 09:25:21 2023 +0200 USB: dwc3: clean up core init error handling Clean up the core init error handling by using descriptive names for the error labels and releasing resourcing in reverse order consistently. Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-9-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit c8e9eccf6ed29f6c20fa489286eee1059566d035 Author: Johan Hovold Date: Tue Apr 4 09:25:20 2023 +0200 USB: dwc3: clean up phy init error handling While there likely are no platforms out there that mix generic and legacy PHYs the driver should still be able to handle that, if only for consistency reasons. Add the missing calls to shutdown any legacy PHYs if generic PHY initialisation fails. Note that we continue to happily ignore potential errors from the legacy PHY callbacks... Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-8-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit fe296046c7219c3b156cddc90a0efaa52a5eb996 Author: Johan Hovold Date: Tue Apr 4 09:25:19 2023 +0200 USB: dwc3: clean up probe error labels Use descriptive names consistently for the probe error labels. Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-7-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit f56d0d29b018b6c19b4d5c60e768b5f90bb20c8d Author: Johan Hovold Date: Tue Apr 4 09:25:18 2023 +0200 USB: dwc3: drop dead hibernation code The hibernation code is broken and has never been enabled in mainline and should thus be dropped. Specifically, the scratch buffer DMA mapping would have been leaked on every suspend cycle since commit 51f5d49ad6f0 ("usb: dwc3: core: simplify suspend/resume operations") if this feature was ever enabled. The related error handling was also broken and could have resulted in attempts to unmap never mapped buffers, etc. This effectively revert commit 0ffcaf3798bf ("usb: dwc3: core: allocate scratch buffers"). Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-6-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit bdb19d01026a5cccfa437be8adcf2df472c5889e Author: Johan Hovold Date: Tue Apr 4 09:25:17 2023 +0200 USB: dwc3: gadget: drop dead hibernation code The hibernation code is broken and has never been enabled in mainline and should thus be dropped. Remove the hibernation bits from the gadget code, which effectively reverts commits e1dadd3b0f27 ("usb: dwc3: workaround: bogus hibernation events") and 7b2a0368bbc9 ("usb: dwc3: gadget: set KEEP_CONNECT in case of hibernation") except for the spurious interrupt warning. Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-5-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6b3b2402ca5be6a19f92968a5654bc64d3996d16 Author: Johan Hovold Date: Tue Apr 4 09:25:16 2023 +0200 USB: dwc3: disable autosuspend on unbind Add the missing calls to disable autosuspend on probe errors and on driver unbind. Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 44d257e9012ee8040e41d224d0e5bfb5ef5427ea Author: Johan Hovold Date: Tue Apr 4 09:25:15 2023 +0200 USB: dwc3: fix runtime pm imbalance on unbind Make sure to balance the runtime PM usage count on driver unbind by adding back the pm_runtime_allow() call that had been erroneously removed. Fixes: 266d0493900a ("usb: dwc3: core: don't trigger runtime pm when remove driver") Cc: stable@vger.kernel.org # 5.9 Cc: Li Jun Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9a8ad10c9f2e0925ff26308ec6756b93fc2f4977 Author: Johan Hovold Date: Tue Apr 4 09:25:14 2023 +0200 USB: dwc3: fix runtime pm imbalance on probe errors Make sure not to suspend the device when probe fails to avoid disabling clocks and phys multiple times. Fixes: 328082376aea ("usb: dwc3: fix runtime PM in error path") Cc: stable@vger.kernel.org # 4.8 Cc: Roger Quadros Acked-by: Thinh Nguyen Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230404072524.19014-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 21d018b75f4f1c183be565d302fde7a01ae79fb0 Author: Fabrice Gasnier Date: Fri Apr 14 10:41:37 2023 +0200 ARM: dts: stm32: add USB OTG UTMI clock on stm32mp151 It's needed on STM32MP15, when using the integrated full-speed PHY. This clock is an output of USBPHYC, and the HS USBPHYC is not attached as PHY in this case (managed directly by dwc2 ggpio glue): &usbotg_hs { compatible = "st,stm32mp15-fsotg", "snps,dwc2"; pinctrl-names = "default"; pinctrl-0 = <&usbotg_hs_pins_a &usbotg_fs_dp_dm_pins_a>; vbus-supply = <&vbus_otg>; status = "okay"; }; USBPHYC clock output must be used, so it can be properly enabled as a clock provider. Without this, currently, when the dualport High-Speed USBPHYC isn't requested by either USBH or OTG, it remains uninitialized when probing OTG: OTG configured with full-speed PHY isn't properly clocked, resulting in error log like: [ 2.383138] dwc2 49000000.usb-otg: dwc2_core_reset: HANG! Soft Reset timeout GRSTCTL_CSFTRST. Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20230414084137.1050487-5-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 02329adeae1f92b0133cfc1a2b06645f4c496c1b Author: Fabrice Gasnier Date: Fri Apr 14 10:41:36 2023 +0200 usb: dwc2: platform: add support for utmi optional clock Add support for the utmi clock. It's needed on STM32MP15, when using the integrated full-speed PHY. This clock is an output of USBPHYC, but HS USBPHYC is not attached as PHY in this case: Full-Speed PHY is directly managed in dwc2 glue, through GGPIO register. Typical DT when using FS PHY &usbotg_hs { compatible = "st,stm32mp15-fsotg", "snps,dwc2"; pinctrl-names = "default"; pinctrl-0 = <&usbotg_hs_pins_a &usbotg_fs_dp_dm_pins_a>; vbus-supply = <&vbus_otg>; status = "okay"; }; In this configuration, USBPHYC clock output must be defined, so it can be properly enabled as a clock provider: clocks = <&rcc USBO_K>, <&usbphyc>; clock-names = "otg", "utmi"; Acked-by: Minas Harutyunyan Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20230414084137.1050487-4-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 28f75a39d8a878d9e8e57fd2aa0a1ad262d257bd Author: Fabrice Gasnier Date: Fri Apr 14 10:41:35 2023 +0200 dt-bindings: usb: dwc2: add utmi optional clock utmi clock is typically provided by PHY output. Add this optional clock, as the core could use other clocks depending on the SoC where it's used. This is needed on stm32mp15, when using the integrated full-speed PHY. Acked-by: Krzysztof Kozlowski Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20230414084137.1050487-3-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 236d835302bd4e11697dfe65eb24a219ea5c70eb Author: Fabrice Gasnier Date: Fri Apr 14 10:41:34 2023 +0200 usb: dwc2: improve error handling in __dwc2_lowlevel_hw_enable Add error handling in __dwc2_lowlevel_hw_enable() that may leave the clocks and regulators enabled upon error. Acked-by: Minas Harutyunyan Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20230414084137.1050487-2-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 6a14ffc05c60fb4d5b7beb95460ac5642293e03f Author: Chunfeng Yun Date: Fri Apr 7 14:24:06 2023 +0800 usb: xhci-mtk: add optional frame count clock Add optional clock frmcnt_ck used on 4nm or advanced process SoC Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230407062406.12575-2-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 4076c4f37bd9ef8415a7ab6acb6e2b5d6fddaf05 Author: Chunfeng Yun Date: Fri Apr 7 14:24:05 2023 +0800 dt-bindings: usb: mtk-xhci: add an optional frame count clock Add optional clock 'frmcnt_ck' used on 4nm or advanced process SoC Reviewed-by: AngeloGioacchino Del Regno Acked-by: Krzysztof Kozlowski Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20230407062406.12575-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 9134c1fd05034dd29a1a2f010abd178af409171e Author: Stanley Chang Date: Fri Apr 7 14:07:31 2023 +0800 usb: xhci: plat: Add USB 3.0 phy support For Realtek SoC, the usb xhci uses different driver for u2phy and u3phy. Therefore, add a hook to retrieve the USB 3.0 PHY to XHCI plat. Signed-off-by: Stanley Chang Link: https://lore.kernel.org/r/20230407060731.20537-1-stanley_chang@realtek.com Signed-off-by: Greg Kroah-Hartman commit f3588ea40aa17273c3303789b1828b3aa6b80748 Author: Nobuhiro Iwamatsu Date: Thu Apr 6 08:46:05 2023 +0900 usb: host: xhci-plat: Use dev_is_pci() helper Use common dev_is_pci() helper for checking PCI devices. And if CONFIG_PCI is not defined, dev_is_pci returns false. Therefore, CONFIG_PCI is also unnecessary, so remove it. Signed-off-by: Nobuhiro Iwamatsu Link: https://lore.kernel.org/r/20230405234605.2310155-1-nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Greg Kroah-Hartman commit 735baf1b23458f71a8b15cb924af22c9ff9cd125 Author: Johan Hovold Date: Wed Apr 5 11:03:42 2023 +0200 xhci: fix debugfs register accesses while suspended Wire up the debugfs regset device pointer so that the controller is resumed before accessing registers to avoid crashing or locking up if it happens to be runtime suspended. Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver") Cc: stable@vger.kernel.org # 4.15: 30332eeefec8: debugfs: regset32: Add Runtime PM support Cc: stable@vger.kernel.org # 4.15 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230405090342.7363-1-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 091b813d3d1078afba6ed74fa8df2a5bbc9bf124 Author: Rob Herring Date: Mon Apr 10 18:26:38 2023 -0500 usb: Add explicit of.h of_platform.h include Several USB drivers use of_platform_* functions which are declared in of_platform.h. of_platform.h gets implicitly included by of_device.h, but that is going to be removed soon. Nothing else depends on of_device.h so it can be dropped. Acked-by: Thinh Nguyen Acked-by: Chunfeng Yun Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230410232639.1561152-1-robh@kernel.org Signed-off-by: Greg Kroah-Hartman commit a00e9e4319c2a8a8b166da028292de83190e39a4 Author: Christophe JAILLET Date: Tue Apr 18 23:47:38 2023 +0200 KVM: arm64: Use the bitmap API to allocate bitmaps Use bitmap_zalloc()/bitmap_free() instead of hand-writing them. It is less verbose and it improves the semantic. Signed-off-by: Christophe JAILLET Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/3c5043731db4d3635383e9326bc7e98e25de3288.1681854412.git.christophe.jaillet@wanadoo.fr commit 4be8ddb48b1b6c6067fb59c846b9c6e19d6efe14 Author: Christophe JAILLET Date: Tue Apr 18 23:47:37 2023 +0200 KVM: arm64: Slightly optimize flush_context() bitmap_zero() is faster than bitmap_clear(), so use it to save a few cycles. Signed-off-by: Christophe JAILLET Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/97bf2743f3a302b3066aced02218b9da60690dd3.1681854412.git.christophe.jaillet@wanadoo.fr commit a189884bdc9238aeba941c50f02e25eb584fafed Author: Reiji Watanabe Date: Tue Apr 18 19:18:52 2023 -0700 KVM: arm64: Have kvm_psci_vcpu_on() use WRITE_ONCE() to update mp_state All accessors of kvm_vcpu_arch::mp_state should be {READ,WRITE}_ONCE(), since readers of the mp_state don't acquire the mp_state_lock. Nonetheless, kvm_psci_vcpu_on() updates the mp_state without using WRITE_ONCE(). So, fix the code to update the mp_state using WRITE_ONCE. Signed-off-by: Reiji Watanabe Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230419021852.2981107-3-reijiw@google.com commit 4ff910be01c0ca28c2ea8b354dd47a3a17524489 Author: Reiji Watanabe Date: Tue Apr 18 19:18:51 2023 -0700 KVM: arm64: Acquire mp_state_lock in kvm_arch_vcpu_ioctl_vcpu_init() kvm_arch_vcpu_ioctl_vcpu_init() doesn't acquire mp_state_lock when setting the mp_state to KVM_MP_STATE_RUNNABLE. Fix the code to acquire the lock. Signed-off-by: Reiji Watanabe [maz: minor refactor] Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230419021852.2981107-2-reijiw@google.com commit 9d9a7614a75989a2356c8d2db736ce1a69d92fe4 Author: Jon Hunter Date: Wed Apr 5 19:18:54 2023 +0100 usb: gadget: tegra-xudc: Remove unneeded return variable The 'ret' variable in the function tegra_xudc_gadget_vbus_draw() is not needed and so remove this variable. Reviewed-by: Thierry Reding Signed-off-by: Jon Hunter Link: https://lore.kernel.org/r/20230405181854.42355-2-jonathanh@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 5629d31955297ca47b9283c64fff70f2f34aa528 Author: Jon Hunter Date: Wed Apr 5 19:18:53 2023 +0100 usb: gadget: tegra-xudc: Fix crash in vbus_draw Commit ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support") populated the vbus_draw callback for the Tegra XUDC driver. The function tegra_xudc_gadget_vbus_draw(), that was added by this commit, assumes that the pointer 'curr_usbphy' has been initialised, which is not always the case because this is only initialised when the USB role is updated. Fix this crash, by checking that the 'curr_usbphy' is valid before dereferencing. Fixes: ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support") Reviewed-by: Thierry Reding Signed-off-by: Jon Hunter Link: https://lore.kernel.org/r/20230405181854.42355-1-jonathanh@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 9e6ca3e6ff4a463454d35c8747aa08198628f4d7 Merge: ced7c981f382f a095edfc15f08 Author: Greg Kroah-Hartman Date: Thu Apr 20 08:59:38 2023 +0200 Merge tag 'usb-serial-6.4-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial updates for 6.4-rc1 Here are the USB-serial updates for 6.4-rc1; a new modem device id and an unused-function cleanup. All have been in linux-next with no reported issues. * tag 'usb-serial-6.4-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add UNISOC vendor and TOZED LT70C product USB: serial: quatech2: remove unused qt2_setdevice function commit 780c69830ec6b27e0224586ce26bc89552fcf163 Merge: 2ddade3229256 5ff54dedf35bf Author: Alexei Starovoitov Date: Wed Apr 19 21:29:39 2023 -0700 Merge branch 'Access variable length array relaxed for integer type' Feng zhou says: ==================== From: Feng Zhou Add support for integer type of accessing variable length array. Add a selftest to check it. ==================== Signed-off-by: Alexei Starovoitov commit 5ff54dedf35bfee7a16eb9f8fb7ecadf7d5564cb Author: Feng Zhou Date: Thu Apr 20 11:27:35 2023 +0800 selftests/bpf: Add test to access integer type of variable array Add prog test for accessing integer type of variable array in tracing program. In addition, hook load_balance function to access sd->span[0], only to confirm whether the load is successful. Because there is no direct way to trigger load_balance call. Co-developed-by: Chengming Zhou Signed-off-by: Chengming Zhou Signed-off-by: Feng Zhou Link: https://lore.kernel.org/r/20230420032735.27760-3-zhoufeng.zf@bytedance.com Signed-off-by: Alexei Starovoitov commit 2569c7b8726fc06d946a4f999fb1be15b68f3f3c Author: Feng Zhou Date: Thu Apr 20 11:27:34 2023 +0800 bpf: support access variable length array of integer type After this commit: bpf: Support variable length array in tracing programs (9c5f8a1008a1) Trace programs can access variable length array, but for structure type. This patch adds support for integer type. Example: Hook load_balance struct sched_domain { ... unsigned long span[]; } The access: sd->span[0]. Co-developed-by: Chengming Zhou Signed-off-by: Chengming Zhou Signed-off-by: Feng Zhou Link: https://lore.kernel.org/r/20230420032735.27760-2-zhoufeng.zf@bytedance.com Signed-off-by: Alexei Starovoitov commit 519fe1bae7e20fc4e7f179d50b6102b49980e85d Author: Josh Triplett Date: Sun Apr 2 11:37:42 2023 +0900 ext4: Add a uapi header for ext4 userspace APIs Create a uapi header include/uapi/linux/ext4.h, move the ioctls and associated data structures to the uapi header, and include it from fs/ext4/ext4.h. Signed-off-by: Josh Triplett Link: https://lore.kernel.org/r/680175260970d977d16b5cc7e7606483ec99eb63.1680402881.git.josh@joshtriplett.org Signed-off-by: Theodore Ts'o commit 17809d3cf801374d7c23101800770ea34951f3c8 Author: wuchi Date: Sat Apr 1 15:53:03 2023 +0800 ext4: remove useless conditional branch code It's ok because the code will be optimized by the compiler, just try to simple the code. Signed-off-by: wuchi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230401075303.45206-1-wuchi.zero@gmail.com Signed-off-by: Theodore Ts'o commit 8ae56b4e82ee29b5cc1fbea8b00a0a7e0758f3c2 Author: Tom Rix Date: Thu Mar 16 16:48:31 2023 -0400 ext4: remove unneeded check of nr_to_submit cppcheck reports fs/ext4/page-io.c:516:51: style: Condition 'nr_to_submit' is always true [knownConditionTrueFalse] if (fscrypt_inode_uses_fs_layer_crypto(inode) && nr_to_submit) { ^ This earlier check to bail, makes this check unncessary /* Nothing to submit? Just unlock the page... */ if (!nr_to_submit) return 0; Signed-off-by: Tom Rix Fixes: dff4ac75eeee ("ext4: move keep_towrite handling to ext4_bio_write_page()") Reviewed-by: Eric Biggers Link: https://lore.kernel.org/r/20230316204831.2472537-1-trix@redhat.com Signed-off-by: Theodore Ts'o commit 228c7a95534b438859d6cc068691164bd705a9c8 Author: Michael Ellerman Date: Wed Mar 29 18:23:33 2023 +1100 powerpc/Makefile: Don't prefix archhelp commands with "@" It's not necessary to prefix every command in archhelp with "@" (to suppress echoing the command), because that is done by the top level Makefile when it evaluates archhelp. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230329072334.2023357-1-mpe@ellerman.id.au commit 18b5e7170a33a985dc842ab24a690fa6ff0f50e4 Author: Michael Ellerman Date: Fri Apr 7 00:45:35 2023 +1000 powerpc/pseries: Always inline functions called from cpuidle Code in the idle path is not allowed to be instrumented because RCU is disabled, see commit 0e985e9d2286 ("cpuidle: Add comments about noinstr/__cpuidle usage"). Force inlining of the inline functions called from cpuidle, to ensure they are not emitted out-of-line and then available for tracing. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406144535.3786008-4-mpe@ellerman.id.au commit 88990745c934b14359e526033c5bc1daaf15267c Author: Michael Ellerman Date: Fri Apr 7 00:45:34 2023 +1000 cpuidle: pseries: Mark ->enter() functions as __cpuidle Code in the idle path is not allowed to be instrumented because RCU is disabled, see commit 0e985e9d2286 ("cpuidle: Add comments about noinstr/__cpuidle usage"). Mark the cpuidle ->enter() callbacks as __cpuidle and use the raw_local_irq_*() routines to ensure that is the case. Reported-by: Sachin Sant Link: https://lore.kernel.org/all/4C073F6A-C812-4C4A-BB7A-ECD10B75FB88@linux.ibm.com/ Suggested-by: Peter Zijlstra Tested-by: Sachin Sant Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406144535.3786008-3-mpe@ellerman.id.au commit 6fee130204650515af80c2786176da0fe7e94482 Author: Michael Ellerman Date: Fri Apr 7 00:45:33 2023 +1000 powerpc/64: Don't call trace_hardirqs_on() in prep_irq_for_idle() Since commit a01353cf1896 ("cpuidle: Fix ct_idle_*() usage"), the cpuidle entry code calls trace_hardirqs_on() (actually trace_hardirqs_on_prepare()) in ct_cpuidle_enter() before calling into the cpuidle driver. Suggested-by: Peter Zijlstra Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406144535.3786008-2-mpe@ellerman.id.au commit 7640854d966449e5befeff02c45c799cfc3d4fcf Author: Michael Ellerman Date: Fri Apr 7 00:45:32 2023 +1000 powerpc/64: Mark prep_irq_for_idle() __cpuidle Code in the idle path is not allowed to be instrumented because RCU is disabled, see commit 0e985e9d2286 ("cpuidle: Add comments about noinstr/__cpuidle usage"). Mark prep_irq_for_idle() __cpuidle, which is equivalent to noinstr, to enforce that. Suggested-by: Peter Zijlstra Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406144535.3786008-1-mpe@ellerman.id.au commit e5b6634aa1bcbd43120b2fd6f15780f00e9e7f66 Author: Michael Ellerman Date: Thu Apr 6 22:21:18 2023 +1000 powerpc/irq: Mark check_return_regs_valid() notrace check_return_regs_valid() is called from the middle of the irq exit handling, which is all notrace, so mark it notrace also. Reported-by: Sachin Sant Link: https://lore.kernel.org/all/4C073F6A-C812-4C4A-BB7A-ECD10B75FB88@linux.ibm.com/ Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406122118.3760344-1-mpe@ellerman.id.au commit 9ab9de2f3aa99ab6245203236d66a057d73b7e9f Author: Michael Ellerman Date: Tue Apr 11 20:28:38 2023 +1000 powerpc/corenet: Add PPC_QEMU_E500 to corenet configs Add PPC_QEMU_E500 to corenet_base.config, which is then used to generate corenet64_smp_defconfig and corenet32_smp_defconfig. That then allows both those configs to build kernels that boot in qemu using the ppce500 machine type and respectively -cpu e5500 or -cpu e500mc. The code that is added by PPC_QEMU_E500 just defines another machine with a probe function that recognises qemu, so there should be no change when booting on actual hardware supported by CORENET_GENERIC. The increase in vmlinux size is less than 1KB. Signed-off-by: Michael Ellerman Link: https://msgid.link/20230411102838.512859-1-mpe@ellerman.id.au commit ad46ad2d853daf082f742c9654da84e3d2a46765 Author: Paul Gortmaker Date: Fri Feb 24 15:49:59 2023 -0500 powerpc: drop MPC8272-ADS and PowerQUICC II FADS shared code. With the two platforms depending on this shared code, and no others, we can remove the orphaned code and Kconfigs Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman Link: https://msgid.link/20230224204959.17425-4-paul.gortmaker@windriver.com commit 859b21a008ebcc7fd876f50738f63750d46b5296 Author: Paul Gortmaker Date: Fri Feb 24 15:49:58 2023 -0500 powerpc: drop PowerQUICC II Family ADS platform support Based on documentation revision dates, this MPC82xx pq2fads system predates the MPC8272-ADS variant by about a year and only has 1/2 the amount of RAM (32MB) -- largely making it useless with a modern v6.x kernel from today. Similar to the MPC8272-ADS the pq2fads also supported other 82xx CPU variants, had 8MB flash, and like the 8272 ADS platform, was on a fairly large PCB in order to have space for breakout connectors for all features. These 82xx platforms are two decades old, and originally made for a small group of industry related people in order to assist in new OEM board designs. Given that, it makes sense to remove support today. Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman Link: https://msgid.link/20230224204959.17425-3-paul.gortmaker@windriver.com commit 33777a4e9bb93f66ac2511d99ec66ab50f1a04bc Author: Paul Gortmaker Date: Fri Feb 24 15:49:57 2023 -0500 powerpc: drop MPC8272_ADS platform support The MPC8272-ADS also supported other 82xx CPU variants, had 64MB RAM, 8MB flash, and like the 85xx ADS platforms, was on a fairly large PCB in order to have space for breakout connectors for all the features. These 82xx platforms are two decades old, and originally made for a small group of industry related people in order to assist in new OEM board designs. Given that, it makes sense to remove support today. Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman Link: https://msgid.link/20230224204959.17425-2-paul.gortmaker@windriver.com commit 248667f8bbded6c00a300dbcabe0d15b3d0de9ab Author: Paul Gortmaker Date: Sat Feb 25 15:13:18 2023 -0500 powerpc: drop HPCD/MPC8610 evaluation platform support This evaluation platform was essentially a single core 8641 with integrated graphics/display support - in an effort to reduce chip count on kiosk and similar applications. Compared to other evaluation platforms considered for removal in other recent commits, this platform was relatively rare. Unlike all the other 10+ platforms, I couldn't find any documentation on it - just a link to downloading the 2007 era BSP in "LTIB" format as was done back then. With all that in mind, it seems prudent to remove it here in 2023. Signed-off-by: Paul Gortmaker [mpe: Drop stale reference to MPC8610_HPCD in 86xx/Kconfig] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230225201318.3682-4-paul.gortmaker@windriver.com commit c1d85f3f75e3c8391134b67aefc8d029b26fa38e Author: Paul Gortmaker Date: Sat Feb 25 15:13:17 2023 -0500 powerpc: drop HPC-NET/MPC8641D evaluation platform support There is no denying that this was an interesting platform in its day. Access to a SMP powerpc platform became a bit more obtainable for folks in the BSP industry in the 2007 era, thanks to this platform. Add to that the move to the black Antec case vs. the generic white 2005 era case of the MPC8548CDS or the retro 1950s 1/2 height horizontal case of the HPC II, and it was pretty interesting to people like myself then. However, like all the other evaluation platforms, the overall system was complex out of necessity, as it tried to showcase all possible features and use-cases. That included an AMP option, where you could run two bootloaders and two kernels over two serial consoles. Peripheral sharing got a bit more tricky when you got to the hard disk and similar. In any case we still have the same circumstance. A relatively rare and expensive evaluation platform that is now 15+ years old and not out there in large numbers in the general public. Removal in 2023 just makes sense. Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman Link: https://msgid.link/20230225201318.3682-3-paul.gortmaker@windriver.com commit f03425a5fd838a841138e3be586c1245fa9c78d6 Author: Paul Gortmaker Date: Sat Feb 25 15:13:16 2023 -0500 powerpc: drop HPC II (MPC7448) evaluation platform support. This was an interesting platform - it was the 1st instance of a respin of earlier 130nm 74xx CPUs on 90nm and systems using MPC7448 were positioned as a rack server platform solution. Given that, the evaluation platform (at least the one I had) was shipped in a horizontal 1/2 height Antec desktop case with retro styling and colours, despite the fact the docs explicitly stated that the HPC II is not a desktop machine (noting it had no gfx or legacy PC I/O support). Historic trivia aside, this was the 1st introduction of the e600 procfam as an evolution from the earlier G4. However even with the claim to being "1st e600" it seems the 2005+ era was turning its attention to multicore support and from my memory this poor guy was quickly overshadowed by the dual core MPC8641D. All that aside, we are once again looking at 15+ year old evaluation platforms that were not widely distributed, so 2023 removal makes sense. Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman Link: https://msgid.link/20230225201318.3682-2-paul.gortmaker@windriver.com commit b8fa3af2dbcb0c84270d4d2ecf54a088f7c90701 Author: Paul Gortmaker Date: Thu Apr 13 11:08:58 2023 +1000 powerpc: drop MPC832x_MDS platform support This final variant in the e300 family of Modular Development System (MDS) in this series was actually aimed at feature reduction - things like floating point and ethernet were removed in order to make for a lower power and lower cost system. Like all the MDS systems, it was meant as a vehicle to get the CPU out early to hardware OEMs so software and board development could take place in parallel. These were made in limited numbers and availability preference was given to partners who were planning to make their own boards. Given that the whole reason for existence was to assist in enabling new board designs [not happening for 10+ years], and that they weren't generally available, and that the hardware wasn't really hobbyist friendly even for retro computing, it makes sense to retire the support for this particular platform. Signed-off-by: Paul Gortmaker Acked-by: Li Yang [mpe: Drop stale reference to MPC832x_MDS in arch/powerpc/boot/Makefile] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230220115913.25811-5-paul.gortmaker@windriver.com commit aa572079633c293882d8fa3973bf6d8c27eb430f Author: Paul Gortmaker Date: Thu Apr 13 11:08:57 2023 +1000 powerpc: drop MPC837x_MDS platform support This next evolutionary step in the e300 family of Modular Development System (MDS) still has, at its core component, a full length card with a PCI edge. No case. Serial and network connectors were on card, so it could optionally be fitted with plastic stand-offs and run stand-alone off a power brick. This is very similar to the MPC834x_MDS and MPC836x_MDS removed in the prior commits, but with this board variant as yet another evolutionary step. SATA and PCI-e were now available. But overall the form factor and design goals were unchanged. Like all the MDS systems, it was meant as a vehicle to get the CPU out early to hardware OEMs so software and board development could take place in parallel. These were made in limited numbers and availability preference was given to partners who were planning to make their own boards. Given that the whole reason for existence was to assist in enabling new board designs [not happening for 10+ years], and that they weren't generally available, and that the hardware wasn't really hobbyist friendly even for retro computing, it makes sense to retire the support for this particular platform. Signed-off-by: Paul Gortmaker Acked-by: Li Yang Signed-off-by: Michael Ellerman Link: https://msgid.link/20230220115913.25811-4-paul.gortmaker@windriver.com commit 7840b08aeccbd4d46261a6d5c27699d6939f712e Author: Paul Gortmaker Date: Thu Apr 13 11:08:55 2023 +1000 powerpc: drop MPC836x_MDS platform support This 2006 era Modular Development System (MDS) has, at its core component, a full length card with a PCI edge. No case. Serial and network connectors were on card, so it could optionally be fitted with plastic stand-offs and run stand-alone off a power brick. This is very similar to the MPC834x_MDS removed in the prior commit, but with this board variant as an evolutionary step. DDR2 was now an option, and the card edge was revised down to PCI-32 as PCI-64 never got traction. But overall the form factor and design goals were unchanged. Like all the MDS systems, it was meant as a vehicle to get the CPU out early to hardware OEMs so software and board development could take place in parallel. To that end, the BGA CPU was held in place with a mechanical spring loaded pressure assembly (vs. solder) so that early rev silicon could be replaced in the field. Not for COTS deployment! These were made in limited numbers and availability preference was given to partners who were planning to make their own boards. Given that the whole reason for existence was to assist in enabling new board designs [not happening for 10+ years], and that they weren't generally available, and that the hardware wasn't really hobbyist friendly even for retro computing, it makes sense to retire the support for this particular platform. Signed-off-by: Paul Gortmaker Acked-by: Li Yang [mpe: Drop stale reference to MPC836x_MDS in arch/powerpc/boot/Makefile] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230220115913.25811-3-paul.gortmaker@windriver.com commit da03101799579f6477feb47a3aefcdb2e2379da1 Author: Paul Gortmaker Date: Thu Apr 13 11:08:53 2023 +1000 powerpc: drop MPC834x_MDS platform support This 2006 era Modular Development System (MDS) has, at its core component, a full length card with a PCI-64 edge. No case. Serial and network connectors were on card, so it could optionally be fitted with plastic stand-offs and run stand-alone off a power brick. Like all the MDS systems, it was meant as a vehicle to get the CPU out early to hardware OEMs so software and board development could take place in parallel. To that end, the BGA CPU was held in place with a mechanical spring loaded pressure assembly (vs. solder) so that early rev silicon could be replaced in the field. Not for COTS deployment! These were made in limited numbers and availability preference was given to partners who were planning to make their own boards, like our WR SBC8349 [since retired in v4.18 (2017, commit 3bc6cf5a86e5)] Given that the whole reason for existence was to assist in enabling new board designs [not happening for 10+ years], and that they weren't generally available, and that the hardware wasn't really hobbyist friendly even for retro computing, it makes sense to retire the support for this platform. Signed-off-by: Paul Gortmaker Acked-by: Li Yang Signed-off-by: Michael Ellerman Link: https://msgid.link/20230220115913.25811-2-paul.gortmaker@windriver.com commit df9cad09493808dca7d16a2fbcac1a78e8d412af Author: Andrew Donnellan Date: Fri Feb 24 15:10:12 2023 +1100 powerpc/pseries: Add FW_FEATURE_PLPKS feature flag Add a firmware feature flag, FW_FEATURE_PLPKS, to indicate availability of Platform KeyStore related hcalls. Check this flag in plpks_is_available() and pseries_plpks_init() before trying to make an hcall. Suggested-by: Michael Ellerman Signed-off-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://msgid.link/20230224041012.772648-1-ajd@linux.ibm.com commit ae7312c09014fceb782a92cfb934e973f08b338f Author: Benjamin Gray Date: Thu Apr 6 14:33:20 2023 +1000 selftests/powerpc/dscr: Restore timeout to DSCR selftests Reducing the time taken by dscr_sysfs_test.c allows restoring the default timeout, which was removed in commit 850507f30c38 ("selftests/powerpc: Turn off timeout setting for benchmarks, dscr, signal, tm") because that test took too long. Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406043320.125138-8-bgray@linux.ibm.com commit c14a9d0a79d4fb83c4e9e8cadc5cb094f41d01d0 Author: Benjamin Gray Date: Thu Apr 6 14:33:19 2023 +1000 selftests/powerpc/dscr: Speed up DSCR sysfs tests This test case is extremely slow, taking around a minute compared to most of the other DSCR tests taking a second at most. Perf shows most time is spent by the kernel switching to each CPU it reads in /sys/devices/system/cpu. This switching is an unavoidable consequnce of reading all the .../cpuN/dscr values. Remove the outer iteration loop from this test case, reducing the reads from 1600 to 16. This still updates the DSCR 16 times and verifies on every CPU each time, so I do not expect the lower coverage to be meaningful. The speedup is significant: back down to ~1 second like the other tests. Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406043320.125138-7-bgray@linux.ibm.com commit 3067b89ab62305c54ec15b00a2c4dbaf64809c59 Author: Benjamin Gray Date: Thu Apr 6 14:33:18 2023 +1000 selftests/powerpc/dscr: Improve DSCR explicit random test case The tests currently have a single writer thread updating the system DSCR with a 1/1000 chance looped only 100 times. So only around one in 10 runs actually do anything. * Add multiple threads to the dscr_explicit_random_test case. * Use a barrier to make all the threads start work as simultaneously as possible. * Use a rwlock and make all threads have a reasonable chance to write to the DSCR on each iteration. PTHREAD_RWLOCK_PREFER_WRITER_NONRECURSIVE_NP is used to prevent writers from starving while all the other threads keep reading. Logging the reads/writes shows a decent mix across the whole test. * Allow all threads a chance to write. * Make the chance of writing more likely. Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406043320.125138-6-bgray@linux.ibm.com commit fda8158870063b99b88a0904bbb95188973b4297 Author: Benjamin Gray Date: Thu Apr 6 14:33:17 2023 +1000 selftests/powerpc/dscr: Add lockstep test cases to DSCR explicit tests Add new cases to the relevant tests that use explicitly synchronized threads to test the behaviour across context switches with less randomness. By locking the participants to the same CPU we guarantee a context switch occurs each time they make progress, which is a likely failure point if the kernel is not tracking the thread local DSCR correctly. The random case is left in to keep exercising potential edge cases. Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406043320.125138-5-bgray@linux.ibm.com commit 6ff4dc25483f3f49d1db48af28d4c485fc77bd21 Author: Benjamin Gray Date: Thu Apr 6 14:33:16 2023 +1000 selftests/powerpc: Allow bind_to_cpu() to automatically pick CPU All current users of bind_to_cpu() don't care _which_ CPU they get, just that they are bound to a single free one. So alter the interface to 1. Accept a BIND_CPU_ANY value that tells it to automatically pick a CPU 2. Return the picked CPU And convert all these users to bind_to_cpu(BIND_CPU_ANY). Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406043320.125138-4-bgray@linux.ibm.com commit c97b2fc6627e1c26a3a84633e135322918a1e592 Author: Benjamin Gray Date: Thu Apr 6 14:33:15 2023 +1000 selftests/powerpc: Move bind_to_cpu() to utils.h This function will be useful in the DSCR test patches later in this series, so promote it to be shared by all powerpc selftests. Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406043320.125138-3-bgray@linux.ibm.com commit 15f0c2601e141e3c01c8dc3368b81181bc1c9228 Author: Benjamin Gray Date: Thu Apr 6 14:33:14 2023 +1000 selftests/powerpc/dscr: Correct typos Correct a couple of typos while working on other improvements to the DSCR tests. Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230406043320.125138-2-bgray@linux.ibm.com commit 92cb1eff88a67e95daaf39eccf777272e85398c6 Author: Joel Stanley Date: Wed Apr 5 14:23:16 2023 +0930 powerpc: Remove duplicate SPRN_HSRR definitions There are two copies of these defines. Keep the older ones as they have associated bit definitions. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman Link: https://msgid.link/20230405045316.95003-1-joel@jms.id.au commit 77e69ee7ce0715c39b9a0cde68ff44fe467435ef Author: Nicholas Piggin Date: Sat Apr 8 12:17:52 2023 +1000 powerpc/64: modules support building with PCREL addresing Build modules using PCREL addressing when CONFIG_PPC_KERNEL_PCREL=y. - The module loader must handle several new relocation types: * R_PPC64_REL24_NOTOC is a function call handled like R_PPC_REL24, but does not restore r2 upon return. The external function call stub is changed to use pcrel addressing to load the function pointer rather than based on the module TOC. * R_PPC64_GOT_PCREL34 is a reference to external data. A GOT table must be built by hand, because the linker adds this during the final link (which is not done for kernel modules). The GOT table is built similarly to the way the external function call stub table is. This section is called .mygot because .got has a special meaning for the linker and can become upset. * R_PPC64_PCREL34 is used for local data addressing, but there is a special case where the percpu section is moved at load-time to the percpu area which is out of range of this relocation. This requires the PCREL34 relocations are converted to use GOT_PCREL34 addressing. Signed-off-by: Nicholas Piggin [mpe: Some coding style & formatting fixups] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408021752.862660-7-npiggin@gmail.com commit 7e3a68be42e10f5fa5890e97afc0afd992355bc3 Author: Nicholas Piggin Date: Sat Apr 8 12:17:51 2023 +1000 powerpc/64: vmlinux support building with PCREL addresing PC-Relative or PCREL addressing is an extension to the ELF ABI which uses Power ISA v3.1 PC-relative instructions to calculate addresses, rather than the traditional TOC scheme. Add an option to build vmlinux using pcrel addressing. Modules continue to use TOC addressing. - TOC address helpers and r2 are poisoned with -1 when running vmlinux. r2 could be used for something useful once things are ironed out. - Assembly must call C functions with @notoc annotation, or the linker complains aobut a missing nop after the call. This is done with the CFUNC macro introduced earlier. - Boot: with the exception of prom_init, the execution branches to the kernel virtual address early in boot, before any addresses are generated, which ensures 34-bit pcrel addressing does not miss the high PAGE_OFFSET bits. TOC relative addressing has a similar requirement. prom_init does not go to the virtual address and its addresses should not carry over to the post-prom kernel. - Ftrace trampolines are converted from TOC addressing to pcrel addressing, including module ftrace trampolines that currently use the kernel TOC to find ftrace target functions. - BPF function prologue and function calling generation are converted from TOC to pcrel. - copypage_64.S has an interesting problem, prefixed instructions have alignment restrictions so the linker can add padding, which makes the assembler treat the difference between two local labels as non-constant even if alignment is arranged so padding is not required. This may need toolchain help to solve nicely, for now move the prefix instruction out of the alternate patch section to work around it. This reduces kernel text size by about 6%. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408021752.862660-6-npiggin@gmail.com commit 4e991e3c16a350d1eeffc100ce3fb25292596d03 Author: Nicholas Piggin Date: Sat Apr 8 12:17:50 2023 +1000 powerpc: add CFUNC assembly label annotation This macro is to be used in assembly where C functions are called. pcrel addressing mode requires branches to functions with a localentry value of 1 to have either a trailing nop or @notoc. This macro permits the latter without changing callers. Signed-off-by: Nicholas Piggin [mpe: Add dummy definitions to fix selftests build] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408021752.862660-5-npiggin@gmail.com commit dc5dac748af9087e9240bd2ae6ae7db48d5360ae Author: Nicholas Piggin Date: Sat Apr 8 12:17:49 2023 +1000 powerpc/64: Add support to build with prefixed instructions Add an option to build kernel and module with prefixed instructions if the CPU and toolchain support it. This is not related to kernel support for userspace execution of prefixed instructions. Building with prefixed instructions breaks some extended inline asm memory addressing, for example it will provide immediates that exceed the range of simple load/store displacement. Whether this is a toolchain or a kernel asm problem remains to be seen. For now, these are replaced with simpler and less efficient direct register addressing when compiling with prefixed. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408021752.862660-4-npiggin@gmail.com commit b270bebd34e36fb69363d65e24b00a9d148903e8 Author: Nicholas Piggin Date: Sat Apr 8 12:17:48 2023 +1000 powerpc/64s: Run at the kernel virtual address earlier in boot This mostly consolidates the Book3E and Book3S behaviour in boot WRT executing from the physical or virtual address. Book3E sets up kernel virtual linear map in start_initialization_book3e and runs from the virtual linear alias after that. This change makes Book3S begin to execute from the virtual alias at the same point. Book3S can not use its MMU for that at this point, but when the MMU is disabled, the virtual linear address correctly aliases to physical memory because the top bits of the address are ignored with MMU disabled. Secondaries execute from the virtual address similarly early. This reduces the differences between subarchs, but the main motivation was to enable the PC-relative addressing ABI for Book3S, where pointer calculations must execute from the virtual address or the top bits of the pointer will be lost. This is similar to the requirement the TOC relative addressing already has that the TOC pointer use its virtual address. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408021752.862660-3-npiggin@gmail.com commit 4f18b9e6ca58440394e86a53bf1be0d8a1920bcd Author: Nicholas Piggin Date: Sat Apr 8 12:17:47 2023 +1000 powerpc/64: Move initial base and TOC pointer calculation A later change moves the non-prom case to run at the virtual address earlier, which calls for virtual TOC and kernel base. Split these two calculations for prom and non-prom to make that change simpler. Signed-off-by: Nicholas Piggin [mpe: Retain relative_toc call for start_initialization_book3e] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408021752.862660-2-npiggin@gmail.com commit 40f7b523e31fd68163d9dfe639f2f34b6a726ecd Author: Pali Rohár Date: Sat Apr 8 16:01:22 2023 +0200 powerpc: dts: turris1x.dts: Remove "fsl,P2020RDB-PC" compatible string "fsl,P2020RDB-PC" compatible string was present in Turris 1.x DTS file just because Linux kernel required it for proper detection of P2020 processor during boot. This was quite a hack as CZ.NIC Turris 1.x is not compatible with Freescale P2020-RDB-PC board. Now when kernel has generic unified support for boards with P2020 processors, there is no need to have this "hack" in turris1x.dts file. So remove incorrect "fsl,P2020RDB-PC" compatible string from turris1x.dts. Signed-off-by: Pali Rohár Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-14-pali@kernel.org commit b5340a094b5c753ee3490716bcd86546dfd3e078 Author: Pali Rohár Date: Sat Apr 8 16:01:21 2023 +0200 powerpc/85xx: p2020: Enable boards by new config option CONFIG_PPC_P2020 Generic unified P2020 machine description which supports all P2020-based boards is now in separate file p2020.c. So create a separate config option CONFIG_PPC_P2020 for it. Previously machine descriptions for P2020 boards were enabled by CONFIG_MPC85xx_DS or CONFIG_MPC85xx_RDB option. So set CONFIG_PPC_P2020 to be enabled by default when one of those option is enabled. This allows to compile support for P2020 boards without need to have enabled support for older mpc85xx boards. And to compile kernel for old mpc85xx boards without having enabled support for new P2020 boards. Signed-off-by: Pali Rohár Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-13-pali@kernel.org commit 1a170efec56ba4707cd33e711dbafb60b7f94626 Author: Pali Rohár Date: Sat Apr 8 16:01:20 2023 +0200 powerpc/85xx: p2020: Define just one machine description Combine machine descriptions and code of all P2020 boards into just one generic unified P2020 machine description. This allows kernel to boot on any P2020-based board with P2020 DTS file without need to patch kernel and define a new machine description in 85xx powerpc platform directory. Signed-off-by: Pali Rohár Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-12-pali@kernel.org commit 7d8ae6e081428699999c9d128c4e9d3927c1da03 Author: Pali Rohár Date: Sat Apr 8 16:01:19 2023 +0200 powerpc/85xx: p2020: Unify .setup_arch and .init_IRQ callbacks Make just one .setup_arch and one .init_IRQ callback implementation for all P2020 board code. This deduplicate repeated and same code. Signed-off-by: Pali Rohár Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-11-pali@kernel.org commit 92189c902c2e2f8c0d4238310686e93da99156b5 Author: Pali Rohár Date: Sat Apr 8 16:01:18 2023 +0200 powerpc/85xx: mpc85xx_ds: Move i8259 code into own file In order to share mpc85xx i8259 code between DS and P2020. Prefix i8259 debug and error messages by i8259 word. Signed-off-by: Pali Rohár Signed-off-by: Christophe Leroy [mpe: Fix some coding style warnings in the moved code] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-10-pali@kernel.org commit e1f2750edc4afebb966a229b797fc89b98ee6098 Author: Linus Torvalds Date: Wed Apr 19 19:09:52 2023 -0700 x86: remove 'zerorest' argument from __copy_user_nocache() Every caller passes in zero, meaning they don't want any partial copy to zero the remainder of the destination buffer. Which is just as well, because the implementation of that function didn't actually even look at that argument, and wasn't even aware it existed, although some misleading comments did mention it still. The 'zerorest' thing is a historical artifact of how "copy_from_user()" worked, in that it would zero the rest of the kernel buffer that it copied into. That zeroing still exists, but it's long since been moved to generic code, and the raw architecture-specific code doesn't do it. See _copy_from_user() in lib/usercopy.c for this all. However, while __copy_user_nocache() shares some history and superficial other similarities with copy_from_user(), it is in many ways also very different. In particular, while the code makes it *look* similar to the generic user copy functions that can copy both to and from user space, and take faults on both reads and writes as a result, __copy_user_nocache() does no such thing at all. __copy_user_nocache() always copies to kernel space, and will never take a page fault on the destination. What *can* happen, though, is that the non-temporal stores take a machine check because one of the use cases is for writing to stable memory, and any memory errors would then take synchronous faults. So __copy_user_nocache() does look a lot like copy_from_user(), but has faulting behavior that is more akin to our old copy_in_user() (which no longer exists, but copied from user space to user space and could fault on both source and destination). And it very much does not have the "zero the end of the destination buffer", since a problem with the destination buffer is very possibly the very source of the partial copy. So this whole thing was just a confusing historical artifact from having shared some code with a completely different function with completely different use cases. Signed-off-by: Linus Torvalds commit a5962e0a8b7b0da2350b4baeefaf7dfa3377bc89 Merge: f1836a424518a 88232ec1ec5ec Author: Jakub Kicinski Date: Wed Apr 19 18:48:50 2023 -0700 Merge branch 'another-crack-at-a-handshake-upcall-mechanism' Chuck Lever says: ==================== Another crack at a handshake upcall mechanism Here is v10 of a series to add generic support for transport layer security handshake on behalf of kernel socket consumers (user space consumers use a security library directly, of course). A summary of the purpose of these patches is archived here: https://lore.kernel.org/netdev/1DE06BB1-6BA9-4DB4-B2AA-07DE532963D6@oracle.com/ The first patch in the series applies to the top-level .gitignore file to address the build warnings reported a few days ago. I intend to submit that separately. I'd like you to consider taking the rest of this series for v6.4. The full patch set to support SunRPC with TLSv1.3 is available in the topic-rpc-with-tls-upcall branch here, based on net-next/main: https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git This patch set includes support for in-transit confidentiality and peer authentication for both the Linux NFS client and server. A user space handshake agent for TLSv1.3 to go along with the kernel patches is available in the "main" branch here: https://github.com/oracle/ktls-utils ==================== Link: https://lore.kernel.org/r/168174169259.9520.1911007910797225963.stgit@91.116.238.104.host.secureserver.net Signed-off-by: Jakub Kicinski commit 88232ec1ec5ecf4aa5de439cff3d5e2b7adcac93 Author: Chuck Lever Date: Mon Apr 17 10:32:39 2023 -0400 net/handshake: Add Kunit tests for the handshake consumer API These verify the API contracts and help exercise lifetime rules for consumer sockets and handshake_req structures. One way to run these tests: ./tools/testing/kunit/kunit.py run --kunitconfig ./net/handshake/.kunitconfig Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 2fd5532044a89d2403b543520b4902e196f7d165 Author: Chuck Lever Date: Mon Apr 17 10:32:33 2023 -0400 net/handshake: Add a kernel API for requesting a TLSv1.3 handshake To enable kernel consumers of TLS to request a TLS handshake, add support to net/handshake/ to request a handshake upcall. This patch also acts as a template for adding handshake upcall support for other kernel transport layer security providers. Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 3b3009ea8abb713b022d94fba95ec270cf6e7eae Author: Chuck Lever Date: Mon Apr 17 10:32:26 2023 -0400 net/handshake: Create a NETLINK service for handling handshake requests When a kernel consumer needs a transport layer security session, it first needs a handshake to negotiate and establish a session. This negotiation can be done in user space via one of the several existing library implementations, or it can be done in the kernel. No in-kernel handshake implementations yet exist. In their absence, we add a netlink service that can: a. Notify a user space daemon that a handshake is needed. b. Once notified, the daemon calls the kernel back via this netlink service to get the handshake parameters, including an open socket on which to establish the session. c. Once the handshake is complete, the daemon reports the session status and other information via a second netlink operation. This operation marks that it is safe for the kernel to use the open socket and the security session established there. The notification service uses a multicast group. Each handshake mechanism (eg, tlshd) adopts its own group number so that the handshake services are completely independent of one another. The kernel can then tell via netlink_has_listeners() whether a handshake service is active and prepared to handle a handshake request. A new netlink operation, ACCEPT, acts like accept(2) in that it instantiates a file descriptor in the user space daemon's fd table. If this operation is successful, the reply carries the fd number, which can be treated as an open and ready file descriptor. While user space is performing the handshake, the kernel keeps its muddy paws off the open socket. A second new netlink operation, DONE, indicates that the user space daemon is finished with the socket and it is safe for the kernel to use again. The operation also indicates whether a session was established successfully. Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 2bc42f482bedeafdbe70804fd82bdbf8f7e28b00 Author: Chuck Lever Date: Mon Apr 17 10:32:19 2023 -0400 .gitignore: Do not ignore .kunitconfig files Circumvent the .gitignore wildcard to avoid warnings about ignored .kunitconfig files. As far as I can tell, the warnings are harmless and these files are not actually ignored. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304142337.jc4oUrov-lkp@intel.com/ Signed-off-by: Chuck Lever Signed-off-by: Jakub Kicinski commit f1836a424518a09b17ee2b69e81e9477321a0aff Merge: 84ce730f82dfe f4796398f21b9 Author: Jakub Kicinski Date: Wed Apr 19 18:46:17 2023 -0700 Merge tag 'ipsec-next-2023-04-19' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== ipsec-next 2023-04-19 1) Remove inner/outer modes from input/output path. These are not needed anymore. From Herbert Xu. * tag 'ipsec-next-2023-04-19' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: Remove inner/outer modes from output path xfrm: Remove inner/outer modes from input path ==================== Link: https://lore.kernel.org/r/20230419075300.452227-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit 84ce730f82dfe62f6f3e76b059ce0f7178322fb9 Author: Rob Herring Date: Tue Apr 18 10:06:27 2023 -0500 dt-bindings: net: ethernet: Fix JSON pointer references A JSON pointer reference (the part after the "#") must start with a "/". Conversely, references to the entire document must not have a trailing "/" and should be just a "#". The existing jsonschema package allows these, but coming changes make allowed "$ref" URIs stricter and throw errors on these references. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230418150628.1528480-1-robh@kernel.org Signed-off-by: Jakub Kicinski commit 3e9c0700bf42b6170ae6b6e616cdc2e75a21b506 Author: Horatiu Vultur Date: Tue Apr 18 14:47:13 2023 +0200 net: micrel: Update the list of supported phys At the beginning of the file micrel.c there is list of supported PHYs. Extend this list with the following PHYs lan8841, lan8814 and lan8804, as these PHYs were added but the list was not updated. Signed-off-by: Horatiu Vultur Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230418124713.2221451-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 43bb6100d8d5871d211196034042308c1b1d69c3 Author: Simon Horman Date: Tue Apr 18 13:07:33 2023 +0200 net: stmmac: dwmac-meson8b: Avoid cast to incompatible function type Rather than casting clk_disable_unprepare to an incompatible function type provide a trivial wrapper with the correct signature for the use-case. Reported by clang-16 with W=1: drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c:276:6: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] (void(*)(void *))clk_disable_unprepare, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ No functional change intended. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20230418-dwmac-meson8b-clk-cb-cast-v1-1-e892b670cbbb@kernel.org Signed-off-by: Jakub Kicinski commit 91daa4f62ce878b6e1ac5908aceb83550332447f Author: Daniel Golle Date: Sun Apr 16 13:08:14 2023 +0100 net: dsa: mt7530: fix support for MT7531BE There are two variants of the MT7531 switch IC which got different features (and pins) regarding port 5: * MT7531AE: SGMII/1000Base-X/2500Base-X SerDes PCS * MT7531BE: RGMII Moving the creation of the SerDes PCS from mt753x_setup to mt7530_probe with commit 6de285229773 ("net: dsa: mt7530: move SGMII PCS creation to mt7530_probe function") works fine for MT7531AE which got two instances of mtk-pcs-lynxi, however, MT7531BE requires mt7531_pll_setup to setup clocks before the single PCS on port 6 (usually used as CPU port) starts to work and hence the PCS creation failed on MT7531BE. Fix this by introducing a pointer to mt7531_create_sgmii function in struct mt7530_priv and call it again at the end of mt753x_setup like it was before commit 6de285229773 ("net: dsa: mt7530: move SGMII PCS creation to mt7530_probe function"). Fixes: 6de285229773 ("net: dsa: mt7530: move SGMII PCS creation to mt7530_probe function") Signed-off-by: Daniel Golle Acked-by: Arınç ÜNAL Link: https://lore.kernel.org/r/ZDvlLhhqheobUvOK@makrotopia.org Signed-off-by: Jakub Kicinski commit 8660484ed1cf3261e89e0bad94c6395597e87599 Author: Luis Chamberlain Date: Thu Apr 13 22:28:39 2023 -0700 module: add debugging auto-load duplicate module support The finit_module() system call can in the worst case use up to more than twice of a module's size in virtual memory. Duplicate finit_module() system calls are non fatal, however they unnecessarily strain virtual memory during bootup and in the worst case can cause a system to fail to boot. This is only known to currently be an issue on systems with larger number of CPUs. To help debug this situation we need to consider the different sources for finit_module(). Requests from the kernel that rely on module auto-loading, ie, the kernel's *request_module() API, are one source of calls. Although modprobe checks to see if a module is already loaded prior to calling finit_module() there is a small race possible allowing userspace to trigger multiple modprobe calls racing against modprobe and this not seeing the module yet loaded. This adds debugging support to the kernel module auto-loader (*request_module() calls) to easily detect duplicate module requests. To aid with possible bootup failure issues incurred by this, it will converge duplicates requests to a single request. This avoids any possible strain on virtual memory during bootup which could be incurred by duplicate module autoloading requests. Folks debugging virtual memory abuse on bootup can and should enable this to see what pr_warn()s come on, to see if module auto-loading is to blame for their wores. If they see duplicates they can further debug this by enabling the module.enable_dups_trace kernel parameter or by enabling CONFIG_MODULE_DEBUG_AUTOLOAD_DUPS_TRACE. Current evidence seems to point to only a few duplicates for module auto-loading. And so the source for other duplicates creating heavy virtual memory pressure due to larger number of CPUs should becoming from another place (likely udev). Signed-off-by: Luis Chamberlain commit c30aa8fd6cabd12917277facbd2bd81dc3a226d6 Author: Pali Rohár Date: Sat Apr 8 16:01:17 2023 +0200 powerpc/85xx: p2020: Move all P2020 RDB machine descriptions to p2020.c This moves P2020 RDB machine descriptions into new p2020.c source file. This is preparation for code de-duplication and providing one unified machine description for all P2020 boards. Signed-off-by: Pali Rohár Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-9-pali@kernel.org commit ba5a7ca277afc0e9083a7a2021725425a493cfb2 Author: Pali Rohár Date: Sat Apr 8 16:01:16 2023 +0200 powerpc/85xx: p2020: Move all P2020 DS machine descriptions to p2020.c This moves P2020 DS machine descriptions into new p2020.c source file. This is preparation for code de-duplication and providing one unified machine description for all P2020 boards. Signed-off-by: Pali Rohár Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-8-pali@kernel.org commit b1a54cb693724b6212efa64d877126769ece4d4c Author: Christophe Leroy Date: Sat Apr 8 16:01:15 2023 +0200 powerpc/85xx: Remove #ifdef CONFIG_QUICC_ENGINE in mpc85xx_rdb mpc85xx_qe_par_io_init() is a stub when CONFIG_QUICC_ENGINE is not set. CONFIG_UCC_GETH and CONFIG_SERIAL_QE depend on CONFIG_QUICC_ENGINE. Remove #ifdef CONFIG_QUICC_ENGINE Signed-off-by: Christophe Leroy Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-7-pali@kernel.org commit f435f67024cbee223083aa843f9b69888c8de8a8 Author: Christophe Leroy Date: Sat Apr 8 16:01:14 2023 +0200 powerpc/85xx: Remove #ifdefs CONFIG_PPC_I8259 in mpc85xx_ds All necessary items are declared all the time, no need to use a #ifdef CONFIG_PPC_I8259. Refactor CONFIG_PPC_I8259 actions into a dedicated init function. Signed-off-by: Christophe Leroy Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-6-pali@kernel.org commit 15c6ba7992993fecdac52a424ce35b6e4a272c75 Author: Christophe Leroy Date: Sat Apr 8 16:01:13 2023 +0200 powerpc/85xx: mpc85xx_{ds/rdb} replace prink by pr_xxx macro Use pr_debug() instead of printk(KERN_DEBUG Use pr_err() instead of printk(KERN_ERR Use pr_info() instead of printk(KERN_INFO or printk(" Signed-off-by: Christophe Leroy Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-5-pali@kernel.org commit 1bca2f8219da51a1119d1f4054b44880cbf0494e Author: Christophe Leroy Date: Sat Apr 8 16:01:12 2023 +0200 powerpc/85xx: mpc85xx_{ds/rdb} replace BUG_ON() by WARN_ON() No need to BUG() in case mpic_alloc() fails. Use WARN_ON(). Signed-off-by: Christophe Leroy Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-4-pali@kernel.org commit 0abc1eadd605d461b9a953e6a27d810ed169ed7b Author: Christophe Leroy Date: Sat Apr 8 16:01:11 2023 +0200 powerpc/85xx: mpc85xx_{ds/rdb} compact the call to mpic_alloc() Reduce number of lines in the call to mpic_alloc(). Signed-off-by: Christophe Leroy Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-3-pali@kernel.org commit 6faab5d7ac49d40bedf348a879042681755c14b0 Author: Christophe Leroy Date: Sat Apr 8 16:01:10 2023 +0200 powerpc/85xx: Remove DBG() macro DBG() macro is defined at three places while used only one time at one place. Replace its only use by a pr_debug() and remove the macro. Signed-off-by: Christophe Leroy Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230408140122.25293-2-pali@kernel.org commit 3ce271435b717e1dbc4fc8191a69e88deb4f8990 Author: Pali Rohár Date: Sun Apr 9 02:08:12 2023 +0200 powerpc/fsl_uli1575: Mark uli_exclude_device() as static Function uli_exclude_device() is not used outside of the fsl_uli1575.c source file anymore. So mark it as static and remove public prototype. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230409000812.18904-9-pali@kernel.org commit 40b221daf17bf8e0f27c7f1ffc8d5179d58e8597 Author: Pali Rohár Date: Sun Apr 9 02:08:11 2023 +0200 powerpc/86xx: mpc86xx_hpcn: Call uli_init() instead of explicit ppc_md assignment After calling fsl_pci_assign_primary(), it is possible to use uli_init() to conditionally initialize ppc_md.pci_exclude_device callback based on the uli1575 detection. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230409000812.18904-8-pali@kernel.org commit 22fdf79171e8509db54599fd2c05ef0022ee83f5 Author: Pali Rohár Date: Sun Apr 9 02:08:10 2023 +0200 powerpc/fsl_uli1575: Allow to disable FSL_ULI1575 support ULI1575 PCIe south bridge exists only on some Freescale boards. Allow to disable CONFIG_FSL_ULI1575 symbol when it is not explicitly selected and only implied. This is achieved by marking symbol as visible by providing short description. Also adds dependency for this symbol to prevent enabling it on platforms on which driver does not compile. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230409000812.18904-7-pali@kernel.org commit 304e364d1f89f590b72af6bec42b5199971b531b Author: Pali Rohár Date: Sun Apr 9 02:08:09 2023 +0200 powerpc/85xx: mpc85xx_rdb: Do not automatically select FSL_ULI1575 Boards provided by CONFIG_MPC85xx_RDB option do not initialize fsl_uli1575.c driver. So remove explicit select dependency on it. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230409000812.18904-6-pali@kernel.org commit c4f6d8665cff0abacd164b3cd10afe0385290db2 Author: Pali Rohár Date: Sun Apr 9 02:08:08 2023 +0200 powerpc/85xx: mpc85xx_ds: Move uli_init() code into its own driver file Move uli_init() function into existing driver fsl_uli1575.c file in order to share its code between more platforms and board files. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230409000812.18904-5-pali@kernel.org commit aa9f3d2d619b878a66dc918d8b3bf984300f975f Author: Pali Rohár Date: Sun Apr 9 02:08:07 2023 +0200 powerpc/fsl_uli1575: Simplify uli_exclude_device() usage Function uli_exclude_device() is called only from mpc86xx_exclude_device() and mpc85xx_exclude_device() functions. Both those functions are same, so merge its logic directly into the uli_exclude_device() function. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230409000812.18904-4-pali@kernel.org commit 485536b9f289c8c3c86ecaad0f05a1a7b633cb8a Author: Pali Rohár Date: Sun Apr 9 02:08:06 2023 +0200 powerpc/85xx: mpc85xx_ds: Simplify mpc85xx_exclude_device() function Function mpc85xx_exclude_device() is installed and used only when pci_with_uli is fsl_pci_primary. So replace check for pci_with_uli by fsl_pci_primary in mpc85xx_exclude_device() and move pci_with_uli variable declaration into function mpc85xx_ds_uli_init() where it is used. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230409000812.18904-3-pali@kernel.org commit 821b3a471f686910b97228010861c4a99d07fd86 Author: Christophe Leroy Date: Sun Apr 9 02:08:05 2023 +0200 powerpc/fsl_uli1575: Misc cleanup Use a single line for uli_exclude_device(). Add uli_exclude_device() prototype in ppc-pci.h and guard it. Remove that prototype from mpc85xx_ds.c and mpc86xx_hpcn.c files. Make uli_pirq_to_irq[] static as it is used only in that file. Signed-off-by: Christophe Leroy Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230409000812.18904-2-pali@kernel.org commit 648a1783fe2551f5a091c9a5f8f463cb2cbf8745 Author: Nicholas Piggin Date: Fri Apr 7 14:09:09 2023 +1000 powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU -mcpu=power10 will generate prefixed and pcrel code by default, which we do not support. The general kernel disables these with cflags, but those were missed for the boot wrapper. Fixes: 4b2a9315f20d ("powerpc/64s: POWER10 CPU Kconfig build option") Cc: stable@vger.kernel.org # v6.1+ Reported-by: Danny Tsen Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230407040909.230998-1-npiggin@gmail.com commit 71deb8a5658c592ccad5ededb2ceffef6fcbba5f Author: Bagas Sanjaya Date: Thu Apr 20 08:18:36 2023 +1000 xfs: Extend table marker on deprecated mount options table Sphinx reports htmldocs warning on deprecated mount options table: /home/bagas/repo/linux-kernel/Documentation/admin-guide/xfs.rst:243: WARNING: Malformed table. Text in column margin in table line 5. =========================== ================ Name Removal Schedule =========================== ================ Mounting with V4 filesystem September 2030 Mounting ascii-ci filesystem September 2030 ikeep/noikeep September 2025 attr2/noattr2 September 2025 =========================== ================ Extend the table markers to take account of the second name entry ("Mounting ascii-ci filesystem"), which is now the widest and to fix the above warning. Fixes: 7ba83850ca2691 ("xfs: deprecate the ascii-ci feature") Signed-off-by: Bagas Sanjaya Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 422d56536fd2ebac254e469e196c64cf53cd8a07 Author: Dave Chinner Date: Thu Apr 20 08:18:34 2023 +1000 xfs: fix duplicate includes Header files were already included, just not in the normal order. Remove the duplicates, preserving normal order. Also move xfs_ag.h include to before the scrub internal includes which are normally last in the include list. Fixes: d5c88131dbf0 ("xfs: allow queued AG intents to drain before scrubbing") Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 Author: Dai Ngo Date: Tue Apr 18 13:19:02 2023 -0700 SUNRPC: remove the maximum number of retries in call_bind_status Currently call_bind_status places a hard limit of 3 to the number of retries on EACCES error. This limit was done to prevent NLM unlock requests from being hang forever when the server keeps returning garbage. However this change causes problem for cases when NLM service takes longer than 9 seconds to register with the port mapper after a restart. This patch removes this hard coded limit and let the RPC handles the retry based on the standard hard/soft task semantics. Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests") Reported-by: Helen Chao Tested-by: Helen Chao Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit 9e05a2599a37295eb2dc5c03441daa6741abed4b Author: Ondrej Kozina Date: Tue Apr 11 11:09:31 2023 +0200 sed-opal: geometry feature reporting command Locking range start and locking range length attributes may be require to satisfy restrictions exposed by OPAL2 geometry feature reporting. Geometry reporting feature is described in TCG OPAL SSC, section 3.1.1.4 (ALIGN, LogicalBlockSize, AlignmentGranularity and LowestAlignedLBA). 4.3.5.2.1.1 RangeStart Behavior: [ StartAlignment = (RangeStart modulo AlignmentGranularity) - LowestAlignedLBA ] When processing a Set method or CreateRow method on the Locking table for a non-Global Range row, if: a) the AlignmentRequired (ALIGN above) column in the LockingInfo table is TRUE; b) RangeStart is non-zero; and c) StartAlignment is non-zero, then the method SHALL fail and return an error status code INVALID_PARAMETER. 4.3.5.2.1.2 RangeLength Behavior: If RangeStart is zero, then [ LengthAlignment = (RangeLength modulo AlignmentGranularity) - LowestAlignedLBA ] If RangeStart is non-zero, then [ LengthAlignment = (RangeLength modulo AlignmentGranularity) ] When processing a Set method or CreateRow method on the Locking table for a non-Global Range row, if: a) the AlignmentRequired (ALIGN above) column in the LockingInfo table is TRUE; b) RangeLength is non-zero; and c) LengthAlignment is non-zero, then the method SHALL fail and return an error status code INVALID_PARAMETER In userspace we stuck to logical block size reported by general block device (via sysfs or ioctl), but we can not read 'AlignmentGranularity' or 'LowestAlignedLBA' anywhere else and we need to get those values from sed-opal interface otherwise we will not be able to report or avoid locking range setup INVALID_PARAMETER errors above. Signed-off-by: Ondrej Kozina Reviewed-by: Christoph Hellwig Reviewed-by: Christian Brauner Tested-by: Milan Broz Link: https://lore.kernel.org/r/20230411090931.9193-2-okozina@redhat.com Signed-off-by: Jens Axboe commit ba7a4754da1092decbeea3b29bf7d5946f1be400 Author: Bjorn Andersson Date: Tue Apr 18 09:30:18 2023 -0700 rpmsg: glink: Consolidate TX_DATA and TX_DATA_CONT Rather than duplicating most of the code for constructing the initial TX_DATA and subsequent TX_DATA_CONT packets, roll them into a single loop. Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230418163018.785524-3-quic_bjorande@quicinc.com commit 7a68f9fa97357a0f2073c9c31ed4101da4fce93e Author: Bjorn Andersson Date: Tue Apr 18 09:30:17 2023 -0700 rpmsg: glink: Propagate TX failures in intentless mode as well As support for splitting transmission over several messages using TX_DATA_CONT was introduced it does not immediately return the return value of qcom_glink_tx(). The result is that in the intentless case (i.e. intent == NULL), the code will continue to send all additional chunks. This is wasteful, and it's possible that the send operation could incorrectly indicate success, if the last chunk fits in the TX fifo. Fix the condition. Fixes: 8956927faed3 ("rpmsg: glink: Add TX_DATA_CONT command while sending") Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230418163018.785524-2-quic_bjorande@quicinc.com commit c05dfce0b89e3b58043805b6f4bdf30e3561d867 Author: Bjorn Andersson Date: Mon Mar 27 07:46:17 2023 -0700 rpmsg: glink: Wait for intent, not just request ack In some implementations of the remote firmware, an intent request acknowledgment is sent when it's determined if the intent allocation will be fulfilled, but then the intent is queued after the acknowledgment. The result is that upon receiving a granted allocation request, the search for the newly allocated intent will fail and an additional request will be made. This will at best waste memory, but if the second request is rejected the transaction will be incorrectly rejected. Take the incoming intent into account in the wait to mitigate this problem. The above scenario can still happen, in the case that, on that same channel, an unrelated intent is delivered prior to the request acknowledgment and a separate process enters the send path and picks up the intent. Given that there's no relationship between the acknowledgment and the delivered (or to be delivered intent), there doesn't seem to be a solution to this problem. Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew [bjorn: Fixed spelling issues pointed out by checkpatch in commit message] Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230327144617.3134175-3-quic_bjorande@quicinc.com commit 0a7eee89e79eb8b97d46e1e0001b9e2709795af5 Author: Bjorn Andersson Date: Mon Mar 27 07:46:16 2023 -0700 rpmsg: glink: Transition intent request signaling to wait queue Transition the intent request acknowledgement to use a wait queue so that it's possible, in the next commit, to extend the wait to also wait for an incoming intent. Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230327144617.3134175-2-quic_bjorande@quicinc.com commit 265b0de2f0f293f98173abb336edb63921b9c282 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 16:30:05 2023 -0300 perf probe: Add missing 0x prefix for addresses printed in hexadecimal To fix this confusing warning: # perf probe -l Failed to find debug information for address 798240 probe_main:prometheus_new_counter__return (on github.com/prometheus/client_golang/prometheus.NewCounter%return in /home/acme/git/prometheus-uprobes/main with counter) # As that 798240 is printed with PRIx64 but has no letters, better print the 0x prefix to disambiguate. Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZEBCyFu2GjTw6qOi@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7227aacb62aeb59b007a6d3489b11f78fa332696 Merge: 38f1aa5566730 ec185b18c2232 Author: Miquel Raynal Date: Wed Apr 19 20:38:54 2023 +0200 Merge tag 'nand/for-6.4' into mtd/next Raw NAND core changes: * Convert to platform remove callback returning void * Fix spelling mistake waifunc() -> waitfunc() Raw NAND controller driver changes: * imx: Remove unused is_imx51_nfc and imx53_nfc functions * omap2: Drop obsolete dependency on COMPILE_TEST * orion: Use devm_platform_ioremap_resource() * qcom: - Use of_property_present() for testing DT property presence - Use devm_platform_get_and_ioremap_resource() * stm32_fmc2: Depends on ARCH_STM32 instead of MACH_STM32MP157 * tmio: Remove reference to config MTD_NAND_TMIO in the parsers Raw NAND manufacturer driver changes: * hynix: Fix up bit 0 of sdr_timing_mode SPI-NAND changes: * Add support for ESMT F50x1G41LB Signed-off-by: Miquel Raynal commit 38f1aa5566730cdc5e09ec982c80489d87f0f0a7 Merge: e6026eb080fa1 df6def86b9dcb Author: Miquel Raynal Date: Wed Apr 19 20:38:10 2023 +0200 Merge tag 'spi-nor/for-6.4' into mtd/next SPI NOR core changes: * introduce Read While Write support for flashes featuring several banks * set the 4-Byte Address Mode method based on SFDP data * allow post_sfdp hook to return errors * parse SCCR MC table and introduce support for multi-chip devices SPI NOR manufacturer drivers changes: * macronix: add support for mx25uw51245g with RWW * spansion: - determine current address mode at runtime as it can be changed in a non-volatile way and differ from factory defaults or from what SFDP advertises. - enable JFFS2 write buffer mode for few ECC'd NOR flashes: S25FS256T, s25hx and s28hx - add support for s25hl02gt and s25hs02gt Signed-off-by: Miquel Raynal commit 8e4c62c7d980eaf0f64c1c0ef0c80f5685af0fb6 Author: Jakub Kicinski Date: Mon Apr 17 08:28:05 2023 -0700 page_pool: add DMA_ATTR_WEAK_ORDERING on all mappings Commit c519fe9a4f0d ("bnxt: add dma mapping attributes") added DMA_ATTR_WEAK_ORDERING to DMA attrs on bnxt. It has since spread to a few more drivers (possibly as a copy'n'paste). DMA_ATTR_WEAK_ORDERING only seems to matter on Sparc and PowerPC/cell, the rarity of these platforms is likely why we never bothered adding the attribute in the page pool, even though it should be safe to add. To make the page pool migration in drivers which set this flag less of a risk (of regressing the precious sparc database workloads or whatever needed this) let's add DMA_ATTR_WEAK_ORDERING on all page pool DMA mappings. We could make this a driver opt-in but frankly I don't think it's worth complicating the API. I can't think of a reason why device accesses to packet memory would have to be ordered. Acked-by: Ilias Apalodimas Acked-by: Somnath Kotur Reviewed-by: Alexander Lobakin Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/20230417152805.331865-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 686c511866b4634734be9d6e827e4e55b877d35e Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 13:47:03 2023 -0300 perf build: Test the refcnt check build Make sure we test build the currently added REFCNT_CHECKING infrastructure. Signed-off-by: Arnaldo Carvalho de Melo commit 2832ef81d4c75d4f0e3945bd2cb0b7012313cbb3 Author: Ian Rogers Date: Wed Apr 19 12:57:53 2023 -0300 perf map: Add reference count checking There's no strict get/put policy with map that leads to leaks or use after free. Reference count checking identifies correct pairing of gets and puts. Committer notes: Extracted from a larger patch removing bits that were covered by the use of pre-existing map__ accessors (e.g. maps__nr_maps()) and new ones added (map__refcnt() and the maps__set_ ones) to reduce RC_CHK_ACCESS(maps)-> source code pollution. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexey Bayduraev Cc: Dmitriy Vyukov Cc: Jiri Olsa Cc: Namhyung Kim Cc: Riccardo Mancini Cc: Stephane Eranian Cc: Stephen Brennan Link: https://lore.kernel.org/lkml/20230407230405.2931830-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e6a9efcee55f084a5450e4853ecbbaa0b086dcd0 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 12:24:12 2023 -0300 perf map: Add set_ methods for map->{start,end,pgoff,pgoff,reloc,erange_warned,dso,map_ip,unmap_ip,priv} To have a way to intercept usage of the reference counted struct map. Signed-off-by: Arnaldo Carvalho de Melo commit 38d11da522aacaa05898c734a1cec86f1e611129 Author: Li Lingfeng Date: Tue Apr 18 16:38:04 2023 +0800 dm: don't lock fs when the map is NULL in process of resume Commit fa247089de99 ("dm: requeue IO if mapping table not yet available") added a detection of whether the mapping table is available in the IO submission process. If the mapping table is unavailable, it returns BLK_STS_RESOURCE and requeues the IO. This can lead to the following deadlock problem: dm create mount ioctl(DM_DEV_CREATE_CMD) ioctl(DM_TABLE_LOAD_CMD) do_mount vfs_get_tree ext4_get_tree get_tree_bdev sget_fc alloc_super // got &s->s_umount down_write_nested(&s->s_umount, ...); ext4_fill_super ext4_load_super ext4_read_bh submit_bio // submit and wait io end ioctl(DM_DEV_SUSPEND_CMD) dev_suspend do_resume dm_suspend __dm_suspend lock_fs freeze_bdev get_active_super grab_super // wait for &s->s_umount down_write(&s->s_umount); dm_swap_table __bind // set md->map(can't get here) IO will be continuously requeued while holding the lock since mapping table is NULL. At the same time, mapping table won't be set since the lock is not available. Like request-based DM, bio-based DM also has the same problem. It's not proper to just abort IO if the mapping table not available. So clear DM_SKIP_LOCKFS_FLAG when the mapping table is NULL, this allows the DM table to be loaded and the IO submitted upon resume. Fixes: fa247089de99 ("dm: requeue IO if mapping table not yet available") Cc: stable@vger.kernel.org Signed-off-by: Li Lingfeng Signed-off-by: Mike Snitzer commit e1805aae1e0f648351913e7f5a8a7530a90c8634 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 10:57:57 2023 -0300 perf map: Add missing conversions to map__refcnt() Some conversions weren't performed in 4e8db2d7520f780f ("perf map: Add map__refcnt() accessor to use in the maps test"), fix it. Signed-off-by: Arnaldo Carvalho de Melo commit 0ae241f4d7d0003f091df6f8d1f45767c3d96d62 Author: Heiko Carstens Date: Mon Apr 17 14:45:17 2023 +0200 s390/relocate_kernel: adjust indentation relocate_kernel.S seems to be the only assembler file which doesn't follow the standard way of indentation. Adjust this for the sake of consistency. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 680957b3b8b0b2e8697592fcb77369d4f643908a Author: Heiko Carstens Date: Mon Apr 17 14:45:16 2023 +0200 s390/relocate_kernel: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit fda1dffa44b0ea657e413f1e548022e3f0269592 Author: Heiko Carstens Date: Mon Apr 17 14:45:15 2023 +0200 s390/entry: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 04b6d02dbecdda5d15aa55edbae2f0e1eb81749e Author: Heiko Carstens Date: Mon Apr 17 14:45:14 2023 +0200 s390/purgatory: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 6cea5f0bc93dffc74f0fa8cad7680b5ad21d1961 Author: Heiko Carstens Date: Mon Apr 17 14:45:13 2023 +0200 s390/kprobes: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 26d14299220ab8e1d4fb166d8e66dd4a43097ec1 Author: Heiko Carstens Date: Mon Apr 17 14:45:12 2023 +0200 s390/reipl: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 05d0935d12966686eb1d780e3f929727e9fa500d Author: Heiko Carstens Date: Mon Apr 17 14:45:11 2023 +0200 s390/head64: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit a89d60fc7a9ad544a30251d238a5f35d023754d1 Author: Heiko Carstens Date: Mon Apr 17 14:45:10 2023 +0200 s390/earlypgm: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit aaaac068f0d2d137b7fcad47d4cebbd24bf060ae Author: Heiko Carstens Date: Mon Apr 17 14:45:09 2023 +0200 s390/mcount: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit b5f3c99d15725d78a2e720ca48ab47a43bd1b5cb Author: Heiko Carstens Date: Mon Apr 17 14:45:08 2023 +0200 s390/crc32le: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 4b788ac8ed39686f7810733c16521a7b91e005c1 Author: Heiko Carstens Date: Mon Apr 17 14:45:07 2023 +0200 s390/crc32be: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 3e5e5107b7c6efe319069272a68a4d0ec8bce7fb Author: Heiko Carstens Date: Mon Apr 17 14:45:06 2023 +0200 s390/crypto,chacha: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Acked-by: Harald Freudenberger Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit ac0c06a1dc8702209e651975ce6f54715f7321c8 Author: Heiko Carstens Date: Mon Apr 17 14:45:05 2023 +0200 s390/amode31: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 45769052ae77c0fb0f846c151bb0a845cf5d4237 Author: Heiko Carstens Date: Mon Apr 17 14:45:04 2023 +0200 s390/lib: use SYM* macros instead of ENTRY(), etc. Consistently use the SYM* family of macros instead of the deprecated ENTRY(), ENDPROC(), etc. family of macros. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit e48b6853d81b6b48dc238d328700536b425c8e70 Author: Heiko Carstens Date: Sun Apr 16 20:15:17 2023 +0200 s390/kasan: remove override of mem*() functions The kasan mem*() functions are not used anymore since s390 has switched to GENERIC_ENTRY and commit 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*() functions"). Therefore remove the now dead code, similar to x86. While at it also use the SYM* macros in mem.S. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 2d1b21eceaf0765d60b543b2b8e26c2f55517259 Author: Alexander Gordeev Date: Mon Apr 3 08:44:40 2023 +0200 s390/kdump: remove nodat stack restriction for calling nodat functions To allow calling of DAT-off code from kernel the stack needs to be switched to nodat_stack (or other stack mapped as 1:1). Before call_nodat() macro was introduced that was necessary to provide the very same memory address for STNSM and STOSM instructions. If the kernel would stay on a random stack (e.g. a virtually mapped one) then a virtual address provided for STNSM instruction could differ from the physical address needed for the corresponding STOSM instruction. After call_nodat() macro is introduced the kernel stack does not need to be mapped 1:1 anymore, since the macro stores the physical memory address of return PSW in a register before entering DAT-off mode. This way the return LPSWE instruction is able to pick the correct memory location and restore the DAT-on mode. That however might fail in case the 16-byte return PSW happened to cross page boundary: PSW mask and PSW address could end up in two separate non-contiguous physical pages. Align the return PSW on 16-byte boundary so it always fits into a single physical page. As result any stack (including the virtually mapped one) could be used for calling DAT-off code and prior switching to nodat_stack becomes unnecessary. Signed-off-by: Alexander Gordeev Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 82caf7aba107dbc0e70c330786bed9961a098ab0 Author: Alexander Gordeev Date: Mon Apr 3 08:44:39 2023 +0200 s390/kdump: rework invocation of DAT-off code Calling kdump kernel is a two-step process that involves invocation of the purgatory code: first time - to verify the new kernel checksum and second time - to call the new kernel itself. The purgatory code operates on real addresses and does not expect any memory protection. Therefore, before the purgatory code is entered the DAT mode is always turned off. However, it is only restored upon return from the new kernel checksum verification. In case the purgatory was called to start the new kernel and failed the control is returned to the old kernel, but the DAT mode continues staying off. The new kernel start failure is unlikely and leads to the disabled wait state anyway. Still that poses a risk, since the kernel code in general is not DAT-off safe and even calling the disabled_wait() function might crash. Introduce call_nodat() macro that allows entering DAT-off mode, calling an arbitrary function and restoring DAT mode back on. Switch all invocations of DAT-off code to that macro and avoid the above described scenario altogether. Name the call_nodat() macro in small letters after the already existing call_on_stack() and put it to the same header file. Signed-off-by: Alexander Gordeev Reviewed-by: Heiko Carstens [hca@linux.ibm.com: some small modifications to call_nodat() macro] Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 39218bcf941ab1a5eabbf350c0f7a1f1325434b0 Author: Alexander Gordeev Date: Mon Apr 3 08:44:38 2023 +0200 s390/kdump: fix virtual vs physical address confusion Fix virtual vs physical address confusion (which currently are the same). Signed-off-by: Alexander Gordeev Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 86295cb4530dfbc2315ca5997502dad03748e5dd Author: Alexander Gordeev Date: Mon Apr 3 08:44:37 2023 +0200 s390/kdump: cleanup do_start_kdump() prototype and usage Avoid unnecessary run-time and compile-time type conversions of do_start_kdump() function return value and parameter. Signed-off-by: Alexander Gordeev Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7a04d491edf4766e7724671355b1ab27cae81a4a Author: Alexander Gordeev Date: Mon Apr 3 08:44:36 2023 +0200 s390/kexec: turn DAT mode off immediately before purgatory The kernel code is not guaranteed DAT-off mode safe. Turn the DAT mode off immediately before entering the purgatory. Further, to avoid subtle side effects reset the system immediately before turning DAT mode off while making all necessary preparations in advance. Signed-off-by: Alexander Gordeev Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit aa7d7bc99fed71664e9a241b32294ee15a88d938 Author: Mikulas Patocka Date: Tue Apr 18 15:56:41 2023 -0400 dm flakey: add an "error_reads" option dm-flakey returns error on reads if no other argument is specified. This commit simplifies associated logic while formalizing an "error_reads" argument and an ERROR_READS flag. If no argument is specified, set ERROR_READS flag so that it behaves just like before this commit. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit e3675dc1e7ea2e4e5a6527fa7068e9fcbc2475cc Author: Mikulas Patocka Date: Tue Apr 18 15:56:09 2023 -0400 dm flakey: remove trailing space in the table line Don't return a trailing space in the output of STATUSTYPE_TABLE. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 98dba02d9a93eec11bffbb93c7c51624290702d2 Author: Mikulas Patocka Date: Tue Apr 18 15:57:47 2023 -0400 dm flakey: fix a crash with invalid table line This command will crash with NULL pointer dereference: dmsetup create flakey --table \ "0 `blockdev --getsize /dev/ram0` flakey /dev/ram0 0 0 1 2 corrupt_bio_byte 512" Fix the crash by checking if arg_name is non-NULL before comparing it. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 1a33aee1dc2476c5937a0890f2dfc228a165f364 Author: Thomas Richter Date: Thu Apr 6 11:40:42 2023 +0200 s390/cpum_cf: remove function validate_ctr_auth() by inline code Remove function validate_ctr_auth() and replace this very small function by its body. No functional change. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Acked-by: Sumanth Korikkar Signed-off-by: Vasily Gorbik commit 9ae9b868aeaad377f6315d7196a43e8827e24cb3 Author: Thomas Richter Date: Thu Apr 6 11:32:18 2023 +0200 s390/cpum_cf: provide counter number to validate_ctr_version() Function validate_ctr_version() first parameter is a pointer to a large structure, but only member hw_perf_event::config is used. Supply this structure member value in the function invocation. No functional change. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Acked-by: Sumanth Korikkar Signed-off-by: Vasily Gorbik commit 46c4d945ea1f9beebf49148b0d4aafb44e41ceb6 Author: Thomas Richter Date: Tue Apr 4 14:47:55 2023 +0200 s390/cpum_cf: introduce static CPU counter facility information The CPU measurement facility counter information instruction qctri() retrieves information about the available counter sets. The information varies between machine generations, but is constant when running on a particular machine. For example the CPU measurement facility counter first and second version numbers determine the amount of counters in a counter set. This information never changes. The counter sets are identical for all CPUs in the system. It does not matter which CPU performs the instruction. Authorization control of the CPU Measurement facility can only be changed in the activation profile while the LPAR is not running. Retrieve the CPU measurement counter information at device driver initialization time and use its constant values. Function validate_ctr_version() verifies if a user provided CPU Measurement counter facility counter is valid and defined. It now uses the newly introduced static CPU counter facility information. To avoid repeated recalculation of the counter set sizes (numbers of counters per set), which never changes on a running machine, calculate the counter set size once at device driver initialization and store the result in an array. Functions cpum_cf_make_setsize() and cpum_cf_read_setsize() are introduced. Finally remove cpu_cf_events::info member and use the static CPU counter facility information instead. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Acked-by: Sumanth Korikkar Signed-off-by: Vasily Gorbik commit 310c33dc7a1278d80ba717b9964bd478d52681e0 Merge: 2667e3673f707 559d1e45a16dc Author: Palmer Dabbelt Date: Wed Apr 19 07:47:45 2023 -0700 Merge patch series "Introduce 64b relocatable kernel" Alexandre Ghiti says: After multiple attempts, this patchset is now based on the fact that the 64b kernel mapping was moved outside the linear mapping. The first patch allows to build relocatable kernels but is not selected by default. That patch is a requirement for KASLR. The second and third patches take advantage of an already existing powerpc script that checks relocations at compile-time, and uses it for riscv. * b4-shazam-merge: riscv: Use --emit-relocs in order to move .rela.dyn in init riscv: Check relocations at compile time powerpc: Move script to check relocations at compile time in scripts/ riscv: Introduce CONFIG_RELOCATABLE riscv: Move .rela.dyn outside of init to avoid empty relocations riscv: Prepare EFI header for relocatable kernels Link: https://lore.kernel.org/r/20230329045329.64565-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 3b42877cd53ad4a1b1e3875a0fe537c9c517e635 Author: Harald Freudenberger Date: Fri Apr 14 17:33:19 2023 +0200 s390/zcrypt: rework arrays with length zero occurrences Review and rework all the zero length array occurrences within structs to flexible array fields or comment if not used at all. However, some struct fields are there for documentation purpose or to have correct sizeof() evaluation of a struct and thus should not get deleted. Signed-off-by: Harald Freudenberger Acked-by: Heiko Carstens Reviewed-by: Holger Dengler Signed-off-by: Vasily Gorbik commit 559d1e45a16dcf1542e430ea3dce9ab625be98d0 Author: Alexandre Ghiti Date: Wed Mar 29 06:53:29 2023 +0200 riscv: Use --emit-relocs in order to move .rela.dyn in init To circumvent an issue where placing the relocations inside the init sections produces empty relocations, use --emit-relocs. But to avoid carrying those relocations in vmlinux, use an intermediate vmlinux.relocs file which is a copy of vmlinux *before* stripping its relocations. Suggested-by: Björn Töpel Suggested-by: Nick Desaulniers Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230329045329.64565-7-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit c2dea0bc53397166a77811d9b66928643a83d6f3 Author: Alexandre Ghiti Date: Wed Mar 29 06:53:28 2023 +0200 riscv: Check relocations at compile time Relocating kernel at runtime is done very early in the boot process, so it is not convenient to check for relocations there and react in case a relocation was not expected. There exists a script in scripts/ that extracts the relocations from vmlinux that is then used at postlink to check the relocations. Signed-off-by: Alexandre Ghiti Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20230329045329.64565-6-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 47981b5cc6871d78aee67b6c9ae70aff90ddb97d Author: Alexandre Ghiti Date: Wed Mar 29 06:53:27 2023 +0200 powerpc: Move script to check relocations at compile time in scripts/ Relocating kernel at runtime is done very early in the boot process, so it is not convenient to check for relocations there and react in case a relocation was not expected. Powerpc architecture has a script that allows to check at compile time for such unexpected relocations: extract the common logic to scripts/ so that other architectures can take advantage of it. Signed-off-by: Alexandre Ghiti Reviewed-by: Anup Patel Acked-by: Michael Ellerman (powerpc) Link: https://lore.kernel.org/r/20230329045329.64565-5-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 39b33072941f8bab82aa2c802044062385a046bf Author: Alexandre Ghiti Date: Wed Mar 29 06:53:26 2023 +0200 riscv: Introduce CONFIG_RELOCATABLE This config allows to compile 64b kernel as PIE and to relocate it at any virtual address at runtime: this paves the way to KASLR. Runtime relocation is possible since relocation metadata are embedded into the kernel. Note that relocating at runtime introduces an overhead even if the kernel is loaded at the same address it was linked at and that the compiler options are those used in arm64 which uses the same RELA relocation format. Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230329045329.64565-4-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 69a90d2fe107c8bf6a424af0f30d2b223cdeaf7c Author: Alexandre Ghiti Date: Wed Mar 29 06:53:25 2023 +0200 riscv: Move .rela.dyn outside of init to avoid empty relocations This is a preparatory patch for relocatable kernels: .rela.dyn should be in .init but doing so actually produces empty relocations, so this should be a temporary commit until we find a solution. This issue was reported here [1]. [1] https://lore.kernel.org/all/4a6fc7a3-9697-a49b-0941-97f32194b0d7@ghiti.fr/. Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230329045329.64565-3-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 55de1e4ad43b375566162ae0cc2b56dfa44aae4e Author: Alexandre Ghiti Date: Wed Mar 29 06:53:24 2023 +0200 riscv: Prepare EFI header for relocatable kernels ld does not handle relocations correctly as explained here [1], a fix for that was proposed by Nelson there but we have to support older toolchains and then provide this fix. Note that llvm does not need this fix and is then excluded. [1] https://sourceware.org/pipermail/binutils/2023-March/126690.html Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230329045329.64565-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 09cda705860125ffee1b1359b1da79f8e0c77a40 Author: Shengjiu Wang Date: Wed Apr 19 18:29:18 2023 +0800 ASoC: fsl: Restore configuration of platform This reverts commit 33683cbf49b54 ("ASoC: fsl: remove unnecessary dai_link->platform"). dai_link->platform is needed. The platform component is "snd_dmaengine_pcm", which is registered from cpu driver, If dai_link->platform is not assigned, then platform component will not be probed, then there will be issue: aplay: main:831: audio open error: Invalid argument Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1681900158-17428-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 2ddade322925641ee2a75f13665c51f2e74d7791 Author: Magnus Karlsson Date: Tue Apr 18 16:36:17 2023 +0200 selftests/xsk: Fix munmap for hugepage allocated umem Fix the unmapping of hugepage allocated umems so that they are properly unmapped. The new test referred to in the fixes label, introduced a test that allocated a umem that is not a multiple of a 2M hugepage size. This is fine for mmap() that rounds the size up the nearest multiple of 2M. But munmap() requires the size to be a multiple of the hugepage size in order for it to unmap the region. The current behaviour of not properly unmapping the umem, was discovered when further additions of tests that require hugepages (unaligned mode tests only) started failing as the system was running out of hugepages. Fixes: c0801598e543 ("selftests: xsk: Add test UNALIGNED_INV_DESC_4K1_FRAME_SIZE") Signed-off-by: Magnus Karlsson Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230418143617.27762-1-magnus.karlsson@gmail.com commit b100722a777f6455d913666a376f81342b2cb995 Author: Muna Sinada Date: Mon Apr 17 13:22:27 2023 -0700 wifi: ath11k: Remove disabling of 80+80 and 160 MHz This is a regression fix for 80+80 and 160 MHz support bits being cleared, therefore not adverised. Remove disable of 80+80 and 160 MHz capability flags and assign valid center frequency 2 similar to VHT80_80. Fixes: 38dfe775d0ab ("wifi: ath11k: push MU-MIMO params from hostapd to hardware") Reported-by: Robert Marko Tested-by: Robert Marko # IPQ8074 WLAN.HK.2.9.0.1-01385-QCAHKSWPL_SILICONZ-1 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217299 Co-developed-by: P Praneesh Signed-off-by: P Praneesh Signed-off-by: Muna Sinada Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1681762947-13882-1-git-send-email-quic_msinada@quicinc.com commit 2c69679626d5daa680d71c77ad58af0088db537f Author: Imre Deak Date: Fri Apr 14 20:38:00 2023 +0300 drm/i915/dp_mst: Fix active port PLL selection for secondary MST streams The port PLL selection needs to be up-to-date in the CRTC state of both the primary and all secondary MST streams. The commit removing the encoder update_prepare/complete hooks (see Fixes: below), stopped doing this for secondary streams, fix this up. Fixes: 0f752b2178c9 ("drm/i915: Remove the encoder update_prepare()/complete() hooks") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8336 Cc: Mika Kahola Signed-off-by: Imre Deak Reviewed-by: Mika Kahola Link: https://patchwork.freedesktop.org/patch/msgid/20230414173800.590790-1-imre.deak@intel.com (cherry picked from commit 27ac123b454417ea92d77c13a5d94655f53b759c) Signed-off-by: Joonas Lahtinen commit 2667e3673f7079cf95d58cf84d7c0b5a455ac68b Merge: 2e75ab3189ecf 864046c512c2c Author: Palmer Dabbelt Date: Wed Apr 19 07:24:56 2023 -0700 Merge patch series "RISC-V kasan rework" Alexandre Ghiti says: As described in patch 2, our current kasan implementation is intricate, so I tried to simplify the implementation and mimic what arm64/x86 are doing. In addition it fixes UEFI bootflow with a kasan kernel and kasan inline instrumentation: all kasan configurations were tested on a large ubuntu kernel with success with KASAN_KUNIT_TEST and KASAN_MODULE_TEST. inline ubuntu config + uefi: sv39: OK sv48: OK sv57: OK outline ubuntu config + uefi: sv39: OK sv48: OK sv57: OK Actually 1 test always fails with KASAN_KUNIT_TEST that I have to check: KASAN failure expected in "set_bit(nr, addr)", but none occurrred Note that Palmer recently proposed to remove COMMAND_LINE_SIZE from the userspace abi https://lore.kernel.org/lkml/20221211061358.28035-1-palmer@rivosinc.com/T/ so that we can finally increase the command line to fit all kasan kernel parameters. All of this should hopefully fix the syzkaller riscv build that has been failing for a few months now, any test is appreciated and if I can help in any way, please ask. * b4-shazam-merge: riscv: Unconditionnally select KASAN_VMALLOC if KASAN riscv: Fix ptdump when KASAN is enabled riscv: Fix EFI stub usage of KASAN instrumented strcmp function riscv: Move DTB_EARLY_BASE_VA to the kernel address space riscv: Rework kasan population functions riscv: Split early and final KASAN population functions Link: https://lore.kernel.org/r/20230203075232.274282-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 864046c512c2cd8418dc928b91981fb12a80396c Author: Alexandre Ghiti Date: Fri Feb 3 08:52:32 2023 +0100 riscv: Unconditionnally select KASAN_VMALLOC if KASAN If KASAN is enabled, VMAP_STACK depends on KASAN_VMALLOC so enable KASAN_VMALLOC with KASAN so that we can enable VMAP_STACK by default. Signed-off-by: Alexandre Ghiti Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230203075232.274282-7-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit ecd7ebaf0b5a094a6180b299a5635c0eea42be4b Author: Alexandre Ghiti Date: Fri Feb 3 08:52:31 2023 +0100 riscv: Fix ptdump when KASAN is enabled The KASAN shadow region was moved next to the kernel mapping but the ptdump code was not updated and it appears to break the dump of the kernel page table, so fix this by moving the KASAN shadow region in ptdump. Fixes: f7ae02333d13 ("riscv: Move KASAN mapping next to the kernel mapping") Signed-off-by: Alexandre Ghiti Tested-by: Björn Töpel Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230203075232.274282-6-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 617955ca6e275c4dd0dcf5316fca7fc04a8f2fe6 Author: Alexandre Ghiti Date: Fri Feb 3 08:52:30 2023 +0100 riscv: Fix EFI stub usage of KASAN instrumented strcmp function The EFI stub must not use any KASAN instrumented code as the kernel proper did not initialize the thread pointer and the mapping for the KASAN shadow region. Avoid using the generic strcmp function, instead use the one in drivers/firmware/efi/libstub/string.c. Signed-off-by: Alexandre Ghiti Acked-by: Ard Biesheuvel Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20230203075232.274282-5-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 401e84488800d05e8ed6db2a687eaa94415f4ec8 Author: Alexandre Ghiti Date: Fri Feb 3 08:52:29 2023 +0100 riscv: Move DTB_EARLY_BASE_VA to the kernel address space The early virtual address should lie in the kernel address space for inline kasan instrumentation to succeed, otherwise kasan tries to dereference an address that does not exist in the address space (since kasan only maps *kernel* address space, not the userspace). Simply use the very first address of the kernel address space for the early fdt mapping. It allowed an Ubuntu kernel to boot successfully with inline instrumentation. Signed-off-by: Alexandre Ghiti Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230203075232.274282-4-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 96f9d4daf745205fe869e9e5ac23199ef11c5448 Author: Alexandre Ghiti Date: Fri Feb 3 08:52:28 2023 +0100 riscv: Rework kasan population functions Our previous kasan population implementation used to have the final kasan shadow region mapped with kasan_early_shadow_page, because we did not clean the early mapping and then we had to populate the kasan region "in-place" which made the code cumbersome. So now we clear the early mapping, establish a temporary mapping while we populate the kasan shadow region with just the kernel regions that will be used. This new version uses the "generic" way of going through a page table that may be folded at runtime (avoid the XXX_next macros). It was tested with outline instrumentation on an Ubuntu kernel configuration successfully. Signed-off-by: Alexandre Ghiti Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230203075232.274282-3-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit cd0334e1c091fc0263ccf76e81d333a2ece4f3ab Author: Alexandre Ghiti Date: Fri Feb 3 08:52:27 2023 +0100 riscv: Split early and final KASAN population functions This is a preliminary work that allows to make the code more understandable. Signed-off-by: Alexandre Ghiti Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230203075232.274282-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit b956e3110a797a3663f91f9b8935b667cc23fe72 Author: Toke Høiland-Jørgensen Date: Mon Apr 17 13:35:03 2023 +0300 wifi: ath9k: Don't mark channelmap stack variable read-only in ath9k_mci_update_wlan_channels() This partially reverts commit e161d4b60ae3a5356e07202e0bfedb5fad82c6aa. Turns out the channelmap variable is not actually read-only, it's modified through the MCI_GPM_CLR_CHANNEL_BIT() macro further down in the function, so making it read-only causes page faults when that code is hit. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217183 Fixes: e161d4b60ae3 ("wifi: ath9k: Make arrays prof_prio and channelmap static const") Cc: stable@vger.kernel.org Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230413214118.153781-1-toke@toke.dk commit f9fff67d2d7ca6fa8066132003a3deef654c55b1 Author: Nagarajan Maran Date: Mon Apr 17 13:35:02 2023 +0300 wifi: ath11k: Fix SKB corruption in REO destination ring While running traffics for a long time, randomly an RX descriptor filled with value "0" from REO destination ring is received. This descriptor which is invalid causes the wrong SKB (SKB stored in the IDR lookup with buffer id "0") to be fetched which in turn causes SKB memory corruption issue and the same leads to crash after some time. Changed the start id for idr allocation to "1" and the buffer id "0" is reserved for error validation. Introduced Sanity check to validate the descriptor, before processing the SKB. Crash Signature : Unable to handle kernel paging request at virtual address 3f004900 PC points to "b15_dma_inv_range+0x30/0x50" LR points to "dma_cache_maint_page+0x8c/0x128". The Backtrace obtained is as follows: [<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128) [<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc) [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k]) [<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k]) [<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci]) [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8) [<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280) [<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280) [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4) [<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4) [<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90) [<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Nagarajan Maran Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230403191533.28114-1-quic_nmaran@quicinc.com commit 2f0c9ac8362da09c80f1cd422ef7fd6fa9b252b9 Author: Pradeep Kumar Chitrapu Date: Mon Apr 17 13:35:02 2023 +0300 wifi: ath11k: Fix incorrect update of radiotap fields Fix incorrect update of ppdu stats causing incorrect radiotap fields. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Pradeep Kumar Chitrapu Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230403195738.25367-3-quic_pradeepc@quicinc.com commit 6257c702264c44d74c6b71f0c62a7665da2dc356 Author: Pradeep Kumar Chitrapu Date: Mon Apr 17 13:35:02 2023 +0300 wifi: ath11k: fix tx status reporting in encap offload mode ieee80211_tx_status() treats packets in 802.11 frame format and tries to extract sta address from packet header. When tx encap offload is enabled, this becomes invalid operation. Hence, switch to using ieee80211_tx_status_ext() after filling in station address for handling both 802.11 and 802.3 frames. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Pradeep Kumar Chitrapu Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230403195738.25367-2-quic_pradeepc@quicinc.com commit 20487cc3ff36bbfa9505f0a078ba98f09abfc717 Author: Harshitha Prem Date: Mon Apr 17 13:35:01 2023 +0300 wifi: ath11k: add peer mac information in failure cases During reo command failure, the peer mac detail for which the reo command was not successful is unknown. Hence, to improve the debuggability, add the peer mac information in the failure cases which would be useful during multi client cases. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sathishkumar Muruganandam Signed-off-by: Harshitha Prem Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230403182420.23375-4-quic_hprem@quicinc.com commit a8ae833657a45746debde85c38bb7f070d344026 Author: Harshitha Prem Date: Mon Apr 17 13:35:01 2023 +0300 wifi: ath11k: Prevent REO cmd failures Prevent REO cmd failures causing double free by increasing REO cmd ring size and moving REO status ring mask to IRQ group 3 from group 0 to separate from tx completion ring on IRQ group 0 which may delay reo status processing. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sathishkumar Muruganandam Signed-off-by: Harshitha Prem Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230403182420.23375-3-quic_hprem@quicinc.com commit 93a91f40c25c3d0e61f8540a7accf105090f9995 Author: Harshitha Prem Date: Mon Apr 17 13:35:00 2023 +0300 wifi: ath11k: fix double free of peer rx_tid during reo cmd failure Peer rx_tid is locally copied thrice during peer_rx_tid_cleanup to send REO_CMD_UPDATE_RX_QUEUE followed by REO_CMD_FLUSH_CACHE to flush all aged REO descriptors from HW cache. When sending REO_CMD_FLUSH_CACHE fails, we do dma unmap of already mapped rx_tid->vaddr and free it. This is not checked during reo_cmd_list_cleanup() and dp_reo_cmd_free() before trying to free and unmap again. Fix this by setting rx_tid->vaddr NULL in rx tid delete and also wherever freeing it to check in reo_cmd_list_cleanup() and reo_cmd_free() before trying to free again. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sathishkumar Muruganandam Signed-off-by: Harshitha Prem Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230403182420.23375-2-quic_hprem@quicinc.com commit ed09c61eb19d9889780c791cb316ac76468f5186 Author: Konrad Dybcio Date: Mon Apr 17 13:35:00 2023 +0300 dt-bindings: net: Convert ath10k to YAML Convert the ath10k bindings to YAML. Dropped properties that are absent at the current state of mainline: - qcom,msi_addr - qcom,msi_base Somewhat based on the ath11k bindings. Signed-off-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230406-topic-ath10k_bindings-v4-1-9f67a6bb0d56@linaro.org commit 9989b3c0ff9771760c103d46e6b5e8645fd3d836 Author: Frank Crawford Date: Sun Apr 16 14:25:07 2023 +1000 hwmon: (it87) Disable SMBus access for environmental controller registers. Add functions to disable and re-enable access by the SMBus for specific chips. Signed-off-by: Frank Crawford Signed-off-by: Guenter Roeck commit 7a46c0cb473f05fe61edf26aa5509aa555dcd9be Author: Lakshmi Yadlapati Date: Thu Apr 13 08:26:26 2023 -0500 docs: hwmon: Add documentaion for acbel-fsg032 PSU Add documentation changes for acbel-fsg032 psu Signed-off-by: Lakshmi Yadlapati Link: https://lore.kernel.org/r/20230413132627.3444119-5-lakshmiy@us.ibm.com [groeck: Fixed alphabetic order in index.rst] Signed-off-by: Guenter Roeck commit d89d6c093acdf4545a89ded625686ee6e8db4634 Author: Lakshmi Yadlapati Date: Thu Apr 13 08:26:25 2023 -0500 hwmon: (pmbus/acbel-fsg032) Add Acbel power supply Add the driver to support ACBEL FSG032 power supply. Signed-off-by: Lakshmi Yadlapati Link: https://lore.kernel.org/r/20230413132627.3444119-4-lakshmiy@us.ibm.com Signed-off-by: Guenter Roeck commit b0cda2cc85686d5cd30a874f2caf9c6c34958cd1 Author: Lakshmi Yadlapati Date: Thu Apr 13 08:26:24 2023 -0500 dt-bindings: trivial-devices: Add acbel,fsg032 Add new Acbel FSG032 power supply to trivial devices. Signed-off-by: Lakshmi Yadlapati Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230413132627.3444119-3-lakshmiy@us.ibm.com Signed-off-by: Guenter Roeck commit 680921653cf39f086fe065234a2d9813b526bb6c Author: Lakshmi Yadlapati Date: Thu Apr 13 08:26:23 2023 -0500 dt-bindings: vendor-prefixes: Add prefix for acbel Add a vendor prefix entry for acbel (https://www.acbel.com) Signed-off-by: Lakshmi Yadlapati Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230413132627.3444119-2-lakshmiy@us.ibm.com Signed-off-by: Guenter Roeck commit fb23f23096471f915bf9745fa297c366e03ee579 Author: Christophe JAILLET Date: Sat Apr 15 18:23:37 2023 +0200 hwmon: (sfctemp) Simplify error message dev_err_probe() already display the error code. There is no need to duplicate it explicitly in the error message. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/f32a6e877f399e11ca130476002f85c2b48ba7ec.1681575790.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck commit 1680796b21c33cc13f413f8c39640b594092a3a4 Author: Eddie James Date: Wed Apr 12 11:15:26 2023 -0500 hwmon: (pmbus/ibm-cffps) Use default debugfs attributes and lock function Switch the driver to use the default debugfs attributes instead of ones that provide the same data under different names. Use the lock functions for the debugfs and led attributes, and simplify the input history operation by dropping the timer and lock. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20230412161526.252294-3-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit a7ac37183ac2a0cc46d857997b2dd24997ca2754 Author: Eddie James Date: Wed Apr 12 11:15:25 2023 -0500 hwmon: (pmbus/core) Add lock and unlock functions Debugfs operations may set the page number, which must be done atomically with the subsequent i2c operation. Lock the update_lock in the debugfs functions and provide a function for pmbus drivers to lock and unlock the update_lock. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20230412161526.252294-2-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit ab3e00416a0078be6d4126edc139536286d816e2 Author: Guenter Roeck Date: Wed Apr 12 11:11:17 2023 -0700 hwmon: (pmbus/core) Request threaded interrupt with IRQF_ONESHOT 0-day rightfully complains: drivers/hwmon/pmbus/pmbus_core.c:3164:7-32: WARNING: Threaded IRQ with no primary handler requested without IRQF_ONESHOT (unless it is nested IRQ) Without IRQF_ONESHOT, the primary interrupt may end up in a loop, and the threaded interrupt handler may never execute. Request interrupt with IRQF_ONESHOT and assume that the interrupt will cleared and re-enabled by clearing the fault condition in the threaded interrupt handler. Reported-by: kernel test robot Link: https://lore.kernel.org/linux-hwmon/6436efbb.08+e+yEDqvRxvHDP%25lkp@intel.com/T/#u Cc: Patrick Rudolph Cc: Naresh Solanki Signed-off-by: Guenter Roeck commit 5dcd53e315b7cd3efb591227c281f979bebd2155 Author: Denis Pauk Date: Sat Apr 8 19:22:28 2023 +0300 hwmon: (nct6775) update ASUS WMI monitoring list A620/B760/W790 Boards such as * B360M-BASALT, * B360M-D3H, * EX-B360M-V, * EX-B360M-V3, * EX-B360M-V5, * EX-B760M-V5 D4, * PRIME A620M-A, * PRIME B460I-PLUS, * PRIME B460M-A, * PRIME B460M-K, * PRIME B550-PLUS AC-HES, * PRIME B660M-A AC D4, * PRIME B760M-A, * PRIME B760M-A AX D4, * PRIME B760M-A D4, * PRIME B760M-AJ D4, * PRIME B760M-A WIFI, * PRIME B760M-A WIFI D4, * PRIME B760M-K D4, * PRIME B760-PLUS, * PRIME B760-PLUS D4, * PRIME H310I-PLUS, * PRIME H310M-A, * PRIME H310M-C, * PRIME H310M-D, * PRIME H310M-DASH, * PRIME H310M-E, * PRIME H310M-E/BR, * PRIME H310M-F, * PRIME H310M-K, * PRIME H310-PLUS, * PRIME H310T, * PRIME H370-A, * PRIME H370M-PLUS, * PRIME H370-PLUS, * PRIME H410I-PLUS, * PRIME H470M-PLUS, * PRIME H470-PLUS, * PRIME H510M-R, * PRIME H510T2/CSM, * PRIME H570M-PLUS, * PRIME H570-PLUS, * PRIME H610M-R D4, * PRIME H670-PLUS D4, * PRIME H770-PLUS D4, * PRIME Q370M-C, * ProArt B760-CREATOR D4, * Pro B760M-C, * Pro B760M-CT, * PRO Q470M-C, * Pro Q670M-C, * Pro WS W790-ACE, * Pro WS W790E-SAGE SE, * ROG MAXIMUS Z690 FORMULA, * ROG MAXIMUS Z690 HERO, * ROG STRIX B360-F GAMING, * ROG STRIX B360-G GAMING, * ROG STRIX B360-H GAMING, * ROG STRIX B360-H GAMING/OPTANE, * ROG STRIX B360-I GAMING, * ROG STRIX B760-A GAMING WIFI, * ROG STRIX B760-A GAMING WIFI D4, * ROG STRIX B760-F GAMING WIFI, * ROG STRIX B760-G GAMING WIFI, * ROG STRIX B760-G GAMING WIFI D4, * ROG STRIX B760-I GAMING WIFI, * ROG STRIX H370-F GAMING, * ROG STRIX H370-I GAMING, * ROG STRIX H470-I GAMING, * ROG STRIX Z690-E GAMING WIFI, * ROG STRIX Z690-F GAMING WIFI, * ROG STRIX Z690-G GAMING WIFI, * TUF B360M-E GAMING, * TUF B360M-PLUS GAMING, * TUF B360M-PLUS GAMING/BR, * TUF B360M-PLUS GAMING S, * TUF B360-PLUS GAMING, * TUF B360-PRO GAMING, * TUF B360-PRO GAMING (WI-FI), * TUF GAMING A620M-PLUS, * TUF GAMING A620M-PLUS WIFI, * TUF GAMING B660M-PLUS D4, * TUF GAMING B660M-PLUS WIFI D4, * TUF GAMING B760M-BTF WIFI D4, * TUF GAMING B760M-E D4, * TUF GAMING B760M-PLUS, * TUF GAMING B760M-PLUS D4, * TUF GAMING B760M-PLUS WIFI, * TUF GAMING B760M-PLUS WIFI D4, * TUF GAMING B760-PLUS WIFI, * TUF GAMING B760-PLUS WIFI D4, * TUF GAMING H470-PRO, * TUF GAMING H470-PRO (WI-FI), * TUF GAMING H570-PRO, * TUF GAMING H570-PRO WIFI, * TUF GAMING H670-PRO WIFI D4, * TUF GAMING H770-PRO WIFI, * TUF GAMING X570-PRO WIFI II, * TUF H310M-PLUS GAMING, * TUF H310M-PLUS GAMING/BR, * TUF H310-PLUS GAMING, * TUF H370-PRO GAMING, * TUF H370-PRO GAMING (WI-FI), have got a nct6775 chip, but by default there's no use of it because of resource conflict with WMI method. This commit adds such boards to the WMI monitoring list. Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Link: https://lore.kernel.org/r/20230408162228.4291-1-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit ad20248a2d644087fc149e6a8db150bde826c16f Author: Svyatoslav Ryhel Date: Fri Apr 7 19:05:08 2023 +0300 hwmon: ina2xx: add optional regulator support TI ina2xx sensors according to datasheets have dedicated vs supplies. Add it for proper work. Signed-off-by: Svyatoslav Ryhel Link: https://lore.kernel.org/r/20230407160508.20479-3-clamor95@gmail.com Signed-off-by: Guenter Roeck commit 4173a5bb7f51e3726381af65c365c1aac7769b54 Author: Svyatoslav Ryhel Date: Fri Apr 7 19:05:07 2023 +0300 dt-bindings: hwmon: ina2xx: add supply property Add vs-supply property. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230407160508.20479-2-clamor95@gmail.com Signed-off-by: Guenter Roeck commit 9e51acc4dbed91265c3a3e04e9ab6bd63bc9819b Author: Cristian Ciocaltea Date: Thu Apr 6 21:20:00 2023 +0300 dt-bindings: hwmon: pwm-fan: Convert to DT schema Convert the PWM fan bindings to DT schema format. Signed-off-by: Cristian Ciocaltea Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230406182000.956275-2-cristian.ciocaltea@collabora.com Signed-off-by: Guenter Roeck commit 7a0c7b9ff21d35c398fe609b3e2c7c3eaf374d05 Author: Naresh Solanki Date: Tue Mar 28 17:03:35 2023 +0200 hwmon: (pmbus/core) Notify regulator events Notify regulator events in PMBus irq handler. Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230328150335.90238-3-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck commit f74f06f4069ec008cec62574a55415c4567f8acf Author: Patrick Rudolph Date: Tue Mar 28 17:03:34 2023 +0200 hwmon: (pmbus/core) Add regulator event support Add regulator events corresponding to regulator error in regulator flag map. Also capture the same in pmbus_regulator_get_flags. Signed-off-by: Patrick Rudolph Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230328150335.90238-2-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck commit ffe36eb557d375ff7667d249aecdf08ed5acf55d Author: Naresh Solanki Date: Tue Mar 28 17:03:33 2023 +0200 hwmon: (pmbus/core) Add rdev in pmbus_data struct Add regulator device in pmbus_data & initialize the same during PMBus regulator register. Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230328150335.90238-1-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck commit 7f2958e845d2c8bf1100dc088dbdc31af2a80fd0 Author: Emil Renner Berthing Date: Tue Mar 21 10:26:44 2023 +0800 hwmon: (sfctemp) Add StarFive JH71x0 temperature sensor Add driver for the StarFive JH71x0 temperature sensor. You can enable/disable it and read temperature in milli Celcius through sysfs. Signed-off-by: Emil Renner Berthing Co-developed-by: Samin Guo Signed-off-by: Samin Guo Signed-off-by: Hal Feng Link: https://lore.kernel.org/r/20230321022644.107027-3-hal.feng@starfivetech.com Signed-off-by: Guenter Roeck commit d16718fcdde702c70fd07f8f3e1e0f67166389aa Author: Emil Renner Berthing Date: Tue Mar 21 10:26:43 2023 +0800 dt-bindings: hwmon: Add starfive,jh71x0-temp Add bindings for the temperature sensor on the StarFive JH7100 and JH7110 SoCs. Signed-off-by: Emil Renner Berthing Signed-off-by: Hal Feng Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230321022644.107027-2-hal.feng@starfivetech.com Signed-off-by: Guenter Roeck commit a2930f6dc90f07b2d956cab5f98b594b16918132 Author: Zhang Rui Date: Thu Mar 30 18:33:46 2023 +0800 hwmon: (coretemp) Delete an obsolete comment The refinement of tjmax value retrieved from MSR_IA32_TEMPERATURE_TARGET has been changed for several times. Now, the raw value from MSR is used without refinement. Thus remove the obsolete comment. Signed-off-by: Zhang Rui Link: https://lore.kernel.org/r/20230330103346.6044-2-rui.zhang@intel.com Signed-off-by: Guenter Roeck commit 6c2b659913ad9c70c30050efc3e287fd0869012a Author: Zhang Rui Date: Thu Mar 30 18:33:45 2023 +0800 hwmon: (coretemp) Delete tjmax debug message After commit c0c67f8761ce ("hwmon: (coretemp) Add support for dynamic tjmax"), tjmax value is retrieved from MSR every time the temperature is read. This means that, with debug message enabled, the tjmax debug message is printed out for every single temperature read for any CPU. This spams the syslog. Ideally, as tjmax is package scope unique, the debug message should show once when tjmax is changed for one package. But this requires inventing some new per-package data in the coretemp driver, and this is overkill. To keep the code simple, delete the tjmax debug message. Signed-off-by: Zhang Rui Link: https://lore.kernel.org/r/20230330103346.6044-1-rui.zhang@intel.com Signed-off-by: Guenter Roeck commit 3a31e0920308487331e53a53c4133ce1d8e12ad9 Author: Eugene Shalygin Date: Thu Apr 6 00:43:39 2023 +0200 hwmon: (asus-ec-sensors) add ROG STRIX Z390-F GAMING The definition comes from a LHM PR [1], and the mutex path from the ACPI dump, kindly provided by the PR author [2] [1] https://github.com/LibreHardwareMonitor/LibreHardwareMonitor/pull/1031 [2] https://github.com/zeule/asus-ec-sensors/issues/36 Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20230405224339.358675-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit c7ba3e26fd988116c98e7c8b9c27262b78db594c Author: fireflame90051 Date: Thu Apr 6 00:43:38 2023 +0200 hwmon: (asus-ec-sensors) add ProArt B550-Creator Add support for the ASUS ProArt B550-Creator board, was tested with the hardware [1]. [1] https://github.com/zeule/asus-ec-sensors/issues/35 Signed-off-by: Eugene Shalygin Signed-off-by: fireflame90051 Link: https://lore.kernel.org/r/20230405224339.358675-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit b0eb085b4f960a2961e566b5608470e493b2003d Author: James Seo Date: Wed Apr 5 07:31:07 2023 +0000 hwmon: fix typo in Makefile Fix the spelling of "ACPI" in Makefile. Signed-off-by: James Seo Link: https://lore.kernel.org/r/20230405073056.53466-3-james@equiv.tech Signed-off-by: Guenter Roeck commit 38c92a3110106e1b75d6d3c237478a11fefb461f Author: James Seo Date: Wed Apr 5 07:31:05 2023 +0000 hwmon: remove trailing whitespace in Kconfig Remove an unneeded trailing space. Signed-off-by: James Seo Link: https://lore.kernel.org/r/20230405073056.53466-2-james@equiv.tech Signed-off-by: Guenter Roeck commit 3bf8437be3755084e77cea6b68aec71235301cbe Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:27 2023 +0200 hwmon: w83773g: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit b418bd0a3119ae97cdfc9ab71193e494efc5add8 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:26 2023 +0200 hwmon: w83627ehf: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 7325fea5a5213d91805dc9dc448686b110df82ec Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:25 2023 +0200 hwmon: tps23861: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit b39c94a1f6f0aa3c0438588340495d5c777e2f4f Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:24 2023 +0200 hwmon: tmp513: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 98bc085cae3e350fdf1e4b7f60c8fd80dc6b84cc Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:23 2023 +0200 hwmon: tmp464: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 1198c51f8fb312450c0cb01f989d2537d43dcd0b Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:22 2023 +0200 hwmon: tmp108: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit a705bc468840a3392771477a28aaa394b493aecc Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:21 2023 +0200 hwmon: tmp103: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit fc3ad66804807efa88a6e8c97869ada1b59a257d Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:20 2023 +0200 hwmon: tmp102: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 5b5d8ae01954350f47b9d601ebfc7f96563c3496 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:40:19 2023 +0200 hwmon: sy7636a: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit dc8811447c6be6959b0f18b5a06fd9eafeba32c6 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:21 2023 +0200 hwmon: sparx5-temp: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit d302988c9867bc0daf2bf4057588a59fb2e637f6 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:20 2023 +0200 hwmon: smpro: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 7f46e9883f530068473f2adae93d3cf4a2f8b92e Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:19 2023 +0200 hwmon: sl28cpld: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 11c1dff58c65ee6a5cbfa19af049ee8af01a91c6 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:18 2023 +0200 hwmon: sht4x: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 1ff3d23d00184dc350394e3ca53fdce87daa1bc1 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:17 2023 +0200 hwmon: sch5627: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit eeda3a44532371bf72ef80d163326ca1c65a5bda Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:16 2023 +0200 hwmon: sbtsi_temp: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 29423978b76912b43ebb9ac6433be0f9dd7bd8fa Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:15 2023 +0200 hwmon: sbrmi: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 70df9a55434b2c05f70163524007f1b4382489a3 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:14 2023 +0200 hwmon: raspberrypi: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 42d273bcf4f2e74aa5591fa6a497c9ee48fe523e Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:13 2023 +0200 hwmon: powr1220: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 0c15d66d071c3490a9a3004b5a4c6f7524041a99 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:38:12 2023 +0200 hwmon: peci: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 195030d34ee9a77e851b23b9d5f174860e21a982 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:35:30 2023 +0200 hwmon: oxp-sensors: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 98ce1fc134ef4450c798a9e198261b6d0b9b7cb2 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:35:29 2023 +0200 hwmon: nzxt: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 9add51f2bc65340e5a42efa8f7312fbd9d13ee61 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:35:28 2023 +0200 hwmon: ntc_thermistor: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit ed30302c3bccc1be2c3b3205c37b3f3a0da55138 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:35:27 2023 +0200 hwmon: npcm750-pwm: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 2a06edbe33b21a7c6851f5d4f81f73e1407af040 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:35:26 2023 +0200 hwmon: nct7904: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit bb54a54b5c660053e96032209c5f75c72070b676 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:35:25 2023 +0200 hwmon: mlxreg: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit d716e0cf674d016ddeaeb25bede1bcd15366bc7f Author: Krzysztof Kozlowski Date: Thu Apr 6 22:35:24 2023 +0200 hwmon: mcp3021: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 11305fd37b428e9afddd4acdc104d87774162c09 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:35:23 2023 +0200 hwmon: mc34vr500: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 1c80f98754952749873d02bea5e67883733e7b42 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:36 2023 +0200 hwmon: max6650: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit a7bae59766835188917b3d1f186ecf02f5628cde Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:35 2023 +0200 hwmon: max6621: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit b3fcd02c608184e1ab42710d4bc58b4c15fbf873 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:34 2023 +0200 hwmon: max6620: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 822ce415baa4f46e0c8fe03944ccd1bcee199583 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:33 2023 +0200 hwmon: max31790: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 02681a9f33ab1e18e7838b69c637ca3ec80ddb36 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:32 2023 +0200 hwmon: max31760: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit c70164adbbdd15bc793bd4eed776ec4752dced82 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:31 2023 +0200 hwmon: max31730: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 2b1aec842ee248b2320cdaeea23c9ce6d4c3ea58 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:30 2023 +0200 hwmon: max127: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 894fce118b8dbf3c5b93cd3e0fab186bae35a48f Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:29 2023 +0200 hwmon: ltq-cputemp: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 38ab6d602ea1c332f06f9b22bcee5ea69deab14c Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:28 2023 +0200 hwmon: ltc4245: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 8cbafa6efece730bfb6f11829ec64c80437fbc96 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:27 2023 +0200 hwmon: ltc2992: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 53dc67eb935c8a3e18a06d10847cd761bd715ac4 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:26 2023 +0200 hwmon: ltc2947: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit bf36b752ca464582a0ec67fedf647d841071320e Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:25 2023 +0200 hwmon: lochnagar: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 043f90c8d103f05bdb63aa03afd4d84e1a77bf41 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:24 2023 +0200 hwmon: lm95245: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 1d0cfeb2ea93c6378d62cab88a512a570578c152 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:23 2023 +0200 hwmon: lm95241: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 3c370243cbfa2d194fe9caa36772bf9d8e83110d Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:22 2023 +0200 hwmon: lm83: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 3ee2ceca3f1d65503a9d599a67d92a52a4aea5dc Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:21 2023 +0200 hwmon: lm75: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 2d9011813e5ff462fef0c93d6fcea5a152b702ba Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:20 2023 +0200 hwmon: lan966x: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 55f4466382313d17fb0712e7733d75a91c380f04 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:19 2023 +0200 hwmon: k8temp: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 4dd50f3c1d6521d8f4a688bb00d0228fbe65b2b8 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:18 2023 +0200 hwmon: k10temp: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit b3dc5eee6b2dce921ccfd40dd209b26885a31093 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:17 2023 +0200 hwmon: jc42: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit e374c4100b6154f80aaf12af39c67a942b519a87 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:16 2023 +0200 hwmon: intel-m10-bmc: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 324399753854b8aaa6a621902a33e77f4425e7cf Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:15 2023 +0200 hwmon: ina3221: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit bf9b7f92df737654fc7f3fff3fab320e97ff33de Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:14 2023 +0200 hwmon: ina238: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 92b978fe7616486d9cbefbf2d99267f4258b758e Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:13 2023 +0200 hwmon: i5500_temp: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit d6171e4d3229fb671706edba14052897a353f262 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:12 2023 +0200 hwmon: gxp-fan: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 06c3779625378bb1ceb27e83e0366a2bef6707a8 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:11 2023 +0200 hwmon: ftsteutates: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit c1686de1db3656b0fe91dce44c0dffe084d07853 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:10 2023 +0200 hwmon: emc2305: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit b9adb6b6654486cebdf3b96bf2330d6958c9c326 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:09 2023 +0200 hwmon: drivetemp: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit f4ddd8f2e12f75fcbf956fa6845a11dc0455c040 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:08 2023 +0200 hwmon: dell-smm: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 42bd7a59f3b54f8f7dcf802001a8ed8ebb6cabd6 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:07 2023 +0200 hwmon: corsair: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit edcde8cfefb9809fea5172fcc3f4993c01bed4f1 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:06 2023 +0200 hwmon: bt1-pvt: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit a1e308bfae71d1f464edeb40141b23b1c1a86519 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:05 2023 +0200 hwmon: axi-fan: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 69a1ffca989e0b43afda1b8c93a43433a1c9ec60 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:04 2023 +0200 hwmon: as370: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 832dc5106e813b4dc942bce27f89819f8d21fbd7 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:03 2023 +0200 hwmon: aquacomputer: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit b9ab28a7749895e9ef20c5a70642825479d4dc75 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:02 2023 +0200 hwmon: aht10: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit d7bb04c3e226350d0f99aaf900ecb6f324173c14 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:01 2023 +0200 hwmon: adt7x10: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit ce94ff2ef9758797c4c1670fb90c3d5060024525 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:30:00 2023 +0200 hwmon: adt7470: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 07aa164a503878a83a8e8319109f69ce863a10c3 Author: Krzysztof Kozlowski Date: Thu Apr 6 22:29:59 2023 +0200 hwmon: adt7411: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 013adc9852a1352007722c3e42986cb6e03a99be Author: Krzysztof Kozlowski Date: Thu Apr 6 22:29:58 2023 +0200 hwmon: adm9240: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 63bde65918e60c679e58dcc382b19cf24cc3f07a Author: Krzysztof Kozlowski Date: Thu Apr 6 22:29:57 2023 +0200 hwmon: adm1177: constify pointers to hwmon_channel_info Statically allocated array of pointed to hwmon_channel_info can be made const for safety. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck commit 7165bfc9b89e5c144d63391e2229a905c920f1db Author: Krzysztof Kozlowski Date: Thu Apr 6 22:47:50 2023 +0200 MAINTAINERS: hwmon: drop Agathe Porte Mails to Agathe Porte bounce ("550 5.4.1 Recipient address rejected: Access denied. AS(201806281)"). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230406204750.3017850-1-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck commit a4fffe48e4bab49b991490abd3e6d4bd98af2610 Author: Denis Pauk Date: Thu Mar 23 23:27:51 2023 +0200 hwmon: (nct6775) update ASUS WMI monitoring list B360/H410/H610/Z390... Boards such as * EX-B460M-V5, * EX-H410M-V3, * PRIME B360M-D, * PRIME B360M-K, * PRIME H410M-A, * PRIME H410M-D, * PRIME H410M-E, * PRIME H410M-F, * PRIME H410M-K, * PRIME H410M-K R2.0, * PRIME H510M-K R2.0, * PRIME Z390-A, * PRIME Z390-A/H10, * PRIME Z390-P, * PRIME Z390M-PLUS, * PRIME Z490-A, * PRIME Z490-P, * PRIME Z490-V, * PRIME Z490M-PLUS, * PRO B460M-C, * PRO H410M-C, * ROG MAXIMUS XI APEX, * ROG MAXIMUS XI CODE, * ROG MAXIMUS XI EXTREME, * ROG MAXIMUS XI FORMULA, * ROG MAXIMUS XI GENE, * ROG MAXIMUS XI HERO, * ROG MAXIMUS XI HERO (WI-FI), * ROG MAXIMUS XII APEX, * ROG MAXIMUS XII EXTREME, * ROG MAXIMUS XII FORMULA, * ROG MAXIMUS XII HERO (WI-FI), * ROG STRIX B460-F GAMING, * ROG STRIX B460-G GAMING, * ROG STRIX B460-H GAMING, * ROG STRIX B460-I GAMING, * TUF GAMING B460-PLUS, * TUF GAMING B460-PRO (WI-FI), * TUF GAMING B460M-PLUS, * TUF GAMING B460M-PLUS (WI-FI), * TUF GAMING B460M-PRO, * TUF GAMING B550-PLUS (WI-FI), * TUF GAMING B550M ZAKU (WI-FI), * TUF Z390-PLUS GAMING, * TUF Z390-PLUS GAMING (WI-FI), * TUF Z390-PRO GAMING, * TUF Z390M-PRO GAMING, * TUF Z390M-PRO GAMING (WI-FI), * WS Z390 PRO, * B560M-P, * EX-B560M-V5, * EX-H510M-V3, * EX-H610M-V3 D4, * PRIME B560-PLUS, * PRIME B560-PLUS AC-HES, * PRIME B560M-A, * PRIME B560M-A AC, * PRIME B560M-K, * PRIME B660-PLUS D4, * PRIME H510M-A, * PRIME H510M-A WIFI, * PRIME H510M-D, * PRIME H510M-E, * PRIME H510M-F, * PRIME H510M-K, * PRIME H610I-PLUS D4, * PRIME H610M-A D4, * PRIME H610M-A WIFI D4, * PRIME H610M-D D4, * PRIME H610M-E D4, * PRIME H610M-F D4, * PRIME H610M-K D4, * PRIME Z690-A, * PRIME Z690-P, * PRIME Z690-P D4, * PRIME Z690-P WIFI, * PRIME Z690-P WIFI D4, * PRIME Z690M-PLUS D4, * PRIME Z790-A WIFI, * PRIME Z790-P, * PRIME Z790-P D4, * PRIME Z790-P WIFI, * PRIME Z790-P WIFI D4, * PRIME Z790M-PLUS, * PRIME Z790M-PLUS D4, * Pro B560M-C, * Pro B560M-CT, * Pro H510M-C, * Pro H510M-CT, * Pro H610M-C, * Pro H610M-C D4, * Pro H610M-CT D4, * Pro H610T D4, * ProArt Z690-CREATOR WIFI, * ROG MAXIMUS Z690 HERO EVA, * ROG MAXIMUS Z790 APEX, * ROG MAXIMUS Z790 HERO, * ROG STRIX B560-A GAMING WIFI, * ROG STRIX B560-E GAMING WIFI, * ROG STRIX B560-F GAMING WIFI, * ROG STRIX B560-G GAMING WIFI, * ROG STRIX B560-I GAMING WIFI, * ROG STRIX Z690-A GAMING WIFI, * ROG STRIX Z690-I GAMING WIFI, * ROG STRIX Z790-A GAMING WIFI, * ROG STRIX Z790-A GAMING WIFI D4, * ROG STRIX Z790-E GAMING WIFI, * ROG STRIX Z790-F GAMING WIFI, * ROG STRIX Z790-H GAMING WIFI, * ROG STRIX Z790-I GAMING WIFI, * TUF GAMING B560-PLUS WIFI, * TUF GAMING B560M-E, * TUF GAMING B560M-PLUS, * TUF GAMING B560M-PLUS WIFI, * TUF GAMING Z690-PLUS, * TUF GAMING Z690-PLUS D4, * TUF GAMING Z690-PLUS WIFI, * TUF GAMING Z690-PLUS WIFI D4, * TUF GAMING Z790-PLUS D4, * TUF GAMING Z790-PLUS WIFI, * TUF GAMING Z790-PLUS WIFI D4, have got a nct6775 chip, but by default there's no use of it because of resource conflict with WMI method. This commit adds such boards to the WMI monitoring list. Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Tested-by: Alejandro González Tested-by: bruno Tested-by: renedis Link: https://lore.kernel.org/r/20230323212751.2474-3-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit c05403e64d7feb12ac31cf785a61b665970cc821 Author: Denis Pauk Date: Thu Mar 23 23:27:50 2023 +0200 hwmon: (nct6775) Fix ROG B550-XE WIFI and Pro B660M-C D4 names ROG STRIX B550-XE GAMING WIFI motherboard is incorrectly named as ROG STRIX B550-XE GAMING (WI-FI). Pro B660M-C D4 motherboard is incorrectly named as Pro B660M-C-D4. Validated by dmidecode output from https://github.com/linuxhw/DMI/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Link: https://lore.kernel.org/r/20230323212751.2474-2-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit 0282592678b1e397916db36052986380d5fe4ec6 Author: Denis Pauk Date: Thu Mar 23 23:27:49 2023 +0200 hwmon: (nct6775) Sort ASUS board list Rearrange board list in alphabetical order by: LC_ALL=C sort -u Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Link: https://lore.kernel.org/r/20230323212751.2474-1-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit 8ea57c51e508d8c6ce1531b5336199ceeda39120 Author: Tom Rix Date: Thu Mar 23 17:15:35 2023 -0400 hwmon: remove unused superio_outb function clang with W=1 reports drivers/hwmon/vt1211.c:198:20: error: unused function 'superio_outb' [-Werror,-Wunused-function] static inline void superio_outb(int sio_cip, int reg, int val) ^ This function is not used so remove it. Signed-off-by: Tom Rix Acked-by: Juerg Haefliger Link: https://lore.kernel.org/r/20230323211535.2637939-1-trix@redhat.com Signed-off-by: Guenter Roeck commit a7da8a8bf19b758d6db50a1c09627b0422fe98db Author: Lorenz Brun Date: Thu Mar 9 02:10:08 2023 +0100 hwmon: (pwm-fan) set usage_power on PWM state PWM fans are controlled solely by the duty cycle of the PWM signal, they do not care about the exact timing. Thus set usage_power to true to allow less flexible hardware to work as a PWM source for fan control. Signed-off-by: Lorenz Brun Link: https://lore.kernel.org/r/20230309011009.2109696-1-lorenz@brun.one Signed-off-by: Guenter Roeck commit dedbe4c1499cf1b7b0357872cf858221f583bfc0 Author: Frank Crawford Date: Sat Mar 18 19:05:43 2023 +1100 hwmon: (it87) Use voltage scaling macro where appropriate Apply scaling macro to match the labels for internal voltage sensors. Signed-off-by: Frank Crawford Link: https://lore.kernel.org/r/20230318080543.1226700-3-frank@crawford.emu.id.au Signed-off-by: Guenter Roeck commit bcd2fbec8a2583f4180ffc8b453c24fad2068306 Author: Denis Pauk Date: Thu Mar 16 00:51:28 2023 +0200 hwmon: (nct6775) update ASUS WMI monitoring list A520/B360/B460/B550... Boards such as * EX-B660M-V5 D4, * PRIME A520M-A, * PRIME A520M-A II, * PRIME A520M-E, * PRIME A520M-K, * PRIME B360M-A, * PRIME B360M-C, * PRIME B460M-A R2.0, * PRIME B550M-A AC, * PRIME B550M-A WIFI II, * PRIME B550M-K, * PRIME B650M-A AX II, * PRIME Z590-P WIFI, * PRIME Z590-V, * Pro A520M-C, * ProArt B650-CREATOR, * ProArt Z790-CREATOR WIFI, * Pro B660M-C, * Pro WS W680-ACE, * Pro WS W680-ACE IPMI, * ROG MAXIMUS XIII APEX, * ROG MAXIMUS XIII EXTREME, * ROG MAXIMUS XIII HERO, * ROG MAXIMUS Z690 APEX, * ROG MAXIMUS Z790 EXTREME, * ROG STRIX B660-A GAMING WIFI, * ROG STRIX Z590-A GAMING WIFI, * ROG STRIX Z590-E GAMING WIFI, * ROG STRIX Z590-F GAMING WIFI, * ROG STRIX Z590-I GAMING WIFI, * TUF GAMING A520M-PLUS, * TUF GAMING A520M-PLUS II, * TUF GAMING A520M-PLUS WIFI, * TUF GAMING B660M-E D4, * TUF GAMING B660-PLUS WIFI D4, * TUF GAMING X570-PLUS_BR, * TUF GAMING Z590-PLUS, * Z490-GUNDAM (WI-FI), * Z590 WIFI GUNDAM EDITION have got a nct6775 chip, but by default there's no use of it because of resource conflict with WMI method. This commit adds such boards to the WMI monitoring list. Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Tested-by: Nick Owens Tested-by: A. M. Link: https://lore.kernel.org/r/20230315225128.1236-1-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit 23e8a379cf5c29a97c63016e1554de731b26a29b Author: Denis Pauk Date: Wed Mar 15 23:01:34 2023 +0200 hwmon: (nct6775) Fix TUF GAMING B550M-E WIFI name TUF GAMING B550M-E WIFI motherboard is incorrectly named as TUF GAMING B550M-E (WI-FI). Validated by dmidecode output from https://github.com/linuxhw/DMI/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Link: https://lore.kernel.org/r/20230315210135.2155-1-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit ea00552690bb408a8d1c361edf626d1bfe961f74 Author: Holger Kiehl Date: Mon Mar 13 13:10:31 2023 +0000 hwmon: (nct6775) add Asus Pro A520M-C II/CSM An NCT6798D chip is now detected: dmesg|grep nct6775 [ 23.765392] nct6775: Found NCT6798D or compatible chip at 0x2e:0x290 And sensors now shows: nct6798-isa-0290 Adapter: ISA adapter in0: 312.00 mV (min = +0.00 V, max = +1.74 V) in1: 1.02 V (min = +0.00 V, max = +0.00 V) ALARM in2: 3.42 V (min = +0.00 V, max = +0.00 V) ALARM in3: 3.38 V (min = +0.00 V, max = +0.00 V) ALARM in4: 1.03 V (min = +0.00 V, max = +0.00 V) ALARM in5: 1.02 V (min = +0.00 V, max = +0.00 V) ALARM in6: 200.00 mV (min = +0.00 V, max = +0.00 V) ALARM in7: 3.42 V (min = +0.00 V, max = +0.00 V) ALARM in8: 3.28 V (min = +0.00 V, max = +0.00 V) ALARM in9: 920.00 mV (min = +0.00 V, max = +0.00 V) ALARM in10: 512.00 mV (min = +0.00 V, max = +0.00 V) ALARM in11: 504.00 mV (min = +0.00 V, max = +0.00 V) ALARM in12: 1.03 V (min = +0.00 V, max = +0.00 V) ALARM in13: 256.00 mV (min = +0.00 V, max = +0.00 V) ALARM in14: 1.47 V (min = +0.00 V, max = +0.00 V) ALARM fan1: 0 RPM (min = 0 RPM) fan2: 0 RPM (min = 0 RPM) fan3: 355 RPM (min = 0 RPM) fan7: 0 RPM (min = 0 RPM) SYSTIN: +25.0°C (high = +80.0°C, hyst = +75.0°C) sensor = thermistor CPUTIN: +26.5°C (high = +80.0°C, hyst = +75.0°C) sensor = thermistor AUXTIN0: +97.0°C sensor = thermistor AUXTIN1: +25.0°C sensor = thermistor AUXTIN2: +25.0°C sensor = thermistor AUXTIN3: +1.0°C sensor = thermistor PECI Agent 0 Calibration: +26.0°C PCH_CHIP_CPU_MAX_TEMP: +0.0°C PCH_CHIP_TEMP: +0.0°C PCH_CPU_TEMP: +0.0°C TSI0_TEMP: +27.9°C intrusion0: ALARM intrusion1: OK beep_enable: disabled Signed-off-by: Holger Kiehl Tested-by: Holger Kiehl Link: https://lore.kernel.org/r/868bdc4f-9d45-475c-963e-f5232a8b95@praktifix.dwd.de Signed-off-by: Guenter Roeck commit aededf875a233b2b890af0000aa1b8f17b5351a0 Author: Guenter Roeck Date: Wed Mar 15 14:41:30 2023 -0700 Documentation/hwmon: Remove description of deprecated registration functions Remove description of deprecated registration functions from the hardware monitoring kernel API documentation to help ensure that no attempts are made to use them in new drivers. Signed-off-by: Guenter Roeck commit 9fadbda6d1e0c1022fc77fa14461d1f475b83510 Author: Stefan Wahren Date: Sun Mar 12 16:57:14 2023 +0100 docs: hwmon: sysfs-interface: Fix stray colon The commit 036d6a4e75c9 ("ABI: sysfs-class-hwmon: add ABI documentation for it") moved all ABI attributes to the usual ABI documentation. But this change left a stray colon for the fan speed control method. Fix this to avoid a confusion of readers. Fixes: 036d6a4e75c9 ("ABI: sysfs-class-hwmon: add ABI documentation for it") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20230312155714.17290-1-stefan.wahren@i2se.com Signed-off-by: Guenter Roeck commit f469bde9afd136598a0c4edc054296e6046f90ee Author: Patrick Rudolph Date: Wed Mar 1 17:44:34 2023 +0100 hwmon: (pmbus/core) Notify hwmon events Notify hwmon events using the pmbus irq handler. Signed-off-by: Patrick Rudolph Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230301164434.1928237-4-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck commit 221819ca4c36e13a77475af56e8481dfb0a85646 Author: Patrick Rudolph Date: Wed Mar 1 17:44:33 2023 +0100 hwmon: (pmbus/core) Add interrupt support Implement PMBUS irq handler. Signed-off-by: Patrick Rudolph Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230301164434.1928237-3-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck commit df5f6b6af01ca326dd4babb287c9580fed0ad3d6 Author: Naresh Solanki Date: Wed Mar 1 17:44:32 2023 +0100 hwmon: (pmbus/core) Generalise pmbus get status Add function pmbus get status that can be used to get both pmbus specific status & regulator status Signed-off-by: Naresh Solanki Reviewed-by: Guenter Roeck ... Change in V4 - None Changes in V3: - Add pmbus_is_enabled function Changes in V2: - Add __maybe attribute for pmbus_get_status function - Remove unrelated changes Link: https://lore.kernel.org/r/20230301164434.1928237-2-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck commit 7ab0da3a77fe62670877b986028861dc098532ae Author: Naresh Solanki Date: Wed Mar 1 17:44:31 2023 +0100 hwmon: (pmbus/core) Generalize pmbus status flag map The PMBus status flag map(pmbus_regulator_status_flag_map) is moved outside of the regulator #if block and the associated variable/struct name updated to reflect as generic PMBus status. This will make the PMBus status flag map more versatile and easier to incorporate into different contexts and functions. Signed-off-by: Naresh Solanki Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230301164434.1928237-1-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck commit bd1e92f9977c78a04e9fe401e359feb67aacb7f9 Author: Leonard Anderweit Date: Tue Feb 14 23:02:21 2023 +0100 hwmon: (aquacomputer_d5next) Add fan PWM control for Aquaero Add the option to control fan PWM on Aquacomputer Aquaero. The Aquaero is the most complex Aquacomputer device, control is therefore more complicated then on already supported devices. Setting PWM requires multiple steps. First, an internal static PWM controller is set to the desired PWM value. Second, the fan is set to use that PWM controller. Last, the minimum and maximum accepted PWM values of the fan are set to allow all possible PWM values. Signed-off-by: Leonard Anderweit Link: https://lore.kernel.org/r/20230214220221.15003-7-leonard.anderweit@gmail.com Signed-off-by: Guenter Roeck commit 866e630a3b8b48688f0656e3c31da436493e8a99 Author: Leonard Anderweit Date: Tue Feb 14 23:02:20 2023 +0100 hwmon: (aquacomputer_d5next) Add temperature offset control for Aquaero Adds control over the Aquacomputer Aquaero temperature offset for all eight temperature sensors. Signed-off-by: Leonard Anderweit Link: https://lore.kernel.org/r/20230214220221.15003-6-leonard.anderweit@gmail.com Signed-off-by: Guenter Roeck commit 6c83ccb10c49e4867299a7ad34a0712c72d1f1a4 Author: Leonard Anderweit Date: Tue Feb 14 23:02:19 2023 +0100 hwmon: (aquacomputer_d5next) Add infrastructure for Aquaero control reports Add information on the Aquacomputer Aquaero control report and disable the control report checksum for Aquaero. The Aquaero does not use the checksum so it must be disabled to avoid overwriting the last two bytes of the control report. Signed-off-by: Leonard Anderweit Link: https://lore.kernel.org/r/20230214220221.15003-5-leonard.anderweit@gmail.com Signed-off-by: Guenter Roeck commit b29090bac9358344804b6d2007d9ec68d252cda4 Author: Leonard Anderweit Date: Tue Feb 14 23:02:18 2023 +0100 hwmon: (aquacomputer_d5next) Device dependent control report settings Add device dependent control report id, secondary control report id, secondary control report size and secondary control report for devices which need different control report settings. All currently supported devices use the same values. Signed-off-by: Leonard Anderweit Link: https://lore.kernel.org/r/20230214220221.15003-4-leonard.anderweit@gmail.com Signed-off-by: Guenter Roeck commit 4d09d155a5d1aa984cba70e52609a3587149a911 Author: Leonard Anderweit Date: Tue Feb 14 23:02:17 2023 +0100 hwmon: (aquacomputer_d5next) Support writing multiple control values at once Add new function aqc_set_ctrl_vals() to support changing multiple control values at once while sending only one control report. Signed-off-by: Leonard Anderweit Link: https://lore.kernel.org/r/20230214220221.15003-3-leonard.anderweit@gmail.com Signed-off-by: Guenter Roeck commit d0450fc1e3960ef2cd9aeea1b525bb513ee387bb Author: Leonard Anderweit Date: Tue Feb 14 23:02:16 2023 +0100 hwmon: (aquacomputer_d5next) Support one byte control values Add support for one byte control values. This extends aqc_set_ctrl_val() and aqc_get_ctrl_val() with a type. Currently supported types are AQC_8 (one byte) and AQC_BE16 (two bytes big endian). More types will be added in the future. Signed-off-by: Leonard Anderweit Link: https://lore.kernel.org/r/20230214220221.15003-2-leonard.anderweit@gmail.com Signed-off-by: Guenter Roeck commit 90b86248d31eb3d56b243487c188d0f5a3d24fdb Author: Erik Ekman Date: Mon Feb 27 10:03:11 2023 +0100 hwmon: (nct6775) ASUS PRIME Z590 boards support Tested on Z590M-PLUS. dmesg log: nct6775: Found NCT6798D or compatible chip at 0x2e:0x290 sensors output: nct6798-isa-0290 Adapter: ISA adapter in0: 672.00 mV (min = +0.00 V, max = +1.74 V) in1: 1000.00 mV (min = +0.00 V, max = +0.00 V) ALARM in2: 3.38 V (min = +0.00 V, max = +0.00 V) ALARM in3: 3.28 V (min = +0.00 V, max = +0.00 V) ALARM in4: 1.01 V (min = +0.00 V, max = +0.00 V) ALARM in5: 808.00 mV (min = +0.00 V, max = +0.00 V) ALARM in6: 1000.00 mV (min = +0.00 V, max = +0.00 V) ALARM in7: 3.38 V (min = +0.00 V, max = +0.00 V) ALARM in8: 3.20 V (min = +0.00 V, max = +0.00 V) ALARM in9: 528.00 mV (min = +0.00 V, max = +0.00 V) ALARM in10: 672.00 mV (min = +0.00 V, max = +0.00 V) ALARM in11: 528.00 mV (min = +0.00 V, max = +0.00 V) ALARM in12: 1.21 V (min = +0.00 V, max = +0.00 V) ALARM in13: 992.00 mV (min = +0.00 V, max = +0.00 V) ALARM in14: 1.02 V (min = +0.00 V, max = +0.00 V) ALARM fan1: 971 RPM (min = 0 RPM) fan2: 1525 RPM (min = 0 RPM) fan3: 0 RPM (min = 0 RPM) fan4: 1094 RPM (min = 0 RPM) fan5: 0 RPM (min = 0 RPM) fan6: 0 RPM (min = 0 RPM) fan7: 0 RPM (min = 0 RPM) SYSTIN: +36.0°C (high = +80.0°C, hyst = +75.0°C) sensor = thermistor CPUTIN: +40.0°C (high = +80.0°C, hyst = +75.0°C) sensor = thermistor AUXTIN0: +26.0°C sensor = thermistor AUXTIN1: +8.0°C sensor = thermistor AUXTIN2: +22.0°C sensor = thermistor AUXTIN3: +25.0°C sensor = thermistor PECI Agent 0 Calibration: +40.0°C PCH_CHIP_CPU_MAX_TEMP: +0.0°C PCH_CHIP_TEMP: +55.0°C PCH_CPU_TEMP: +0.0°C intrusion0: OK intrusion1: ALARM beep_enable: disabled Signed-off-by: Erik Ekman Link: https://lore.kernel.org/r/20230227090312.91091-1-erik@kryo.se Signed-off-by: Guenter Roeck commit 92e58a87a26cd2fd7c12165e68d5bd53c8cfb122 Author: Kang Chen Date: Mon Feb 27 11:09:12 2023 +0800 hwmon: (g762) add a check of devm_add_action in g762_of_clock_enable devm_add_action may fails, check it and do the cleanup. Signed-off-by: Kang Chen Link: https://lore.kernel.org/r/20230227030913.893004-1-void0red@gmail.com Signed-off-by: Guenter Roeck commit dbfeafdad31c52da8965819a298ed3b0127025e7 Author: Kang Chen Date: Mon Feb 27 17:15:34 2023 +0800 hwmon: (nzxt-smart2) handle failure of devm_add_action in nzxt_smart2_hid_probe 1. replace the devm_add_action with devm_add_action_or_reset to ensure the mutex lock can be destroyed when it fails. 2. use local wrapper function mutex_fini instead of mutex_destroy to avoid undefined behaviours. 3. add a check of devm_add_action_or_reset and return early when it fails. Link: https://lore.kernel.org/all/f5043281-9b3e-e454-16fe-ef4cde36dfdb@roeck-us.net Signed-off-by: Kang Chen Link: https://lore.kernel.org/r/20230227091534.907101-1-void0red@gmail.com Signed-off-by: Guenter Roeck commit 37ef30fbf2894e1acd5aa7cc1dccfc54039cecd5 Author: Armin Wolf Date: Sun Feb 26 02:48:30 2023 +0100 hwmon: (ftsteutates) Update specifications website The Fujitsu OEM Mainboard business was acquired by Kontron, so the specifications of the Teutates chip was transferred to the new Kontron FTP server. Update the specifications website accordingly. The outdated sensors how-to was omitted. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230226014830.10929-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 914b2fd2cd928f1eccd753e30707800b53acbeec Author: Rob Herring Date: Fri Mar 10 08:47:06 2023 -0600 hwmon: (ibmpowernv, pwm-fan) Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230310144706.1542434-1-robh@kernel.org Signed-off-by: Guenter Roeck commit 50c3480b6db859ce2c5f524eedb74973342455d0 Author: Rob Herring Date: Fri Mar 10 08:47:07 2023 -0600 hwmon: (ltc4245) Use of_property_read_bool() for boolean properties It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. Convert reading boolean properties to of_property_read_bool(). Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230310144707.1542525-1-robh@kernel.org Signed-off-by: Guenter Roeck commit 08d40c1d57b7127cfdebbc0648b57d54e38f2ba7 Author: Andy Shevchenko Date: Fri Feb 17 21:16:00 2023 +0200 hwmon: (nct6775) Drop unneeded casting and conjunction The 64-bit result will be cut to 32-bit automatically (by compiler) due to the type of the destination value. No need to have an explicit casting and especially additional conjunction which does the same. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230217191600.24837-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck commit 4a148e9b1ee04e608263fa9536a96214d5561220 Author: Aleksandr Mezin Date: Sun Feb 19 12:59:19 2023 +0200 hwmon: (nzxt-smart2) add another USB ID This seems to be a new revision of the device. RGB controls have changed, but this driver doesn't touch them anyway. Fan speed control reported to be working with existing userspace (hidraw) software, so I assume it's compatible. Fan channel count is the same. Recently added (0x1e71, 0x2019) seems to be the same device. Discovered in liquidctl project: https://github.com/liquidctl/liquidctl/issues/541 Signed-off-by: Aleksandr Mezin Link: https://lore.kernel.org/r/20230219105924.333007-1-mezin.alexander@gmail.com Signed-off-by: Guenter Roeck commit 8107fe93896dee8f159c8cb4ec8ec18656fbcd96 Author: Krzysztof Kozlowski Date: Sun Mar 12 20:37:22 2023 +0100 hwmon: (gpio-fan) drop of_match_ptr for ID table The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). This also fixes !CONFIG_OF error: drivers/hwmon/gpio-fan.c:484:34: error: ‘of_gpio_fan_match’ defined but not used [-Werror=unused-const-variable=] Note(groeck): The build error is only seen if Kconfig dependencies are messed up. The driver depends on OF_GPIO which should depend on OF. This was temporarily broken in linux-next, and it was possible to select CONFIG_OF=n and CONFIG_SENSORS_GPIO_FAN=y. Nevertheless, this is a sensible fix. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230312193723.478032-1-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck commit 629f57a7d5b9533313f41c79f8ae52c953b261f6 Merge: 0c072385348e3 d8cc9415a40f4 Author: Guenter Roeck Date: Wed Apr 19 07:08:24 2023 -0700 Merge branch 'hwmon-const' into HEAD commit 0c072385348e3ac5229145644055d3e2afb5b3db Author: Babu Moger Date: Thu Apr 13 16:39:58 2023 -0500 hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write Spec says, when CUR_TEMP_TJ_SEL == 3 and CUR_TEMP_RANGE_SEL == 0, it should use RangeUnadjusted is 0, which is (CurTmp*0.125 -49) C. The CUR_TEMP register is read-write when CUR_TEMP_TJ_SEL == 3 (bit 17-16). Add the check to detect it. Sensors command's output before the patch. $sensors k10temp-pci-00c3 Adapter: PCI adapter Tctl: +76.6°C <- Wrong value Tccd1: +26.5°C Tccd2: +27.5°C Tccd3: +27.2°C Tccd4: +27.5°C Tccd5: +26.0°C Tccd6: +26.2°C Tccd7: +25.0°C Tccd8: +26.5°C Sensors command's output after the patch. $sensors k10temp-pci-00c3 Adapter: PCI adapter Tctl: +28.8°C <- corrected value Tccd1: +27.5°C Tccd2: +28.5°C Tccd3: +28.5°C Tccd4: +28.5°C Tccd5: +27.0°C Tccd6: +27.5°C Tccd7: +27.0°C Tccd8: +27.5°C Signed-off-by: Babu Moger Fixes: 1b59788979ac ("hwmon: (k10temp) Add temperature offset for Ryzen 2700X") Link: https://lore.kernel.org/r/20230413213958.847634-1-babu.moger@amd.com Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac Author: John Paul Adrian Glaubitz Date: Wed Apr 19 13:48:52 2023 +0200 sh: sq: Fix incorrect element size for allocating bitmap buffer The Store Queue code allocates a bitmap buffer with the size of multiple of sizeof(long) in sq_api_init(). While the buffer size is calculated correctly, the code uses the wrong element size to allocate the buffer which results in the allocated bitmap buffer being too small. Fix this by allocating the buffer with kcalloc() with element size sizeof(long) instead of kzalloc() whose elements size defaults to sizeof(char). Fixes: d7c30c682a27 ("sh: Store Queue API rework.") Reviewed-by: Geert Uytterhoeven Signed-off-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de commit 8f12692b7e61e5fb5d3e4f6692d6675f62eeebdc Author: Ian Rogers Date: Wed Apr 19 10:48:37 2023 -0300 perf maps: Add reference count checking Add reference count checking to make sure of good use of get and put. Add and use accessors to reduce RC_CHK clutter. The only significant issue was in tests/thread-maps-share.c where reference counts were released in the reverse order to acquisition, leading to a use after put. This was fixed by reversing the put order. Committer notes: Extracted from a larger patch removing bits that were covered by the use of pre-existing maps__ accessors (e.g. maps__nr_maps()) and new ones added (maps__refcnt()) to reduce RC_CHK_ACCESS(maps)-> source code pollution. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexey Bayduraev Cc: Dmitriy Vyukov Cc: Jiri Olsa Cc: Namhyung Kim Cc: Riccardo Mancini Cc: Stephane Eranian Cc: Stephen Brennan Link: https://lore.kernel.org/lkml/20230407230405.2931830-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a07dacad8ac40d1beadb640fe341b5198c1cf097 Author: Arnaldo Carvalho de Melo Date: Tue Apr 18 17:45:34 2023 -0300 perf maps: Use maps__nr_maps() instead of open coded maps->nr_maps To use the existing accessor and be consistent. Signef-off-by: Arnaldo Carvalho de Melo commit fe693d951e3c303b4fb6c712f8affecbe9e8b001 Author: Arnaldo Carvalho de Melo Date: Tue Apr 18 17:33:48 2023 -0300 perf maps: Add maps__refcnt() accessor to allow checking maps pointer To remove one more direct access to 'struct maps' so that we can intercept accesses to its instantiations and refcount check it to catch use after free, etc. Signed-off-by: Arnaldo Carvalho de Melo commit 3ad1be6faef9a482c3098928220fcafaa51a1283 Author: Arnaldo Carvalho de Melo Date: Tue Apr 18 12:46:02 2023 -0300 perf dso: Fix use before NULL check introduced by map__dso() introduction James Clark noticed that the recent 63df0e4bc368adbd ("perf map: Add accessor for dso") patch accessed map->dso before the 'map' variable was NULL checked, which is a change in logic that leads to segmentation faults, so comb thru that patch to fix similar cases. Fixes: 63df0e4bc368adbd ("perf map: Add accessor for dso") Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Link: https://lore.kernel.org/lkml/ZD68RYCVT8hqPuxr@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a7b3a470fdea9f4a7daa5ae446c4e27c65f00aac Merge: ca9d081b49cc2 ef9f643a9f8b6 Author: Greg Kroah-Hartman Date: Wed Apr 19 15:09:40 2023 +0200 Merge tag 'cacheinfo-updates-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into driver-core-next Sudeep writes: cacheinfo and arch_topology updates for v6.4 The cache information can be extracted from either a Device Tree(DT), the PPTT ACPI table, or arch registers (clidr_el1 for arm64). When the DT is used but no cache properties are advertised, the current code doesn't correctly fallback to using arch information. The changes fixes the same and also assuse the that L1 data/instruction caches are private and L2/higher caches are shared when the cache information is missing in DT/ACPI and is derived form clidr_el1/arch registers. Currently the cacheinfo is built from the primary CPU prior to secondary CPUs boot, if the DT/ACPI description contains cache information. However, if not present, it still reverts to the old behavior, which allocates the cacheinfo memory on each secondary CPUs which causes RT kernels to triggers a "BUG: sleeping function called from invalid context". The changes here attempts to enable automatic detection for RT kernels when no DT/ACPI cache information is available, by pre-allocating cacheinfo memory on the primary CPU. * tag 'cacheinfo-updates-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: cacheinfo: Add use_arch[|_cache]_info field/function arch_topology: Remove early cacheinfo error message if -ENOENT cacheinfo: Check cache properties are present in DT cacheinfo: Check sib_leaf in cache_leaves_are_shared() cacheinfo: Allow early level detection when DT/ACPI info is missing/broken cacheinfo: Add arm64 early level initializer implementation cacheinfo: Add arch specific early level initializer commit 0989ffb31cff794506f5d3dd109574ddbb9b983a Author: Alain Volmat Date: Sun Apr 16 21:05:01 2023 +0200 irqchip/st: Remove stih415/stih416 and stid127 platforms support Remove support for the already no more supported stih415 and stih416 platforms. Remove as well the stid127 platform which never made it up to the kernel. Signed-off-by: Alain Volmat Reviewed-by: Patrice Chotard Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230416190501.18737-1-avolmat@me.com commit 12124d16726ca7d9cb1eb8725767cbcfb96195c8 Merge: 3fcf52b71161d 18996a113f256 Author: Greg Kroah-Hartman Date: Wed Apr 19 15:08:11 2023 +0200 Merge tag 'coresight-next-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: Updates for v6.4 This is a relatively smaller update for CoreSight tracing subsystem targeting v6.4, with the following changes: - Removing Mathieu Poirier as MAINTAINER for the subsystem, with updates to CREDITS for his contributions. - Fix CoreSight ETM PMU to set the module field Signed-off-by: Suzuki K Poulose * tag 'coresight-next-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux: coresight: etm_pmu: Set the module field MAINTAINERS: Remove Mathieu Poirier as coresight maintainer commit 3fcf52b71161d52ae47fa4dd2c4911125fe11cc5 Merge: 2a1dd5c88ce3b b7590f3841f47 Author: Greg Kroah-Hartman Date: Wed Apr 19 15:07:09 2023 +0200 Merge tag 'icc-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.4 This pull request contains the interconnect changes for the 6.4-rc1 merge window, which this time are mostly cleanups. Core changes: interconnect: Skip call into provider if initial bw is zero interconnect: Use of_property_present() for testing DT property presence interconnect: drop racy registration API interconnect: drop unused icc_link_destroy() interface Driver changes: interconnect: qcom: Drop obsolete dependency on COMPILE_TEST interconnect: qcom: drop obsolete OSM_L3/EPSS defines interconnect: qcom: osm-l3: drop unuserd header inclusion interconnect: qcom: rpm: drop bogus pm domain attach interconnect: qcom: rpm: make QoS INVALID default interconnect: qcom: rpm: Add support for specifying channel num interconnect: qcom: Sort kerneldoc entries dt-bindings: interconnect: OSM L3: Add SM6375 CPUCP compatible dt-bindings: interconnect: qcom,msm8998-bwmon: Resolve MSM8998 support Signed-off-by: Georgi Djakov * tag 'icc-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: dt-bindings: interconnect: qcom,msm8998-bwmon: Resolve MSM8998 support dt-bindings: interconnect: OSM L3: Add SM6375 CPUCP compatible interconnect: qcom: Sort kerneldoc entries interconnect: qcom: rpm: Add support for specifying channel num interconnect: qcom: rpm: make QoS INVALID default interconnect: qcom: rpm: drop bogus pm domain attach interconnect: drop unused icc_link_destroy() interface interconnect: drop racy registration API interconnect: Use of_property_present() for testing DT property presence interconnect: qcom: osm-l3: drop unuserd header inclusion interconnect: qcom: drop obsolete OSM_L3/EPSS defines interconnect: Skip call into provider if initial bw is zero interconnect: qcom: Drop obsolete dependency on COMPILE_TEST commit 2a1dd5c88ce3b43b9fa9b4f61a847f0a13371bb7 Merge: 7e9fa830be059 1d1493bdc25f4 Author: Greg Kroah-Hartman Date: Wed Apr 19 15:06:11 2023 +0200 Merge tag 'mhi-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host ======== Core ---- - Removed the "mhi_poll()" API as there are no in-kernel users available at the moment. - Added range check for the CHDBOFF and ERDBOFF registers in case the device reports bad values. - Fixed the errno for the rest of the range checks to use -ERANGE. - Modified the event ring handlers to ring the doorbell only if there are any pending elements in the ring to process for the device. - Removed the check for EE (Execution Environment) while processing the SYS_ERR transition as it creates device recovery issues when SBL (Secondary Bootloader) crashes early. - Used mhi_tryset_pm_state() API to set the error state instead of open coding if the firmware loading fails. This avoids the race with other pm_state updates. pci_generic ----------- - Dropped the dedundant pci_{enable/disable}_pcie_error_reporting() calls from driver probe's error path as the PCI core itself takes care of that now. - Revered the commit 2d5253a096c6 ("bus: mhi: host: pci_generic: Add a secondary AT port to Telit FN990") as it turned out to be erroneous. This happened due to the patch adding secondary AT port for FN990 getting applied through NET and MHI trees and this caused two commits for the same functionality but one of them ended up wrong. - Added support for Foxconn T99W510 modem based on SDX24 chipset from Qualcomm. MHI Endpoint ============ - Demoted the channel not supported error log to debug as not all devices will support all channels defined in MHI spec and this may spam users. * tag 'mhi-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: Use mhi_tryset_pm_state() for setting fw error state bus: mhi: host: Remove duplicate ee check for syserr bus: mhi: host: Avoid ringing EV DB if there are no elements to process bus: mhi: pci_generic: Add Foxconn T99W510 bus: mhi: host: Use ERANGE for BHIOFF/BHIEOFF range check bus: mhi: host: Range check CHDBOFF and ERDBOFF bus: mhi: host: pci_generic: Revert "Add a secondary AT port to Telit FN990" bus: mhi: host: pci_generic: Drop redundant pci_enable_pcie_error_reporting() bus: mhi: ep: Demote unsupported channel error log to debug bus: mhi: host: Remove mhi_poll() API commit 574399f4c997ad71fab95dd875a9ff55424f9a3d Author: Christophe JAILLET Date: Sun Apr 16 08:29:34 2023 +0200 ASoC: fsl: Simplify an error message dev_err_probe() already display the error code. There is no need to duplicate it explicitly in the error message. Signed-off-by: Christophe JAILLET Reviewed-by: Iuliana Prodan Acked-by: Shengjiu Wang Link: https://lore.kernel.org/r/c167c16a535049d56f817bbede9c9f6f0a0f4c68.1681626553.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit 4e195166624851d1da1a4e42110e66ee4faca4a3 Author: Corinna Vinschen Date: Mon Apr 17 21:29:03 2023 +0200 stmmac: fix changing mac address Without the IFF_LIVE_ADDR_CHANGE flag being set, the network code disallows changing the mac address while the interface is UP. Consequences are, for instance, that the interface can't be used in a failover bond. Add the missing flag to net_device priv_flags. Tested on Intel Elkhart Lake with default settings, as well as with failover and alb mode bonds. Signed-off-by: Corinna Vinschen Signed-off-by: David S. Miller commit fbb192a836bee873e4e94c5deca19bf558ab7bb9 Merge: 4edd97fbdc23e 48d80c394d3d1 Author: David S. Miller Date: Wed Apr 19 13:04:31 2023 +0100 Merge branch 'skbuff-bitfields' Jakub Kicinski says: ==================== net: skbuff: hide some bitfield members There is a number of protocol or subsystem specific fields in struct sk_buff which are only accessed by one subsystem. We can wrap them in ifdefs with minimal code impact. This gives us a better chance to save a 2B and a 4B holes resulting with the following savings (assuming a lucky kernel config): - /* size: 232, cachelines: 4, members: 28 */ - /* sum members: 227, holes: 1, sum holes: 4 */ - /* sum bitfield members: 8 bits (1 bytes) */ + /* size: 224, cachelines: 4, members: 28 */ /* forced alignments: 2 */ - /* last cacheline: 40 bytes */ + /* last cacheline: 32 bytes */ I think that the changes shouldn't be too controversial. The only one I'm not 100% sure of is the SCTP one, 12 extra LoC for one bit.. But it did fit squarely in the "this bit has only one user" category. ==================== Signed-off-by: David S. Miller Acked-by: Simon Horman commit 48d80c394d3d1afcb49d26398917f5be27bf44cb Author: Jakub Kicinski Date: Mon Apr 17 08:53:50 2023 -0700 net: skbuff: hide nf_trace and ipvs_property Accesses to nf_trace and ipvs_property are already wrapped by ifdefs where necessary. Don't allocate the bits for those fields at all if possible. Acked-by: Florian Westphal Acked-by: Simon Horman Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 4c60d04c2888a542f96fe77ecbdfc242b484f943 Author: Jakub Kicinski Date: Mon Apr 17 08:53:49 2023 -0700 net: skbuff: push nf_trace down the bitfield nf_trace is a debug feature, AFAIU, and yet it sits oddly high in the sk_buff bitfield. Move it down, pushing up dst_pending_confirm and inner_protocol_type. Next change will make nf_trace optional (under Kconfig) and all optional fields should be placed after 2b fields to avoid 2b fields straddling bytes. dst_pending_confirm is L3, so it makes sense next to ignore_df. inner_protocol_type goes up just to keep the balance. Acked-by: Florian Westphal Reviewed-by: Florian Fainelli Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 4398f3f6d1380d9f71a484e1e5d869ba0eaf23d5 Author: Jakub Kicinski Date: Mon Apr 17 08:53:48 2023 -0700 net: skbuff: move alloc_cpu into a potential hole alloc_cpu is currently between 4 byte fields, so it's almost guaranteed to create a 2B hole. It has a knock on effect of creating a 4B hole after @end (and @end and @tail being in different cachelines). None of this matters hugely, but for kernel configs which don't enable all the features there may well be a 2B hole after the bitfield. Move alloc_cpu there. Reviewed-by: Florian Fainelli Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit c24831a13ba2e472f874483525084da2f2feb890 Author: Jakub Kicinski Date: Mon Apr 17 08:53:47 2023 -0700 net: skbuff: hide csum_not_inet when CONFIG_IP_SCTP not set SCTP is not universally deployed, allow hiding its bit from the skb. Reviewed-by: Florian Fainelli Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit eb6fba7555a812c07aa984fb9e8e9b151a65ca16 Author: Jakub Kicinski Date: Mon Apr 17 08:53:46 2023 -0700 net: skbuff: hide wifi_acked when CONFIG_WIRELESS not set Datacenter kernel builds will very likely not include WIRELESS, so let them shave 2 bits off the skb by hiding the wifi fields. Reviewed-by: Florian Fainelli Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski Acked-by: Johannes Berg Signed-off-by: David S. Miller commit 4edd97fbdc23e917ef0787dbf0ccc543b400bb34 Merge: 158441884772a c693ea2fd6e3b Author: David S. Miller Date: Wed Apr 19 12:59:17 2023 +0100 Merge branch 'switch-phy-leds' Christian Marangi says: ==================== net: Add basic LED support for switch/phy This is a continue of [1]. It was decided to take a more gradual approach to implement LEDs support for switch and phy starting with basic support and then implementing the hw control part when we have all the prereq done. This series implements only the brightness_set() and blink_set() ops. An example of switch implementation is done with qca8k. For PHY a more generic approach is used with implementing the LED support in PHY core and with the user (in this case marvell) adding all the required functions. Currently we set the default-state as "keep" to not change the default configuration of the declared LEDs since almost every switch have a default configuration. [1] https://lore.kernel.org/lkml/20230216013230.22978-1-ansuelsmth@gmail.com/ Changes in new series v7: - Drop ethernet-leds schema and add unevaluatedProperties to ethernet-controller and ethernet-phy schema - Drop function-enumerator binding from schema example and DT - Set devname_mandatory for qca8k leds and assign better name to LEDs using the format {slave_mii_bus id}:0{port number}:{color}:{function} - Add Documentation patch for Correct LEDs naming from Andrew - Changes in Andrew patch: - net: phy: Add a binding for PHY LEDs - Convert index from u32 to u8 - net: phy: phy_device: Call into the PHY driver to set LED brightness - Fixup kernel doc - Convert index from u32 to u8 - net: phy: marvell: Add software control of the LEDs - Convert index from u32 to u8 - net: phy: phy_device: Call into the PHY driver to set LED blinking - Kernel doc fix - Convert index from u32 to u8 - net: phy: marvell: Implement led_blink_set() - Convert index from u32 to u8 Changes in new series v6: - Add leds-ethernet.yaml to document reg in led node - Update ethernet-controller and ethernet-phy to follow new leds-ethernet schema - Fix comments in qca8k-leds.c (at least -> at most) (wrong GENMASK for led phy 0 and 4) - Add review and ack tag from Pavel Machek - Changes in Andrew patch: - leds: Provide stubs for when CLASS_LED & NEW_LEDS are disabled - Change LED_CLASS to NEW_LEDS for led_init_default_state_get() - net: phy: Add a binding for PHY LEDs - Add dependency on LED_CLASS - Drop review tag from Michal Kubiak (patch modified) Changes in new series v5: - Rebase everything on top of net-next/main - Add more info on LED probe fail for qca8k - Drop some additional raw number and move to define in qca8k header - Add additional info on LED mapping on qca8k regs - Checks port number in qca8k switch port parse - Changes in Andrew patch: - Add additional patch for stubs when CLASS_LED disabled - Drop CLASS_LED dependency for PHYLIB (to fix kbot errors reported) Changes in new series v4: - Changes in Andrew patch: - net: phy: Add a binding for PHY LEDs: - Rename phy_led: led_list to list - Rename phy_device: led_list to leds - Remove phy_leds_remove() since devm_ should do what is needed - Fixup documentation for struct phy_led - Fail probe on LED errors - net: phy: phy_device: Call into the PHY driver to set LED brightness - Moved phy_led::phydev from previous patch to here since it is first used here. - net: phy: marvell: Implement led_blink_set() - Use int instead of unsigned - net: phy: marvell: Add software control of the LEDs - Use int instead of unsigned - Add depends on LED_CLASS for qca8k Kconfig - Fix Makefile for qca8k as suggested - Move qca8k_setup_led_ctrl to separate header - Move Documentation from dsa-port to ethernet-controller - Drop trailing . from Andrew patch fro consistency Changes in new series v3: - Move QCA8K_LEDS Kconfig option from tristate to bool - Use new helper led_init_default_state_get for default-state in qca8k - Drop cled_qca8k_brightness_get() as there isn't a good way to describe the mode the led is currently in - Rework qca8k_led_brightness_get() to return true only when LED is set to always ON Changes in new series v2: - Add LEDs node for rb3011 - Fix rb3011 switch node unevaluated properties while running make dtbs_check - Fix a copypaste error in qca8k-leds.c for port 4 required shift - Drop phy-handle usage for qca8k and use qca8k_port_to_phy() - Add review tag from Andrew - Add Christian Marangi SOB in each Andrew patch - Add extra description for dsa-port stressing that PHY have no access and LED are controlled by the related MAC - Add missing additionalProperties for dsa-port.yaml and ethernet-phy.yaml Changes from the old v8 series: - Drop linux,default-trigger set to netdev. - Dropped every hw control related patch and implement only blink_set and brightness_set - Add default-state to "keep" for each LED node example ==================== Signed-off-by: David S. Miller commit c693ea2fd6e3b43f6caaf618f864236c36a71f70 Author: Andrew Lunn Date: Mon Apr 17 17:17:38 2023 +0200 Documentation: LEDs: Describe good names for network LEDs Network LEDs can exist in both the MAC and the PHY. Naming is difficult because the netdev name is neither stable or unique, do to commands like ip link set name eth42 dev eth0, and network namesspaces. Give some example names where the MAC and the PHY have unique names based on device tree nodes, or PCI bus addresses. Since the LED can be used for anything which Linux supports for LEDs, avoid using names like activity or link, rather describe the location on the RJ-45, of what the RJ-45 is expected to be used for, WAN/LAN etc. Signed-off-by: Andrew Lunn Signed-off-by: Christian Marangi Signed-off-by: David S. Miller commit 380a8fe1b2f49f262673485d1c7f1c0da170a926 Author: Andrew Lunn Date: Mon Apr 17 17:17:37 2023 +0200 arm: mvebu: dt: Add PHY LED support for 370-rd WAN port The WAN port of the 370-RD has a Marvell PHY, with one LED on the front panel.y List this LED in the device tree. Signed-off-by: Andrew Lunn Signed-off-by: Christian Marangi Signed-off-by: David S. Miller commit 18a24b694a2bfd59ae8a17ffee87f12c65d9f2a6 Author: Christian Marangi Date: Mon Apr 17 17:17:36 2023 +0200 dt-bindings: net: phy: Document support for LEDs node Document support for LEDs node in phy and add an example for it. PHY LED will have to match led pattern and should be treated as a generic led. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 09930f1fb8750d5f4e668ab40733ab63cab58ed7 Author: Christian Marangi Date: Mon Apr 17 17:17:35 2023 +0200 ARM: dts: qcom: ipq8064-rb3011: Add Switch LED for each port Add Switch LED for each port for MikroTik RB3011UiAS-RM. MikroTik RB3011UiAS-RM is a 10 port device with 2 qca8337 switch chips connected. It was discovered that in the hardware design all 3 Switch LED trace of the related port is connected to the same LED. This was discovered by setting to 'always on' the related led in the switch regs and noticing that all 3 LED for the specific port (for example for port 1) cause the connected LED for port 1 to turn on. As an extra test we tried enabling 2 different LED for the port resulting in the LED turned off only if every led in the reg was off. Aside from this funny and strange hardware implementation, the device itself have one green LED for each port, resulting in 10 green LED one for each of the 10 supported port. Cc: Jonathan McDowell Signed-off-by: Christian Marangi Signed-off-by: David S. Miller commit 939595c79d12bb18e3784bc3faa2ddd2df41f70f Author: Christian Marangi Date: Mon Apr 17 17:17:34 2023 +0200 ARM: dts: qcom: ipq8064-rb3011: Drop unevaluated properties in switch nodes IPQ8064 MikroTik RB3011UiAS-RM DT have currently unevaluted properties in the 2 switch nodes. The bindings #address-cells and #size-cells are redundant and cause warning for 'Unevaluated properties are not allowed'. Drop these bindings to mute these warning as they should not be there from the start. Cc: Jonathan McDowell Signed-off-by: Christian Marangi Reviewed-by: Jonathan McDowell Tested-by: Jonathan McDowell Signed-off-by: David S. Miller commit ed617bc022f4596dc03815e8f0331e60644d07ee Author: Christian Marangi Date: Mon Apr 17 17:17:33 2023 +0200 dt-bindings: net: dsa: qca8k: add LEDs definition example Add LEDs definition example for qca8k Switch Family to describe how they should be defined for a correct usage. Signed-off-by: Christian Marangi Signed-off-by: David S. Miller commit 57b6c752c5c05a1f38eb6da9f1618f1b000e1f51 Author: Christian Marangi Date: Mon Apr 17 17:17:32 2023 +0200 dt-bindings: net: ethernet-controller: Document support for LEDs node Document support for LEDs node in ethernet-controller. Ethernet Controller may support different LEDs that can be configured for different operation like blinking on traffic event or port link. Also add some Documentation to describe the difference of these nodes compared to PHY LEDs, since ethernet-controller LEDs are controllable by the ethernet controller regs and the possible intergated PHY doesn't have control on them. Signed-off-by: Christian Marangi Signed-off-by: David S. Miller commit ea9e86485decb2ac1750005bd96c166c9b780406 Author: Andrew Lunn Date: Mon Apr 17 17:17:31 2023 +0200 net: phy: marvell: Implement led_blink_set() The Marvell PHY can blink the LEDs, simple on/off. All LEDs blink at the same rate, and the reset default is 84ms per blink, which is around 12Hz. Signed-off-by: Andrew Lunn Signed-off-by: Christian Marangi Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 4e901018432e38eab35d2a352661ce4727795be1 Author: Andrew Lunn Date: Mon Apr 17 17:17:30 2023 +0200 net: phy: phy_device: Call into the PHY driver to set LED blinking Linux LEDs can be requested to perform hardware accelerated blinking. Pass this to the PHY driver, if it implements the op. Signed-off-by: Andrew Lunn Signed-off-by: Christian Marangi Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 2d3960e58ef7c83fe1dbf952f056b9e906cb6df8 Author: Andrew Lunn Date: Mon Apr 17 17:17:29 2023 +0200 net: phy: marvell: Add software control of the LEDs Add a brightness function, so the LEDs can be controlled from software using the standard Linux LED infrastructure. Signed-off-by: Andrew Lunn Signed-off-by: Christian Marangi Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 684818189b04b095b34964ed4a3ea5249a840eab Author: Andrew Lunn Date: Mon Apr 17 17:17:28 2023 +0200 net: phy: phy_device: Call into the PHY driver to set LED brightness Linux LEDs can be software controlled via the brightness file in /sys. LED drivers need to implement a brightness_set function which the core will call. Implement an intermediary in phy_device, which will call into the phy driver if it implements the necessary function. Signed-off-by: Andrew Lunn Signed-off-by: Christian Marangi Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 01e5b728e9e43ae444e0369695a5f72209906464 Author: Andrew Lunn Date: Mon Apr 17 17:17:27 2023 +0200 net: phy: Add a binding for PHY LEDs Define common binding parsing for all PHY drivers with LEDs using phylib. Parse the DT as part of the phy_probe and add LEDs to the linux LED class infrastructure. For the moment, provide a dummy brightness function, which will later be replaced with a call into the PHY driver. This allows testing since the LED core might otherwise reject an LED whose brightness cannot be set. Add a dependency on LED_CLASS. It either needs to be built in, or not enabled, since a modular build can result in linker errors. Signed-off-by: Andrew Lunn Signed-off-by: Christian Marangi Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e5029edd53937a29801ef507cee12e657ff31ea9 Author: Andrew Lunn Date: Mon Apr 17 17:17:26 2023 +0200 leds: Provide stubs for when CLASS_LED & NEW_LEDS are disabled Provide stubs for devm_led_classdev_register_ext() and led_init_default_state_get() so that LED drivers embedded within other drivers such as PHYs and Ethernet switches still build when LEDS_CLASS or NEW_LEDS are disabled. This also helps with Kconfig dependencies, which are somewhat hairy for phylib and mdio and only get worse when adding a dependency on LED_CLASS. Signed-off-by: Andrew Lunn Signed-off-by: Christian Marangi Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 91acadcc6e599dfc62717abcdad58a459cfb1684 Author: Christian Marangi Date: Mon Apr 17 17:17:25 2023 +0200 net: dsa: qca8k: add LEDs blink_set() support Add LEDs blink_set() support to qca8k Switch Family. These LEDs support hw accellerated blinking at a fixed rate of 4Hz. Reject any other value since not supported by the LEDs switch. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Acked-by: Pavel Machek Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 1e264f9d2918b5737023c44a23ae04def1095210 Author: Christian Marangi Date: Mon Apr 17 17:17:24 2023 +0200 net: dsa: qca8k: add LEDs basic support Add LEDs basic support for qca8k Switch Family by adding basic brightness_set() support. Since these LEDs refelect port status, the default label is set to ":port". DT binding should describe the color and function of the LEDs using standard LEDs api. Each LED always have the device name as prefix. The device name is composed from the mii bus id and the PHY addr resulting in example names like: - qca8k-0.0:00:amber:lan - qca8k-0.0:00:white:lan - qca8k-0.0:01:amber:lan - qca8k-0.0:01:white:lan These LEDs supports only blocking variant of the brightness_set() function since they can sleep during access of the switch leds to set the brightness. While at it add to the qca8k header file each mode defined by the Switch Documentation for future use. Signed-off-by: Christian Marangi Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 3e8b4d6277fd19d98c817576954dd6a4ff3caa2b Author: Christian Marangi Date: Mon Apr 17 17:17:23 2023 +0200 net: dsa: qca8k: move qca8k_port_to_phy() to header Move qca8k_port_to_phy() to qca8k header as it's useful for future reference in Switch LEDs module since the same logic is applied to get the right index of the switch port. Make it inline as it's simple function that just decrease the port. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Reviewed-by: Michal Kubiak Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 158441884772a19e840429e210bfd1879094306b Author: Jaime Breva Date: Mon Apr 17 08:07:24 2023 +0200 net: wwan: Expose secondary AT port on DATA1 Our use-case needs two AT ports available: One for running a ppp daemon, and another one for management This patch enables a second AT port on DATA1 Signed-off-by: Jaime Breva Signed-off-by: David S. Miller commit 73db1b8f2bb6725b7391e85aab41fdf592b3c0c1 Author: Tzung-Bi Shih Date: Wed Apr 19 13:15:26 2023 +0800 netfilter: conntrack: fix wrong ct->timeout value (struct nf_conn)->timeout is an interval before the conntrack confirmed. After confirmed, it becomes a timestamp. It is observed that timeout of an unconfirmed conntrack: - Set by calling ctnetlink_change_timeout(). As a result, `nfct_time_stamp` was wrongly added to `ct->timeout` twice. - Get by calling ctnetlink_dump_timeout(). As a result, `nfct_time_stamp` was wrongly subtracted. Call Trace: dump_stack_lvl ctnetlink_dump_timeout __ctnetlink_glue_build ctnetlink_glue_build __nfqnl_enqueue_packet nf_queue nf_hook_slow ip_mc_output ? __pfx_ip_finish_output ip_send_skb ? __pfx_dst_output udp_send_skb udp_sendmsg ? __pfx_ip_generic_getfrag sock_sendmsg Separate the 2 cases in: - Setting `ct->timeout` in __nf_ct_set_timeout(). - Getting `ct->timeout` in ctnetlink_dump_timeout(). Pablo appends: Update ctnetlink to set up the timeout _after_ the IPS_CONFIRMED flag is set on, otherwise conntrack creation via ctnetlink breaks. Note that the problem described in this patch occurs since the introduction of the nfnetlink_queue conntrack support, select a sufficiently old Fixes: tag for -stable kernel to pick up this fix. Fixes: a4b4766c3ceb ("netfilter: nfnetlink_queue: rename related to nfqueue attaching conntrack info") Signed-off-by: Tzung-Bi Shih Signed-off-by: Pablo Neira Ayuso commit ced7c981f382fc34b941ee3b861d49bdd9180af4 Merge: 8e86652e3e715 1f15af76784cc Author: Greg Kroah-Hartman Date: Wed Apr 19 11:42:44 2023 +0200 Merge tag 'thunderbolt-for-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v6.4 merge window This includes following Thunderbolt/USB4 changes for the v6.4 merge window: - Refactoring of DROM read code paths - Convert to use SI units from units.h - A couple of cleanups All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Introduce usb4_port_sb_opcode_err_to_errno() helper thunderbolt: Make use of SI units from units.h thunderbolt: Get rid of redundant 'else' thunderbolt: Refactor DROM reading thunderbolt: use `tb_eeprom_get_drom_offset` to discover DROM offset commit 63f148c44f3919047301a023b10b0e3ce65a7389 Author: John Paul Adrian Glaubitz Date: Wed Apr 19 09:09:33 2023 +0200 sh: pci: Remove unused variable in SH-7786 PCI Express code Addresses the following warning when building sdk7786_defconfig: arch/sh/drivers/pci/pcie-sh7786.c:34:22: warning: 'dma_pfn_offset' defined but not used [-Wunused-variable] 34 | static unsigned long dma_pfn_offset; | ^~~~~~~~~~~~~~ Fixes: e0d072782c73 ("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset") Reviewed-by: Geert Uytterhoeven Signed-off-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230419070934.422997-1-glaubitz@physik.fu-berlin.de commit 3b522cadedfe6e9e0e8193d7d4ab5aa8d0c73209 Author: Ryder Lee Date: Wed Apr 19 13:58:40 2023 +0800 wifi: mt76: mt7996: fill txd by host driver The hardware SDO has issue to fill txd for the moment, so fallback to driver filling method. Fixes: 98686cd21624 (wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices) Signed-off-by: Ryder Lee Signed-off-by: Felix Fietkau commit 230a167e094770fdcc104481719ef7b1a706fb27 Author: Felix Fietkau Date: Thu Mar 30 11:07:52 2023 +0200 wifi: mt76: set NL80211_EXT_FEATURE_CAN_REPLACE_PTK0 on supported drivers Drivers that do not generate IV/PN in software can safely rekey PTK0 Signed-off-by: Felix Fietkau commit f4d63a87b527de258eec5bd6e9547f063d472b79 Author: Felix Fietkau Date: Sat Dec 31 08:44:33 2022 +0100 wifi: mt76: dma: use napi_build_skb Improves performance by using bulk allocation Signed-off-by: Felix Fietkau commit e12b2e99b8799f26432528934edc8677888ad72f Author: Felix Fietkau Date: Fri Nov 11 19:50:46 2022 +0100 wifi: mt76: mt7615: increase eeprom size for mt7663 mt7663 efuse has 0x600 bytes instead of 0x400. Increase the size in order to fix issues with incomplete calibration data Signed-off-by: Felix Fietkau commit 27db47ab1f47906c2392f9d246e244e412b19278 Author: Ryder Lee Date: Sun Mar 12 14:11:25 2023 +0800 wifi: mt76: mt7996: enable mesh HW amsdu/de-amsdu support This enables HW offloading amsdu/de-amsdu support for 802.11s mesh interface. Co-developed-by: Bo Jiao Signed-off-by: Bo Jiao Signed-off-by: Ryder Lee Signed-off-by: Felix Fietkau commit c2171b068beea766311e4c2858ef8497504c6e6d Author: Ryder Lee Date: Fri Apr 14 04:23:33 2023 +0800 wifi: mt76: mt7996: enable configured beacon tx rate The user is allowed to change beacon tx rate (HT/VHT/HE) from hostapd. Signed-off-by: Ryder Lee Signed-off-by: Felix Fietkau commit ab0eec4bf225c5e78fd10d764d536300376f8445 Author: Ryder Lee Date: Fri Apr 14 04:23:32 2023 +0800 wifi: mt76: mt7996: enable BSS_CHANGED_MCAST_RATE support Similar to BSS_CHANGED_BASIC_RATES, this enables mcast rate configuration through fixed rate tables. Signed-off-by: Ryder Lee Change-Id: Ifc305e8c7de9a7df4ad5f856e2097d721a886aaa Signed-off-by: Felix Fietkau commit 15ee62e73705df447971613de4fa660dd71ed40e Author: Ryder Lee Date: Fri Apr 14 04:23:31 2023 +0800 wifi: mt76: mt7996: enable BSS_CHANGED_BASIC_RATES support The connac3 removes fixed rate fields to reduce txd size and introduces global rate tables (64 entries) for rate setting. Driver needs to fill the corresponding idx in MT_TXD6_TX_RATE while tx, and push mt76_rate into predifined table at bootup stage so that mvif->basic_rates_idx can immediately switch out once setting changes. spe_idx is also needed for fixed rate frames, and will be updated by future patches. Note that all table entries are shared across driver and firmware (i.e.TxBF), hence adding MT7996_BASIC_RATES_TBL to reflect mapping status. Signed-off-by: Ryder Lee Signed-off-by: Felix Fietkau commit 2cdaa3eefed83082923cf219c8b6a314e622da74 Author: Pablo Neira Ayuso Date: Tue Apr 18 23:31:26 2023 +0200 netfilter: conntrack: restore IPS_CONFIRMED out of nf_conntrack_hash_check_insert() e6d57e9ff0ae ("netfilter: conntrack: fix rmmod double-free race") consolidates IPS_CONFIRMED bit set in nf_conntrack_hash_check_insert(). However, this breaks ctnetlink: # conntrack -I -p tcp --timeout 123 --src 1.2.3.4 --dst 5.6.7.8 --state ESTABLISHED --sport 1 --dport 4 -u SEEN_REPLY conntrack v1.4.6 (conntrack-tools): Operation failed: Device or resource busy This is a partial revert of the aforementioned commit to restore IPS_CONFIRMED. Fixes: e6d57e9ff0ae ("netfilter: conntrack: fix rmmod double-free race") Reported-by: Stéphane Graber Tested-by: Stéphane Graber Signed-off-by: Pablo Neira Ayuso commit cd02a1a24897ce8a5e32d29a11cb0a926fa6572a Merge: 14cac662235ea f52ac7028bec2 Author: David S. Miller Date: Wed Apr 19 08:59:27 2023 +0100 Merge branch 'mlx5e-xdp-extend' Tariq Toukan says: ==================== net/mlx5e: Extend XDP multi-buffer capabilities This series extends the XDP multi-buffer support in the mlx5e driver. Patchset breakdown: - Infrastructural changes and preparations. - Add XDP multi-buffer support for XDP redirect-in. - Use TX MPWQE (multi-packet WQE) HW feature for non-linear single-segmented XDP frames. - Add XDP multi-buffer support for striding RQ. In Striding RQ, we overcome the lack of headroom and tailroom between the RQ strides by allocating a side page per packet and using it for the xdp_buff descriptor. We structure the xdp_buff so that it contains nothing in the linear part, and the whole packet resides in the fragments. Performance highlight: Packet rate test, 64 bytes, 32 channels, MTU 9000 bytes. CPU: Intel(R) Xeon(R) Platinum 8380 CPU @ 2.30GHz. NIC: ConnectX-6 Dx, at 100 Gbps. +----------+-------------+-------------+---------+ | Test | Legacy RQ | Striding RQ | Speedup | +----------+-------------+-------------+---------+ | XDP_DROP | 101,615,544 | 117,191,020 | +15% | +----------+-------------+-------------+---------+ | XDP_TX | 95,608,169 | 117,043,422 | +22% | +----------+-------------+-------------+---------+ Series generated against net commit: e61caf04b9f8 Merge branch 'page_pool-allow-caching-from-safely-localized-napi' I'm submitting this directly as Saeed is traveling. ==================== Signed-off-by: David S. Miller commit f52ac7028bec22e925c8fece4f21641eb13b4d6f Author: Tariq Toukan Date: Mon Apr 17 15:19:03 2023 +0300 net/mlx5e: RX, Add XDP multi-buffer support in Striding RQ Here we add support for multi-buffer XDP handling in Striding RQ, which is our default out-of-the-box RQ type. Before this series, loading such an XDP program would fail, until you switch to the legacy RQ (by unsetting the rx_striding_rq priv-flag). To overcome the lack of headroom and tailroom between the strides, we allocate a side page to be used for the descriptor (xdp_buff / skb) and the linear part. When an XDP program is attached, we structure the xdp_buff so that it contains no data in the linear part, and the whole packet resides in the fragments. In case of XDP_PASS, where an SKB still needs to be created, we copy up to 256 bytes to its linear part, to match the current behavior, and satisfy functions that assume finding the packet headers in the SKB linear part (like eth_type_trans). Performance testing: Packet rate test, 64 bytes, 32 channels, MTU 9000 bytes. CPU: Intel(R) Xeon(R) Platinum 8380 CPU @ 2.30GHz. NIC: ConnectX-6 Dx, at 100 Gbps. +----------+-------------+-------------+---------+ | Test | Legacy RQ | Striding RQ | Speedup | +----------+-------------+-------------+---------+ | XDP_DROP | 101,615,544 | 117,191,020 | +15% | +----------+-------------+-------------+---------+ | XDP_TX | 95,608,169 | 117,043,422 | +22% | +----------+-------------+-------------+---------+ Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 2cb0e27d43b4eec70e20103cb09055303f70b6d9 Author: Tariq Toukan Date: Mon Apr 17 15:19:02 2023 +0300 net/mlx5e: RX, Prepare non-linear striding RQ for XDP multi-buffer support In preparation for supporting XDP multi-buffer in striding RQ, use xdp_buff struct to describe the packet. Make its skb_shared_info collide the one of the allocated SKB, then add the fragments using the xdp_buff API. Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 221c8c7ad7a2d414d6d64b5e5bbf7723ae23d3f5 Author: Tariq Toukan Date: Mon Apr 17 15:19:01 2023 +0300 net/mlx5e: RX, Generalize mlx5e_fill_mxbuf() Make the function more generic. Let it get an additional frame_sz parameter instead of deriving it from the RQ struct. No functional change here, just a preparation for a downstream patch. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 27602319e32862717c15c32283a727dc5bed695d Author: Tariq Toukan Date: Mon Apr 17 15:19:00 2023 +0300 net/mlx5e: RX, Take shared info fragment addition into a function Introduce mlx5e_add_skb_shared_info_frag(), a function dedicated for adding a fragment into a struct skb_shared_info object. Use it in the Legacy RQ flow. Similar usage will be added in a downstream patch by the corresponding Striding RQ flow. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 63abf14e13ed09ead1d979949963fe08ced3a77c Author: Tariq Toukan Date: Mon Apr 17 15:18:59 2023 +0300 net/mlx5e: XDP, Allow non-linear single-segment frames in XDP TX MPWQE Under a few restrictions, TX MPWQE feature can serve multiple TX packets in a single TX descriptor. It requires each of the packets to have a single scatter entry / segment. Today we allow only linear frames to use this feature, although there's no real problem with non-linear ones where the whole packet reside in the first fragment. Expand the XDP TX MPWQE feature support to include such frames. This is in preparation for the downstream patch, in which we will generate such non-linear frames. Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 124d0d8daf85ddf106a25ab0647e41b956e5cd38 Author: Tariq Toukan Date: Mon Apr 17 15:18:58 2023 +0300 net/mlx5e: XDP, Remove un-established assumptions on XDP buffer Remove the assumption of non-zero linear length in the XDP xmit function, used to serve both internal XDP_TX operations as well as redirected-in requests. Do not apply the MLX5E_XDP_MIN_INLINE check unless necessary. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 20409abe52b1de8cfdc0565d89b7bc6d159dba35 Author: Tariq Toukan Date: Mon Apr 17 15:18:57 2023 +0300 net/mlx5e: XDP, Consider large muti-buffer packets in Striding RQ params calculations Function mlx5e_rx_get_linear_stride_sz() returns PAGE_SIZE immediately in case an XDP program is attached. The more accurate formula is ALIGN(sz, PAGE_SIZE), to prevent two packets from residing on the same page. The assumption behind the current code is that sz <= PAGE_SIZE holds for all cases with XDP program set. This is true because it is being called from: - 3 times from Striding RQ flows, in which XDP is not supported for such large packets. - 1 time from Legacy RQ flow, under the condition mlx5e_rx_is_linear_skb(). No functional change here, just removing the implied assumption in preparation for supporting XDP multi-buffer in Striding RQ. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit abd3f84ecab3ab90161c9ba49052ac4ca33a0ed3 Author: Tariq Toukan Date: Mon Apr 17 15:18:56 2023 +0300 net/mlx5e: XDP, Let XDP checker function get the params as input Change mlx5e_xdp_allowed() so it gets the params structure with the xdp_prog applied, rather than creating a local copy based on the current params in priv. This reduces the amount of memory on the stack, and acts on the exact params instance that's about to be applied. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 7fc06dd2ae7b42fc5093f76878b77c74006b4fd5 Author: Tariq Toukan Date: Mon Apr 17 15:18:55 2023 +0300 net/mlx5e: XDP, Improve Striding RQ check with XDP Non-linear mem scheme of Striding RQ does not yet support XDP at this point. Take the check where it belongs, inside the params validation function mlx5e_params_validate_xdp(). Reviewed-by: Gal Pressman Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit c1783e74fc042adc28907ac7229b01ed20da31f9 Author: Tariq Toukan Date: Mon Apr 17 15:18:54 2023 +0300 net/mlx5e: XDP, Add support for multi-buffer XDP redirect-in Handle multi-buffer XDP redirect-in requests coming through mlx5e_xdp_xmit. Extend struct mlx5e_xmit_data_frags with an additional dma_arr field, to point to the fragments dma mapping, as they cannot be retrieved via the page_pool_get_dma_addr() function. Push a dma_addr xdpi instance per each fragment, and use them in the completion flow to dma_unmap the frags. Finally, remove the restriction in mlx5e_open_xdpsq, and set the flag in xdp_features. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 3f734b8c594bd378b0266cd98d6ce12b459da1d4 Author: Tariq Toukan Date: Mon Apr 17 15:18:53 2023 +0300 net/mlx5e: XDP, Use multiple single-entry objects in xdpi_fifo Here we fix the current wi->num_pkts abuse, as it was used to indicate multiple xdpi entries in the xdpi_fifo. Instead, reduce mlx5e_xdp_info to the size of a single field, making it a union of unions. Per packet, use as many instances as needed to provide the information needed at the time of completion. The sequence of xdpi instances pushed is well defined, derived by the xmit_mode. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 3a48ba12b4e471a9a3cf5fcff5146632ae6453d5 Author: Tariq Toukan Date: Mon Apr 17 15:18:52 2023 +0300 net/mlx5e: XDP, Remove doubtful unlikely calls It is not likely nor unlikely that the xdp buff has fragments, it depends on the program loaded and size of the packet received. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit eb9b9fdcafe29f022260dc43bd001b85937d9f83 Author: Tariq Toukan Date: Mon Apr 17 15:18:51 2023 +0300 net/mlx5e: Introduce extended version for mlx5e_xmit_data Introduce struct mlx5e_xmit_data_frags to be used for non-linear xmit buffers. Let it include sinfo pointer. Take one bit from the len field to indicate if the descriptor has fragments and can be casted-up into the extended version. Zero-init to make sure has_frags, and potentially future fields, are zero when not explicitly assigned. Another field will be added in a downstream patch to indicate and point to dma addresses of the different frags, for redirect-in requests. This simplifies the mlx5e_xmit_xdp_frame/mlx5e_xmit_xdp_frame_mpwqe functions params. Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit e32654f198897b0323e52fbd96a38606d0289c35 Author: Tariq Toukan Date: Mon Apr 17 15:18:50 2023 +0300 net/mlx5e: Move struct mlx5e_xmit_data to datapath header Move TX datapath struct from the generic en.h to the datapath txrx.h header, where it belongs. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit aebc62d336fed235e35d8522a004866c78dfa5c4 Author: Tariq Toukan Date: Mon Apr 17 15:18:49 2023 +0300 net/mlx5e: Move XDP struct and enum to XDP header Move struct mlx5e_xdp_info and enum mlx5e_xdp_xmit_mode from the generic en.h to the XDP header, where they belong. Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit ef16799640865f937719f0771c93be5dca18adc6 Author: Hans de Goede Date: Tue Apr 18 15:25:46 2023 +0200 wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the iwl_keyinfo.key field. Add a check to not copy more data to iwl_keyinfo.key then will fit. This fixes backtraces like this one: memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16) WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm] Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017 RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm] Call Trace: iwl_set_dynamic_key+0x1f0/0x220 [iwldvm] iwlagn_mac_set_key+0x1e4/0x280 [iwldvm] drv_set_key+0xa4/0x1b0 [mac80211] ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211] ieee80211_key_replace+0x22d/0x8e0 [mac80211] Link: https://www.alionet.org/index.php?topic=1469.0 Link: https://lore.kernel.org/linux-wireless/20230218191056.never.374-kees@kernel.org/ Link: https://lore.kernel.org/linux-wireless/68760035-7f75-1b23-e355-bfb758a87d83@redhat.com/ Cc: Kees Cook Suggested-by: Johannes Berg Signed-off-by: Hans de Goede Reviewed-by: Kees Cook Signed-off-by: Johannes Berg commit 0d19bd4df75eee7df20377ffa2b62a4adedd19ff Author: Rob Herring Date: Fri Mar 10 08:47:33 2023 -0600 ALSA: Use of_property_read_bool() for boolean properties It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. Convert reading boolean properties to to of_property_read_bool(). Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230310144734.1546587-1-robh@kernel.org Signed-off-by: Takashi Iwai commit d42c521ff4c9824e81c13d5fe1af947c1c652669 Author: Rob Herring Date: Fri Mar 10 08:47:33 2023 -0600 ALSA: ppc/tumbler: Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230310144733.1546500-1-robh@kernel.org Signed-off-by: Takashi Iwai commit 14cac662235ea097b6ff97f558ce5066292806b9 Author: Alain Volmat Date: Sun Apr 16 21:55:23 2023 +0200 net: ethernet: stmmac: dwmac-sti: remove stih415/stih416/stid127 Remove no more supported platforms (stih415/stih416 and stid127) Signed-off-by: Alain Volmat Acked-by: Jakub Kicinski Reviewed-by: Horatiu Vultur Link: https://lore.kernel.org/r/20230416195523.61075-1-avolmat@me.com Signed-off-by: Jakub Kicinski commit 33d74c8ff5ced854bc0ab6f94a778464dd2b905b Author: Arnd Bergmann Date: Mon Apr 17 22:55:25 2023 +0200 net: mscc: ocelot: remove incompatible prototypes The types for the register argument changed recently, but there are still incompatible prototypes that got left behind, and gcc-13 warns about these: In file included from drivers/net/ethernet/mscc/ocelot.c:13: drivers/net/ethernet/mscc/ocelot.h:97:5: error: conflicting types for 'ocelot_port_readl' due to enum/integer mismatch; have 'u32(struct ocelot_port *, u32)' {aka 'unsigned int(struct ocelot_port *, unsigned int)'} [-Werror=enum-int-mismatch] 97 | u32 ocelot_port_readl(struct ocelot_port *port, u32 reg); | ^~~~~~~~~~~~~~~~~ Just remove the two prototypes, and rely on the copy in the global header. Fixes: 9ecd05794b8d ("net: mscc: ocelot: strengthen type of "u32 reg" in I/O accessors") Signed-off-by: Arnd Bergmann Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230417205531.1880657-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 6b2c6e4a938fece9b539c8085f21d17c5e6eb9de Author: Corinna Vinschen Date: Mon Apr 17 21:28:45 2023 +0200 net: stmmac: propagate feature flags to vlan stmmac_dev_probe doesn't propagate feature flags to VLANs. So features like offloading don't correspond with the general features and it's not possible to manipulate features via ethtool -K to affect VLANs. Propagate feature flags to vlan features. Drop TSO feature because it does not work on VLANs yet. Signed-off-by: Corinna Vinschen Link: https://lore.kernel.org/r/20230417192845.590034-1-vinschen@redhat.com Signed-off-by: Jakub Kicinski commit 980f0799a15c75403f1f9284a32b6056b9660144 Author: Hangbin Liu Date: Tue Apr 18 11:48:41 2023 +0800 bonding: add software tx timestamping support Currently, bonding only obtain the timestamp (ts) information of the active slave, which is available only for modes 1, 5, and 6. For other modes, bonding only has software rx timestamping support. However, some users who use modes such as LACP also want tx timestamp support. To address this issue, let's check the ts information of each slave. If all slaves support tx timestamping, we can enable tx timestamping support for the bond. Add a note that the get_ts_info may be called with RCU, or rtnl or reference on the device in ethtool.h> Suggested-by: Miroslav Lichvar Signed-off-by: Hangbin Liu Acked-by: Jay Vosburgh Link: https://lore.kernel.org/r/20230418034841.2566262-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 2e75ab3189ecfe5f4383ef82896d30eaad0b3cd6 Merge: 5464912cfae70 3335068f87217 Author: Palmer Dabbelt Date: Tue Apr 18 20:43:07 2023 -0700 Merge patch series "riscv: Use PUD/P4D/PGD pages for the linear mapping" Alexandre Ghiti says: This patchset intends to improve tlb utilization by using hugepages for the linear mapping. As reported by Anup in v6, when STRICT_KERNEL_RWX is enabled, we must take care of isolating the kernel text and rodata so that they are not mapped with a PUD mapping which would then assign wrong permissions to the whole region: it is achieved the same way as arm64 by using the memblock nomap API which isolates those regions and re-merge them afterwards thus avoiding any issue with the system resources tree creation. arch/riscv/include/asm/page.h | 19 ++++++- arch/riscv/mm/init.c | 102 ++++++++++++++++++++++++++-------- arch/riscv/mm/physaddr.c | 16 ++++++ drivers/of/fdt.c | 11 ++-- 4 files changed, 118 insertions(+), 30 deletions(-) * b4-shazam-merge: riscv: Use PUD/P4D/PGD pages for the linear mapping riscv: Move the linear mapping creation in its own function riscv: Get rid of riscv_pfn_base variable Link: https://lore.kernel.org/r/20230324155421.271544-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 3335068f87217ea59d08f462187dc856652eea15 Author: Alexandre Ghiti Date: Fri Mar 24 16:54:21 2023 +0100 riscv: Use PUD/P4D/PGD pages for the linear mapping During the early page table creation, we used to set the mapping for PAGE_OFFSET to the kernel load address: but the kernel load address is always offseted by PMD_SIZE which makes it impossible to use PUD/P4D/PGD pages as this physical address is not aligned on PUD/P4D/PGD size (whereas PAGE_OFFSET is). But actually we don't have to establish this mapping (ie set va_pa_offset) that early in the boot process because: - first, setup_vm installs a temporary kernel mapping and among other things, discovers the system memory, - then, setup_vm_final creates the final kernel mapping and takes advantage of the discovered system memory to create the linear mapping. During the first phase, we don't know the start of the system memory and then until the second phase is finished, we can't use the linear mapping at all and phys_to_virt/virt_to_phys translations must not be used because it would result in a different translation from the 'real' one once the final mapping is installed. So here we simply delay the initialization of va_pa_offset to after the system memory discovery. But to make sure noone uses the linear mapping before, we add some guard in the DEBUG_VIRTUAL config. Finally we can use PUD/P4D/PGD hugepages when possible, which will result in a better TLB utilization. Note that: - this does not apply to rv32 as the kernel mapping lies in the linear mapping. - we rely on the firmware to protect itself using PMP. Signed-off-by: Alexandre Ghiti Acked-by: Rob Herring # DT bits Reviewed-by: Andrew Jones Reviewed-by: Anup Patel Tested-by: Anup Patel Link: https://lore.kernel.org/r/20230324155421.271544-4-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 8589e346bbb679cf7a4b564f75295d94250058f0 Author: Alexandre Ghiti Date: Fri Mar 24 16:54:20 2023 +0100 riscv: Move the linear mapping creation in its own function No change intended, it just splits the linear mapping creation from setup_vm_final: this prepares for upcoming additions to the linear mapping creation. Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Reviewed-by: Anup Patel Tested-by: Anup Patel Link: https://lore.kernel.org/r/20230324155421.271544-3-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit a7407a1318a9d7b5a7de7ab19935de5fc4c47a57 Author: Alexandre Ghiti Date: Fri Mar 24 16:54:19 2023 +0100 riscv: Get rid of riscv_pfn_base variable Use directly phys_ram_base instead, riscv_pfn_base is just the pfn of the address contained in phys_ram_base. Even if there is no functional change intended in this patch, actually setting phys_ram_base that early changes the behaviour of kernel_mapping_pa_to_va during the early boot: phys_ram_base used to be zero before this patch and now it is set to the physical start address of the kernel. But it does not break the conversion of a kernel physical address into a virtual address since kernel_mapping_pa_to_va should only be used on kernel physical addresses, i.e. addresses greater than the physical start address of the kernel. Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Reviewed-by: Anup Patel Tested-by: Anup Patel Link: https://lore.kernel.org/r/20230324155421.271544-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 5464912cfae706aff47f6253c495bf81284bc5d5 Author: Conor Dooley Date: Wed Apr 5 11:21:10 2023 +0100 RISC-V: align ISA extension Kconfig help text with each other Other extensions only capitalise the first letter in the text visible in Kconfig menus, and provide a short comment about the extension's meaning. Do the same for Svnapot & Svpbmt. The precedent for capitalisation in the Kconfig text was set by Zicbom & sorta followed for Zicboz. The RVI styling used for multi-letter extensions only capitalises the first letter, so do the same here. If nothing else, my OCD likes it when the extensions follow a consistent pattern. While editing one of the lines, reformat the "spelling" of 64-bit. Signed-off-by: Conor Dooley Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230405-pucker-cogwheel-3a999a94a2f2@wendy Signed-off-by: Palmer Dabbelt commit 8bf7b3b6676270c0ed3e4968608e1e052ecc8606 Author: Song Shuai Date: Fri Mar 10 19:03:36 2023 +0800 riscv: Kconfig: enable SCHED_MC kconfig RISC-V now builds the sched domain based on the simple possible map. Enable SCHED_MC to make the building based on cpu_coregroup_mask() which also takes care of the NUMA and cores with LLC. Signed-off-by: Song Shuai Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230310110336.970985-1-suagrfillet@gmail.com Signed-off-by: Palmer Dabbelt commit c4b52d8b6c1de1e6359bef2d1394d5917940b3dc Author: Song Shuai Date: Thu Mar 23 20:39:24 2023 +0800 riscv: export cpu/freq invariant to scheduler RISC-V now manages CPU topology using arch_topology which provides CPU capacity and frequency related interfaces to access the cpu/freq invariant in possible heterogeneous or DVFS-enabled platforms. Here adds topology.h file to export the arch_topology interfaces for replacing the scheduler's constant-based cpu/freq invariant accounting. Signed-off-by: Song Shuai Reviewed-by: Andrew Jones Reviewed-by: Ley Foon Tan Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230323123924.3032174-1-suagrfillet@gmail.com [Palmer: Fix the whitespace issues.] Signed-off-by: Palmer Dabbelt commit 65a15d6560dff065339f6cac91de4beded60fe3f Author: Brian King Date: Wed Apr 12 12:40:15 2023 -0500 scsi: ipr: Remove SATA support Linux SATA support in ipr has always been limited to SATA DVDs. The last systems that had the option of including a SATA DVD was Power 8, which have been withdrawn for some time now, so this support can be removed. Signed-off-by: Brian King Link: https://lore.kernel.org/r/20230412174015.114764-1-brking@linux.vnet.ibm.com Reviewed-by: Damien Le Moal Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit 0c028b6a115e7f18480ec3f98ba7bccf011646ea Author: John Garry Date: Sun Apr 16 17:56:54 2023 +0000 scsi: scsi_debug: Abort commands from scsi_debug_device_reset() Currently scsi_debug_device_reset() does not do much apart from setting the SDEBUG_UA_POR ("Power on, reset, or bus device reset") flag, which is eventually passed back to the SCSI midlayer later for a "unit attention" command. There is a report that blktest scsi/007 test fails due to commit 1107c7b24ee3 ("scsi: scsi_debug: Dynamically allocate sdebug_queued_cmd"). The problem there is that there are dangling scsi_debug queued commands when we attempt to remove the driver. scsi/007 test triggers SCSI EH and attempts to abort a timed-out command. Function scsi_debug_device_reset() is called as part of the EH, but does not deal with outstanding erroneous command. Prior to the named commit, removing the driver caused all dangling queued commands to be stopped - this should have not been necessary. Fix by aborting outstanding commands on a scsi_device basis from scsi_debug_device_reset(). Fixes: 1107c7b24ee3 ("scsi: scsi_debug: Dynamically allocate sdebug_queued_cmd") Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202304071111.e762fcbd-yujie.liu@intel.com Signed-off-by: John Garry Link: https://lore.kernel.org/r/20230416175654.159163-1-john.g.garry@oracle.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit eb04e72b345b01d192163e012853fb28f433b234 Merge: 6a24915145c92 aa5af0aa90bad Author: Palmer Dabbelt Date: Tue Apr 18 16:01:19 2023 -0700 Merge patch series "RISC-V Hardware Probing User Interface" Evan Green says: There's been a bunch of off-list discussions about this, including at Plumbers. The original plan was to do something involving providing an ISA string to userspace, but ISA strings just aren't sufficient for a stable ABI any more: in order to parse an ISA string users need the version of the specifications that the string is written to, the version of each extension (sometimes at a finer granularity than the RISC-V releases/versions encode), and the expected use case for the ISA string (ie, is it a U-mode or M-mode string). That's a lot of complexity to try and keep ABI compatible and it's probably going to continue to grow, as even if there's no more complexity in the specifications we'll have to deal with the various ISA string parsing oddities that end up all over userspace. Instead this patch set takes a very different approach and provides a set of key/value pairs that encode various bits about the system. The big advantage here is that we can clearly define what these mean so we can ensure ABI stability, but it also allows us to encode information that's unlikely to ever appear in an ISA string (see the misaligned access performance, for example). The resulting interface looks a lot like what arm64 and x86 do, and will hopefully fit well into something like ACPI in the future. The actual user interface is a syscall, with a vDSO function in front of it. The vDSO function can answer some queries without a syscall at all, and falls back to the syscall for cases it doesn't have answers to. Currently we prepopulate it with an array of answers for all keys and a CPU set of "all CPUs". This can be adjusted as necessary to provide fast answers to the most common queries. An example series in glibc exposing this syscall and using it in an ifunc selector for memcpy can be found at [1]. I was asked about the performance delta between this and something like sysfs. I created a small test program and ran it on a Nezha D1 Allwinner board. Doing each operation 100000 times and dividing, these operations take the following amount of time: - open()+read()+close() of /sys/kernel/cpu_byteorder: 3.8us - access("/sys/kernel/cpu_byteorder", R_OK): 1.3us - riscv_hwprobe() vDSO and syscall: .0094us - riscv_hwprobe() vDSO with no syscall: 0.0091us These numbers get farther apart if we query multiple keys, as sysfs will scale linearly with the number of keys, where the dedicated syscall stays the same. To frame these numbers, I also did a tight fork/exec/wait loop, which I measured as 4.8ms. So doing 4 open/read/close operations is a delta of about 0.3%, versus a single vDSO call is a delta of essentially zero. [1] https://patchwork.ozlabs.org/project/glibc/list/?series=343050 * b4-shazam-merge: RISC-V: Add hwprobe vDSO function and data selftests: Test the new RISC-V hwprobe interface RISC-V: hwprobe: Support probing of misaligned access performance RISC-V: hwprobe: Add support for RISCV_HWPROBE_BASE_BEHAVIOR_IMA RISC-V: Add a syscall for HW probing RISC-V: Move struct riscv_cpuinfo to new header Link: https://lore.kernel.org/r/20230407231103.2622178-1-evan@rivosinc.com Signed-off-by: Palmer Dabbelt commit 63f8793ee60513a09f110ea460a6ff2c33811cdb Author: Chaitanya Kulkarni Date: Sun Apr 16 15:03:39 2023 -0700 null_blk: Always check queue mode setting from configfs Make sure to check device queue mode in the null_validate_conf() and return error for NULL_Q_RQ as we don't allow legacy I/O path, without this patch we get OOPs when queue mode is set to 1 from configfs, following are repro steps :- modprobe null_blk nr_devices=0 mkdir config/nullb/nullb0 echo 1 > config/nullb/nullb0/memory_backed echo 4096 > config/nullb/nullb0/blocksize echo 20480 > config/nullb/nullb0/size echo 1 > config/nullb/nullb0/queue_mode echo 1 > config/nullb/nullb0/power Entering kdb (current=0xffff88810acdd080, pid 2372) on processor 42 Oops: (null) due to oops @ 0xffffffffc041c329 CPU: 42 PID: 2372 Comm: sh Tainted: G O N 6.3.0-rc5lblk+ #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:null_add_dev.part.0+0xd9/0x720 [null_blk] Code: 01 00 00 85 d2 0f 85 a1 03 00 00 48 83 bb 08 01 00 00 00 0f 85 f7 03 00 00 80 bb 62 01 00 00 00 48 8b 75 20 0f 85 6d 02 00 00 <48> 89 6e 60 48 8b 75 20 bf 06 00 00 00 e8 f5 37 2c c1 48 8b 75 20 RSP: 0018:ffffc900052cbde0 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff88811084d800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888100042e00 RBP: ffff8881053d8200 R08: ffffc900052cbd68 R09: ffff888105db2000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002 R13: ffff888104765200 R14: ffff88810eec1748 R15: ffff88810eec1740 FS: 00007fd445fd1740(0000) GS:ffff8897dfc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 0000000166a00000 CR4: 0000000000350ee0 DR0: ffffffff8437a488 DR1: ffffffff8437a489 DR2: ffffffff8437a48a DR3: ffffffff8437a48b DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: nullb_device_power_store+0xd1/0x120 [null_blk] configfs_write_iter+0xb4/0x120 vfs_write+0x2ba/0x3c0 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fd4460c57a7 Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffd3792a4a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd4460c57a7 RDX: 0000000000000002 RSI: 000055b43c02e4c0 RDI: 0000000000000001 RBP: 000055b43c02e4c0 R08: 000000000000000a R09: 00007fd44615b4e0 R10: 00007fd44615b3e0 R11: 0000000000000246 R12: 0000000000000002 R13: 00007fd446198520 R14: 0000000000000002 R15: 00007fd446198700 Signed-off-by: Chaitanya Kulkarni Reviewed-by: Damien Le Moal Reviewed-by: Ming Lei Reviewed-by: Nitesh Shetty Link: https://lore.kernel.org/r/20230416220339.43845-1-kch@nvidia.com Signed-off-by: Jens Axboe commit 2d786e66c9662d84cbeab981ce3a371d2fb5a4bb Author: Ming Lei Date: Tue Apr 18 21:18:10 2023 +0800 block: ublk: switch to ioctl command encoding All ublk commands(control, IO) should have taken ioctl command encoding from the beginning, because ioctl command encoding defines each code uniquely, so driver can figure out wrong command sent from userspace easily; 2) it might help security subsystem for audit uring cmd[1]. Unfortunately we didn't do that way, and it could be one lesson for ublk driver. So switch to ioctl command encoding now, we still support commands encoded in old way, but they become legacy definition. Any new command should take ioctl encoding. See ublksrv code for switching to ioctl command encoding in [2]. [1] https://lore.kernel.org/io-uring/CAHC9VhSVzujW9LOj5Km80AjU0EfAuukoLrxO6BEfnXeK_s6bAg@mail.gmail.com/ [2] https://github.com/ming1/ubdsrv/commits/ioctl_cmd_encoding Cc: Christoph Hellwig Cc: Ken Kurematsu Signed-off-by: Ming Lei Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230418131810.855959-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 1f6fa392a9942e4a2bd3122913baeb33e987ccd9 Author: Rob Herring Date: Fri Mar 10 08:47:35 2023 -0600 remoteproc: st: Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Signed-off-by: Rob Herring Reviewed-by: Mathieu Poirier Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230310144736.1546972-1-robh@kernel.org commit ea97f6c8558e83cb457c3b5f53351e4fd8519ab1 Author: David Wei Date: Tue Apr 18 15:58:18 2023 -0700 io_uring: add support for multishot timeouts A multishot timeout submission will repeatedly generate completions with the IORING_CQE_F_MORE cflag set. Depending on the value of the `off' field in the submission, these timeouts can either repeat indefinitely until cancelled (`off' = 0) or for a fixed number of times (`off' > 0). Only noseq timeouts (i.e. not dependent on the number of I/O completions) are supported. An indefinite timer will be cancelled if the CQ ever overflows. Signed-off-by: David Wei Link: https://lore.kernel.org/r/20230418225817.1905027-1-davidhwei@meta.com Signed-off-by: Jens Axboe commit 2236b3905b4d4e9cd4d149ab35767858c02bb79b Author: Pavel Begunkov Date: Tue Apr 18 14:06:41 2023 +0100 io_uring/rsrc: disassociate nodes and rsrc_data Make rsrc nodes independent from rsrd_data, for that we keep ctx and rsrc type in nodes. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/4f259abe9cd4eea6a3b4ed83508635218acd3c3f.1681822823.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit fc7f3a8d3a78503c4f3e108155fb9a233dc307a4 Author: Pavel Begunkov Date: Tue Apr 18 14:06:40 2023 +0100 io_uring/rsrc: devirtualise rsrc put callbacks We only have two rsrc types, buffers and files, replace virtual callbacks for putting resources down with a switch..case. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/02ca727bf8e5f7f820c2f404e95ae88c8f472930.1681822823.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 29b26c556e7439b1370ac6a59fce83a9d1521de1 Author: Pavel Begunkov Date: Tue Apr 18 14:06:39 2023 +0100 io_uring/rsrc: pass node to io_rsrc_put_work() Instead of passing rsrc_data and a resource to io_rsrc_put_work() just forward node, that's all the function needs. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/791e8edd28d78797240b74d34e99facbaad62f3b.1681822823.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 4130b49991d6b8ca0ea44cb256e710c4e48d7f01 Author: Pavel Begunkov Date: Tue Apr 18 14:06:38 2023 +0100 io_uring/rsrc: inline io_rsrc_put_work() io_rsrc_put_work() is simple enough to be open coded into its only caller. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1b36dd46766ced39a9b160767babfa2fce07b8f8.1681822823.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 26147da37f3e52041d9deba189d39f27ce78a84f Author: Pavel Begunkov Date: Tue Apr 18 14:06:37 2023 +0100 io_uring/rsrc: add empty flag in rsrc_node Unless a node was flushed by io_rsrc_ref_quiesce(), it'll carry a resource. Replace ->inline_items with an empty flag, which is initialised to false and only raised in io_rsrc_ref_quiesce(). Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/75d384c9d2252e12af73b9cf8a44e1699106aeb1.1681822823.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit c376644fb915fbdea8c4a04f859d032a8be352fd Author: Pavel Begunkov Date: Tue Apr 18 14:06:36 2023 +0100 io_uring/rsrc: merge nodes and io_rsrc_put struct io_rsrc_node carries a number of resources represented by struct io_rsrc_put. That was handy before for sync overhead ammortisation, but all complexity is gone and nodes are simple and lightweight. Let's allocate a separate node for each resource. Nodes and io_rsrc_put and not much different in size, and former are cached, so node allocation should work better. That also removes some overhead for nested iteration in io_rsrc_node_ref_zero() / __io_rsrc_put_work(). Another reason for the patch is that it greatly reduces complexity by moving io_rsrc_node_switch[_start]() inside io_queue_rsrc_removal(), so users don't have to care about it. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c7d3a45b30cc14cd93700a710dd112edc703db98.1681822823.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 63fea89027ff4fd4f350b471ad5b9220d373eec5 Author: Pavel Begunkov Date: Tue Apr 18 14:06:35 2023 +0100 io_uring/rsrc: infer node from ctx on io_queue_rsrc_removal For io_queue_rsrc_removal() we should always use the current active rsrc node, don't pass it directly but let the function grab it from the context. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/d15939b4afea730978b4925685c2577538b823bb.1681822823.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 2e6f45ac0e640bbd49296adfa0982c84f85fa342 Author: Pavel Begunkov Date: Tue Apr 18 14:06:34 2023 +0100 io_uring/rsrc: remove unused io_rsrc_node::llist ->llist was needed for rsrc node destruction offload, which is removed now. Get rid of the unused field. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/8e7d764c3f947489fde88d0927c3060d2e1bb599.1681822823.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit e046fe5a36a970bc14fbfbcb2074a48776f6b671 Author: Linus Torvalds Date: Mon Apr 17 12:13:35 2023 -0700 x86: set FSRS automatically on AMD CPUs that have FSRM So Intel introduced the FSRS ("Fast Short REP STOS") CPU capability bit, because they seem to have done the (much simpler) REP STOS optimizations separately and later than the REP MOVS one. In contrast, when AMD introduced support for FSRM ("Fast Short REP MOVS"), in the Zen 3 core, it appears to have improved the REP STOS case at the same time, and since the FSRS bit was added by Intel later, it doesn't show up on those AMD Zen 3 cores. And now that we made use of FSRS for the "rep stos" conditional, that made those AMD machines unnecessarily slower. The Intel situation where "rep movs" is fast, but "rep stos" isn't, is just odd. The 'stos' case is a lot simpler with no aliasing, no mutual alignment issues, no complicated cases. So this just sets FSRS automatically when FSRM is available on AMD machines, to get back all the nice REP STOS goodness in Zen 3. Reported-and-tested-by: Jens Axboe Signed-off-by: Linus Torvalds commit 427fda2c8a4977d9dbd9bc108bbe6e21ec84648d Author: Linus Torvalds Date: Sun Apr 16 18:23:06 2023 -0700 x86: improve on the non-rep 'copy_user' function The old 'copy_user_generic_unrolled' function was oddly implemented for largely historical reasons: it had been largely based on the uncached copy case, which has some other concerns. For example, the __copy_user_nocache() function uses 'movnti' for the destination stores, and those want the destination to be aligned. In contrast, the regular copy function doesn't really care, and trying to align things only complicates matters. Also, like the clear_user function, the copy function had some odd handling of the repeat counts, complicating the exception handling for no really good reason. So as with clear_user, just write it to keep all the byte counts in the %rcx register, exactly like the 'rep movs' functionality that this replaces. Unlike a real 'rep movs', we do allow for this to trash a few temporary registers to not have to unnecessarily save/restore registers on the stack. And like the clearing case, rename this to what it now clearly is: 'rep_movs_alternative', and make it one coherent function, so that it shows up as such in profiles (instead of the odd split between "copy_user_generic_unrolled" and "copy_user_short_string", the latter of which was not about strings at all, and which was shared with the uncached case). Signed-off-by: Linus Torvalds commit 8c9b6a88b7e2f33c656cd667a081bfd4dc8f5005 Author: Linus Torvalds Date: Sun Apr 16 14:06:58 2023 -0700 x86: improve on the non-rep 'clear_user' function The old version was oddly written to have the repeat count in multiple registers. So instead of taking advantage of %rax being zero, it had some sub-counts in it. All just for a "single word clearing" loop, which isn't even efficient to begin with. So get rid of those games, and just keep all the state in the same registers we got it in (and that we should return things in). That not only makes this act much more like 'rep stos' (which this function is replacing), but makes it much easier to actually do the obvious loop unrolling. Also rename the function from the now nonsensical 'clear_user_original' to what it now clearly is: 'rep_stos_alternative'. End result: if we don't have a fast 'rep stosb', at least we can have a fast fallback for it. Signed-off-by: Linus Torvalds commit 577e6a7fd50d519c201d20968b6a027a6563dc4c Author: Linus Torvalds Date: Sat Apr 15 19:31:34 2023 -0700 x86: inline the 'rep movs' in user copies for the FSRM case This does the same thing for the user copies as commit 0db7058e8e23 ("x86/clear_user: Make it faster") did for clear_user(). In other words, it inlines the "rep movs" case when X86_FEATURE_FSRM is set, avoiding the function call entirely. In order to do that, it makes the calling convention for the out-of-line case ("copy_user_generic_unrolled") match the 'rep movs' calling convention, although it does also end up clobbering a number of additional registers. Also, to simplify code sharing in the low-level assembly with the __copy_user_nocache() function (that uses the normal C calling convention), we end up with a kind of mixed return value for the low-level asm code: it will return the result in both %rcx (to work as an alternative for the 'rep movs' case), _and_ in %rax (for the nocache case). We could avoid this by wrapping __copy_user_nocache() callers in an inline asm, but since the cost is just an extra register copy, it's probably not worth it. Signed-off-by: Linus Torvalds commit 3639a535587d7aac449cdce9710dfdc97a3c8c8e Author: Linus Torvalds Date: Sat Apr 15 13:39:15 2023 -0700 x86: move stac/clac from user copy routines into callers This is preparatory work for inlining the 'rep movs' case, but also a cleanup. The __copy_user_nocache() function was mis-used by the rdma code to do uncached kernel copies that don't actually want user copies at all, and as a result doesn't want the stac/clac either. Signed-off-by: Linus Torvalds commit d2c95f9d6802cc518d71d9795f4d9da54fb4e24d Author: Linus Torvalds Date: Sat Apr 15 13:22:31 2023 -0700 x86: don't use REP_GOOD or ERMS for user memory clearing The modern target to use is FSRS (Fast Short REP STOS), and the other cases should only be used for bigger areas (ie mainly things like page clearing). Note! This changes the conditional for the inlining from FSRM ("fast short rep movs") to FSRS ("fast short rep stos"). We'll have a separate fixup for AMD microarchitectures that have a good 'rep stosb' yet do not set the new Intel-specific FSRS bit (because FSRM was there first). Signed-off-by: Linus Torvalds commit adfcf4231b8cbc2d9c1e7bfaa965b907e60639eb Author: Linus Torvalds Date: Sat Apr 15 13:14:59 2023 -0700 x86: don't use REP_GOOD or ERMS for user memory copies The modern target to use is FSRM (Fast Short REP MOVS), and the other cases should only be used for bigger areas (ie mainly things like page clearing). Signed-off-by: Linus Torvalds commit 20f3337d350c4e1b4ac66d731fd4e98565bf6cc0 Author: Linus Torvalds Date: Sat Apr 15 12:01:14 2023 -0700 x86: don't use REP_GOOD or ERMS for small memory clearing The modern target to use is FSRS (Fast Short REP STOS), and the other cases should only be used for bigger areas (ie mainly things like page clearing). Signed-off-by: Linus Torvalds commit 68674f94ffc9dddc45e7733963ecc35c5eda9efd Author: Linus Torvalds Date: Sat Apr 15 11:47:06 2023 -0700 x86: don't use REP_GOOD or ERMS for small memory copies The modern target to use is FSRM (Fast Short REP MOVS), and the other cases should only be used for bigger areas (ie mainly things like page copying and clearing). Signed-off-by: Linus Torvalds commit 4248d0083ec5817eebfb916c54950d100b3468ee Author: Longlong Xia Date: Fri Apr 14 10:17:41 2023 +0800 mm: ksm: support hwpoison for ksm page hwpoison_user_mappings() is updated to support ksm pages, and add collect_procs_ksm() to collect processes when the error hit an ksm page. The difference from collect_procs_anon() is that it also needs to traverse the rmap-item list on the stable node of the ksm page. At the same time, add_to_kill_ksm() is added to handle ksm pages. And task_in_to_kill_list() is added to avoid duplicate addition of tsk to the to_kill list. This is because when scanning the list, if the pages that make up the ksm page all come from the same process, they may be added repeatedly. Link: https://lkml.kernel.org/r/20230414021741.2597273-3-xialonglong1@huawei.com Signed-off-by: Longlong Xia Tested-by: Naoya Horiguchi Reviewed-by: Kefeng Wang Cc: Miaohe Lin Cc: Nanyong Sun Signed-off-by: Andrew Morton commit 4f775086a6eee07c6ae4be4734d736e13b537351 Author: Longlong Xia Date: Fri Apr 14 10:17:40 2023 +0800 mm: memory-failure: refactor add_to_kill() Patch series "mm: ksm: support hwpoison for ksm page", v2. Currently, ksm does not support hwpoison. As ksm is being used more widely for deduplication at the system level, container level, and process level, supporting hwpoison for ksm has become increasingly important. However, ksm pages were not processed by hwpoison in 2009 [1]. The main method of implementation: 1. Refactor add_to_kill() and add new add_to_kill_*() to better accommodate the handling of different types of pages. 2. Add collect_procs_ksm() to collect processes when the error hit an ksm page. 3. Add task_in_to_kill_list() to avoid duplicate addition of tsk to the to_kill list. 4. Try_to_unmap ksm page (already supported). 5. Handle related processes such as sending SIGBUS. Tested with poisoning to ksm page from 1) different process 2) one process and with/without memory_failure_early_kill set, the processes are killed as expected with the patchset. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ commit/?h=01e00f880ca700376e1845cf7a2524ebe68e47d6 This patch (of 2): The page_address_in_vma() is used to find the user virtual address of page in add_to_kill(), but it doesn't support ksm due to the ksm page->index unusable, add an ksm_addr as parameter to add_to_kill(), let's the caller to pass it, also rename the function to __add_to_kill(), and adding add_to_kill_anon_file() for handling anonymous pages and file pages, adding add_to_kill_fsdax() for handling fsdax pages. Link: https://lkml.kernel.org/r/20230414021741.2597273-1-xialonglong1@huawei.com Link: https://lkml.kernel.org/r/20230414021741.2597273-2-xialonglong1@huawei.com Signed-off-by: Longlong Xia Tested-by: Naoya Horiguchi Reviewed-by: Kefeng Wang Cc: Kefeng Wang Cc: Miaohe Lin Cc: Nanyong Sun Signed-off-by: Andrew Morton commit 3cc0c3738cde66a1eadf977fa7b2fdecbbcf5d4f Author: Jeff Xu Date: Fri Apr 14 02:28:01 2023 +0000 selftests/memfd: fix test_sysctl sysctl memfd_noexec is pid-namespaced, non-reservable, and inherent to the child process. Move the inherence test from init ns to child ns, so init ns can keep the default value. Link: https://lkml.kernel.org/r/20230414022801.2545257-1-jeffxu@google.com Signed-off-by: Jeff Xu Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202303312259.441e35db-yujie.liu@intel.com Tested-by: Yujie Liu Cc: Daniel Verkamp Cc: Dmitry Torokhov Cc: Hugh Dickins Cc: Jann Horn Cc: Jorge Lucangeli Obes Cc: Kees Cook Cc: Shuah Khan Signed-off-by: Andrew Morton commit c025da0f14e80028de93f72976a0d81dafc17d03 Author: Chaitanya S Prakash Date: Thu Mar 23 16:22:43 2023 +0530 selftests/mm: run hugetlb testcases of va switch The va_high_addr_switch selftest is used to test mmap across 128TB boundary. It divides the selftest cases into two main categories on the basis of size. One set is used to create mappings that are multiples of PAGE_SIZE while the other creates mappings that are multiples of HUGETLB_SIZE. In order to run the hugetlb testcases the binary must be appended with "--run-hugetlb" but the file that used to run the test only invokes the binary, thereby completely skipping the hugetlb testcases. Hence, the required statement has been added. Link: https://lkml.kernel.org/r/20230323105243.2807166-6-chaitanyas.prakash@arm.com Signed-off-by: Chaitanya S Prakash Cc: Aneesh Kumar K.V Cc: Kirill A. Shutemov Cc: Shuah Khan Cc: Mark Rutland Signed-off-by: Andrew Morton commit 2f489e2e69463729eefc77da22c163ae63b48b74 Author: Chaitanya S Prakash Date: Thu Mar 23 16:22:42 2023 +0530 selftests/mm: configure nr_hugepages for arm64 Arm64 has a default hugepage size of 512MB when CONFIG_ARM64_64K_PAGES=y is enabled. While testing on arm64 platforms having up to 4PB of virtual address space, a minimum of 6 hugepages were required for all test cases to pass. Support for this requirement has been added. Link: https://lkml.kernel.org/r/20230323105243.2807166-5-chaitanyas.prakash@arm.com Signed-off-by: Chaitanya S Prakash Cc: Aneesh Kumar K.V Cc: Kirill A. Shutemov Cc: Shuah Khan Cc: Mark Rutland Signed-off-by: Andrew Morton commit c2af2a41905efcf662b53f280f8538e5c6bd05f4 Author: Chaitanya S Prakash Date: Thu Mar 23 16:22:41 2023 +0530 selftests/mm: add platform independent in code comments The in code comments for the selftest were made on the basis of 128TB switch, an architecture feature specific to PowerPc and x86 platforms. Keeping in mind the support added for arm64 platforms which implements a 256TB switch, a more generic explanation has been provided. Link: https://lkml.kernel.org/r/20230323105243.2807166-4-chaitanyas.prakash@arm.com Signed-off-by: Chaitanya S Prakash Cc: Aneesh Kumar K.V Cc: Kirill A. Shutemov Cc: Shuah Khan Cc: Mark Rutland Signed-off-by: Andrew Morton commit bbe168729d4ef8305f4e35c3bbe4711389ab8354 Author: Chaitanya S Prakash Date: Thu Mar 23 16:22:40 2023 +0530 selftests/mm: rename va_128TBswitch to va_high_addr_switch As the initial selftest only took into consideration PowperPC and x86 architectures, on adding support for arm64, a platform independent naming convention is chosen. Link: https://lkml.kernel.org/r/20230323105243.2807166-3-chaitanyas.prakash@arm.com Signed-off-by: Chaitanya S Prakash Cc: Aneesh Kumar K.V Cc: Kirill A. Shutemov Cc: Shuah Khan Cc: Mark Rutland Signed-off-by: Andrew Morton commit cd834afa8ee3751644534be20d63cff445641f0f Author: Chaitanya S Prakash Date: Thu Mar 23 16:22:39 2023 +0530 selftests/mm: add support for arm64 platform on va switch Patch series "selftests/mm: Implement support for arm64 on va". The va_128TBswitch selftest is designed and implemented for PowerPC and x86 architectures which support a 128TB switch, up to 256TB of virtual address space and hugepage sizes of 16MB and 2MB respectively. Arm64 platforms on the other hand support a 256Tb switch, up to 4PB of virtual address space and a default hugepage size of 512MB when 64k pagesize is enabled. These architectural differences require introducing support for arm64 platforms, after which a more generic naming convention is suggested. The in code comments are amended to provide a more platform independent explanation of the working of the code and nr_hugepages are configured as required. Finally, the file running the testcase is modified in order to prevent skipping of hugetlb testcases of va_high_addr_switch. This patch (of 5): Arm64 platforms have the ability to support 64kb pagesize, 512MB default hugepage size and up to 4PB of virtual address space. The address switch occurs at 256TB as opposed to 128TB. Hence, the necessary support has been added. Link: https://lkml.kernel.org/r/20230323105243.2807166-1-chaitanyas.prakash@arm.com Link: https://lkml.kernel.org/r/20230323105243.2807166-2-chaitanyas.prakash@arm.com Signed-off-by: Chaitanya S Prakash Cc: Aneesh Kumar K.V Cc: Kirill A. Shutemov Cc: Shuah Khan Cc: Mark Rutland Signed-off-by: Andrew Morton commit e5ace96f2cba612825b82421eb6068fc94fb9da5 Author: Krzysztof Kozlowski Date: Fri Apr 14 12:42:30 2023 +0200 dt-bindings: display: simplify compatibles syntax Lists (items) with one item should be just const or enum because it is shorter and simpler. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20230414104230.23165-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 112d5560a0678f5cea0f242ac576eefafed2a9e7 Author: Krzysztof Kozlowski Date: Fri Apr 14 10:33:11 2023 +0200 dt-bindings: display: mediatek: simplify compatibles syntax Lists (items) with one item should be just enum because it is shorter, simpler and does not confuse, if one wants to add new entry with a fallback. Convert all of them to enums. OTOH, leave unused "oneOf" entries in anticipation of further growth of the entire binding. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Matthias Brugger Link: https://lore.kernel.org/r/20230414083311.12197-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit a31a6c2465a368e2c40b8d768aa682b92743f33e Author: Fabio Estevam Date: Wed Apr 12 14:58:00 2023 -0300 dt-bindings: drm/bridge: ti-sn65dsi86: Fix the video-interfaces.yaml references video-interface.txt does not exist anymore, as it has been converted to video-interfaces.yaml. Instead of referencing video-interfaces.yaml multiple times, pass it as a $ref to the schema. Signed-off-by: Fabio Estevam Link: https://lore.kernel.org/r/20230412175800.2537812-1-festevam@gmail.com Signed-off-by: Rob Herring commit 975b1e501887c287e82bbbed523de8c87197fddc Author: Rob Herring Date: Mon Mar 27 12:01:45 2023 -0500 dt-bindings: timer: Drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Reviewed-by: Linus Walleij Reviewed-by: Thierry Reding Link: https://lore.kernel.org/r/20230327170146.4104556-1-robh@kernel.org Signed-off-by: Rob Herring commit 6416a6ec1acbccd4191c62a57a85ef55056e69ca Author: Krzysztof Kozlowski Date: Sun Apr 16 12:28:31 2023 +0200 dt-bindings: interrupt-controller: qcom,pdc: document qcom,qdu1000-pdc Add QDU1000 PDC, already used in upstreamed DTS. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230416102831.105136-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit a04bb4c24a4846232a81047784d5eff2848e45bd Author: Dmitry Rokosov Date: Tue Apr 4 22:17:15 2023 +0300 checkpatch: introduce proper bindings license check All headers from 'include/dt-bindings/' must be verified by checkpatch together with Documentation bindings, because all of them are part of the whole DT bindings system. The requirement is dual licensed and matching patterns: * Schemas: /GPL-2\.0(?:-only)? OR BSD-2-Clause/ * Headers: /GPL-2\.0(?:-only)? OR \S+/ Above patterns suggested by Rob at: https://lore.kernel.org/all/CAL_Jsq+-YJsBO+LuPJ=ZQ=eb-monrwzuCppvReH+af7hYZzNaQ@mail.gmail.com The issue was found during patch review: https://lore.kernel.org/all/20230313201259.19998-4-ddrokosov@sberdevices.ru/ Link: https://lkml.kernel.org/r/20230404191715.7319-1-ddrokosov@sberdevices.ru Signed-off-by: Dmitry Rokosov Reviewed-by: Rob Herring Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Joe Perches Cc: Krzysztof Kozlowski Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit d4cb626d6f3e86121e08ce1492836f37f91858dd Author: Davidlohr Bueso Date: Tue Apr 11 16:41:59 2023 -0700 epoll: rename global epmutex As of 4f04cbaf128 ("epoll: use refcount to reduce ep_mutex contention"), this lock is now specific to nesting cases - inserting an epoll fd onto another epoll fd. Rename the lock to be less generic. Link: https://lkml.kernel.org/r/20230411234159.20421-1-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Cc: Paolo Abeni Cc: Eric Dumazet Signed-off-by: Andrew Morton commit 5a10562bdeb58006de4b1cd5f671b7da26b20bb3 Author: Glenn Washburn Date: Tue Feb 28 18:53:35 2023 -0600 scripts/gdb: add GDB convenience functions $lx_dentry_name() and $lx_i_dentry() $lx_dentry_name() generates a full VFS path from a given dentry pointer, and $lx_i_dentry() returns the dentry pointer associated with the given inode pointer, if there is one. Link: https://lkml.kernel.org/r/c9a5ad8efbfbd2cc6559e082734eed7628f43a16.1677631565.git.development@efficientek.com Signed-off-by: Glenn Washburn Cc: Alexander Viro Cc: Antonio Borneo Cc: Jan Kiszka Cc: John Ogness Cc: Kieran Bingham Cc: Petr Mladek Signed-off-by: Andrew Morton commit f4efbdaf59e959507a1a931ec4afecdfb09db76e Author: Glenn Washburn Date: Tue Feb 28 18:53:34 2023 -0600 scripts/gdb: create linux/vfs.py for VFS related GDB helpers Patch series "GDB VFS utils". I've created a couple GDB convenience functions that I found useful when debugging some VFS issues and figure others might find them useful. For instance, they are useful in setting conditional breakpoints on VFS functions where you only care if the dentry path is a certain value. I took the opportunity to create a new "vfs" python module to give VFS related utilities a home. This patch (of 2): This will allow for more VFS specific GDB helpers to be collected in one place. Move utils.dentry_name into the vfs modules. Also a local variable in proc.py was changed from vfs to mnt to prevent a naming collision with the new vfs module. [akpm@linux-foundation.org: add SPDX-License-Identifier] Link: https://lkml.kernel.org/r/cover.1677631565.git.development@efficientek.com Link: https://lkml.kernel.org/r/7bba4c065a8c2c47f1fc5b03a7278005b04db251.1677631565.git.development@efficientek.com Signed-off-by: Glenn Washburn Cc: Alexander Viro Cc: Antonio Borneo Cc: Jan Kiszka Cc: John Ogness Cc: Kieran Bingham Cc: Petr Mladek Signed-off-by: Andrew Morton commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 Author: Kevin Brodsky Date: Tue Apr 11 10:27:47 2023 +0100 uapi/linux/const.h: prefer ISO-friendly __typeof__ typeof is (still) a GNU extension, which means that it cannot be used when building ISO C (e.g. -std=c99). It should therefore be avoided in uapi headers in favour of the ISO-friendly __typeof__. Unfortunately this issue could not be detected by CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in any uapi header. This matters from a userspace perspective, not a kernel one. uapi headers and their contents are expected to be usable in a variety of situations, and in particular when building ISO C applications (with -std=c99 or similar). This particular problem can be reproduced by trying to use the __ALIGN_KERNEL macro directly in application code, say: #include int align(int x, int a) { return __KERNEL_ALIGN(x, a); } and trying to build that with -std=c99. Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()") Signed-off-by: Kevin Brodsky Reported-by: Ruben Ayrapetyan Tested-by: Ruben Ayrapetyan Reviewed-by: Petr Vorel Tested-by: Petr Vorel Reviewed-by: Masahiro Yamada Cc: Sam Ravnborg Signed-off-by: Andrew Morton commit a3b2aeac9d154e5e15ddbf19de934c0c606b6acd Author: Yang Yang Date: Sat Apr 8 17:28:35 2023 +0800 delayacct: track delays from IRQ/SOFTIRQ Delay accounting does not track the delay of IRQ/SOFTIRQ. While IRQ/SOFTIRQ could have obvious impact on some workloads productivity, such as when workloads are running on system which is busy handling network IRQ/SOFTIRQ. Get the delay of IRQ/SOFTIRQ could help users to reduce such delay. Such as setting interrupt affinity or task affinity, using kernel thread for NAPI etc. This is inspired by "sched/psi: Add PSI_IRQ to track IRQ/SOFTIRQ pressure"[1]. Also fix some code indent problems of older code. And update tools/accounting/getdelays.c: / # ./getdelays -p 156 -di print delayacct stats ON printing IO accounting PID 156 CPU count real total virtual total delay total delay average 15 15836008 16218149 275700790 18.380ms IO count delay total delay average 0 0 0.000ms SWAP count delay total delay average 0 0 0.000ms RECLAIM count delay total delay average 0 0 0.000ms THRASHING count delay total delay average 0 0 0.000ms COMPACT count delay total delay average 0 0 0.000ms WPCOPY count delay total delay average 36 7586118 0.211ms IRQ count delay total delay average 42 929161 0.022ms [1] commit 52b1364ba0b1("sched/psi: Add PSI_IRQ to track IRQ/SOFTIRQ pressure") Link: https://lkml.kernel.org/r/202304081728353557233@zte.com.cn Signed-off-by: Yang Yang Cc: Jiang Xuexin Cc: wangyong Cc: junhua huang Cc: Balbir Singh Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Juri Lelli Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit 29692fc92c5b6a2c7cfe6f588ef68272e3343647 Author: Amjad Ouled-Ameur Date: Thu Apr 6 15:12:17 2023 -0700 scripts/gdb: timerlist: convert int chunks to str join() expects strings but integers are given. Convert chunks list to strings before passing it to join() Link: https://lkml.kernel.org/r/20230406221217.1585486-4-f.fainelli@gmail.com Signed-off-by: Amjad Ouled-Ameur Signed-by: Florian Fainelli Tested-by: Florian Fainelli Cc: Jan Kiszka Signed-off-by: Andrew Morton commit b0969d7687a7aaa82dcf2d1f245ef699387886da Author: Florian Fainelli Date: Thu Apr 6 15:04:51 2023 -0700 scripts/gdb: print interrupts This GDB script prints the interrupts in the system in the same way that /proc/interrupts does. This does include the architecture specific part done by arch_show_interrupts() for x86, ARM, ARM64 and MIPS. Example output from an ARM64 system: (gdb) lx-interruptlist CPU0 CPU1 CPU2 CPU3 10: 3167 1225 1276 2629 GICv2 30 Level arch_timer 13: 0 0 0 0 GICv2 36 Level arm-pmu 14: 0 0 0 0 GICv2 37 Level arm-pmu 15: 0 0 0 0 GICv2 38 Level arm-pmu 16: 0 0 0 0 GICv2 39 Level arm-pmu 28: 0 0 0 0 interrupt-controller@8410640 5 Edge brcmstb-gpio-wake 30: 125 0 0 0 GICv2 128 Level ttyS0 31: 0 0 0 0 interrupt-controller@8416000 0 Level mspi_done 32: 0 0 0 0 interrupt-controller@8410640 3 Edge brcmstb-waketimer 33: 0 0 0 0 interrupt-controller@8418580 8 Edge brcmstb-waketimer-rtc 34: 872 0 0 0 GICv2 230 Level brcm_scmi@0 35: 0 0 0 0 interrupt-controller@8410640 10 Edge 8d0f200.usb-phy 37: 0 0 0 0 GICv2 97 Level PCIe PME 42: 0 0 0 0 GICv2 145 Level xhci-hcd:usb1 43: 94 0 0 0 GICv2 71 Level mmc1 44: 0 0 0 0 GICv2 70 Level mmc0 IPI0: 23 666 154 98 Rescheduling interrupts IPI1: 247 1053 1701 634 Function call interrupts IPI2: 0 0 0 0 CPU stop interrupts IPI3: 0 0 0 0 CPU stop (for crash dump) interrupts IPI4: 0 0 0 0 Timer broadcast interrupts IPI5: 7 9 5 0 IRQ work interrupts IPI6: 0 0 0 0 CPU wake-up interrupts ERR: 0 Link: https://lkml.kernel.org/r/20230406220451.1583239-1-f.fainelli@gmail.com Signed-off-by: Florian Fainelli Cc: Jan Kiszka Cc: Kieran Bingham Signed-off-by: Andrew Morton commit 8af055ae25bff48f57227f5e3d48a4306f3dd1c4 Author: Florian Fainelli Date: Thu Apr 6 14:52:51 2023 -0700 scripts/gdb: raise error with reduced debugging information If CONFIG_DEBUG_INFO_REDUCED is enabled in the kernel configuration, we will typically not be able to load vmlinux-gdb.py and will fail with: Traceback (most recent call last): File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/vmlinux-gdb.py", line 25, in import linux.utils File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/scripts/gdb/linux/utils.py", line 131, in atomic_long_counter_offset = atomic_long_type.get_type()['counter'].bitpos KeyError: 'counter' Rather be left wondering what is happening only to find out that reduced debug information is the cause, raise an eror. This was not typically a problem until e3c8d33e0d62 ("scripts/gdb: fix 'lx-dmesg' on 32 bits arch") but it has since then. Link: https://lkml.kernel.org/r/20230406215252.1580538-1-f.fainelli@gmail.com Fixes: e3c8d33e0d62 ("scripts/gdb: fix 'lx-dmesg' on 32 bits arch") Signed-off-by: Florian Fainelli Cc: Antonio Borneo Cc: Jan Kiszka Cc: John Ogness Cc: Kieran Bingham Cc: Petr Mladek Signed-off-by: Andrew Morton commit b7235d6bb516fed6d62d2c9e30e7123b6ce5124c Author: Kieran Bingham Date: Tue Apr 4 14:40:49 2023 -0700 scripts/gdb: add a Radix Tree Parser Linux makes use of the Radix Tree data structure to store pointers indexed by integer values. This structure is utilised across many structures in the kernel including the IRQ descriptor tables, and several filesystems. This module provides a method to lookup values from a structure given its head node. Usage: The function lx_radix_tree_lookup, must be given a symbol of type struct radix_tree_root, and an index into that tree. The object returned is a generic integer value, and must be cast correctly to the type based on the storage in the data structure. For example, to print the irq descriptor in the sparse irq_desc_tree at index 18, try the following: (gdb) print (struct irq_desc)$lx_radix_tree_lookup(irq_desc_tree, 18) This script previously existed under commit e127a73d41ac471d7e3ba950cf128f42d6ee3448 ("scripts/gdb: add a Radix Tree Parser") and was later reverted with b447e02548a3304c47b78b5e2d75a4312a8f17e1i (Revert "scripts/gdb: add a Radix Tree Parser"). This version expects the XArray based radix tree implementation and has been verified using QEMU/x86 on Linux 6.3-rc5. [f.fainelli@gmail.com: revive and update for xarray implementation] [f.fainelli@gmail.com: guard against a NULL node in the while loop] Link: https://lkml.kernel.org/r/20230405222743.1191674-1-f.fainelli@gmail.com Link: https://lkml.kernel.org/r/20230404214049.1016811-1-f.fainelli@gmail.com Signed-off-by: Kieran Bingham Signed-off-by: Florian Fainelli Cc: Jan Kiszka Cc: Kieran Bingham Signed-off-by: Andrew Morton commit b0687c1119b4e8c88a651b6e876b7eae28d076e3 Author: Noah Goldstein Date: Tue Apr 4 17:13:51 2023 -0500 lib/rbtree: use '+' instead of '|' for setting color. This has a slight benefit for x86 and has no effect on other targets. The benefit to x86 is it change the codegen for setting a node to block from `mov %r0, %r1; or $RB_BLACK, %r1` to `lea RB_BLACK(%r0), %r1` which saves an instructions. In all other cases it just replace ALU with ALU (or -> and) which perform the same on all machines I am aware of. Total instructions in rbtree.o: Before - 802 After - 782 so it saves about 20 `mov` instructions. Link: https://lkml.kernel.org/r/20230404221350.3806566-1-goldstein.w.n@gmail.com Signed-off-by: Noah Goldstein Cc: Michel Lespinasse Signed-off-by: Andrew Morton commit 1be2edb25c72c3fe1bf955694c5521b035fcb276 Author: Heiko Carstens Date: Wed Apr 5 16:34:52 2023 +0200 proc/stat: remove arch_idle_time() The last (only) architecture specific arch_idle_time() implementation was removed with commit be76ea614460 ("s390/idle: remove arch_cpu_idle_time() and corresponding code"). Therefore remove the now dead code in fs/proc/stat.c as well. Link: https://lkml.kernel.org/r/20230405143452.2677172-1-hca@linux.ibm.com Signed-off-by: Heiko Carstens Cc: Alexey Dobriyan Signed-off-by: Andrew Morton commit d6ccdd678e459fdcfe675a45c76b3f1a75b9a8e8 Author: Matthieu Baerts Date: Mon Apr 3 18:23:50 2023 +0200 checkpatch: check for misuse of the link tags "Link:" and "Closes:" tags have to be used with public URLs. It is difficult to make sure the link is public but at least we can verify the tag is followed by 'http(s)://'. With that, we avoid such a tag that is not allowed [1]: Closes: Now that we check the "link" tags are followed by a URL, we can relax the check linked to "Reported-by being followed by a link tag" to only verify if a "link" tag is present after the "Reported-by" one. Link: https://lore.kernel.org/linux-doc/CAHk-=wh0v1EeDV3v8TzK81nDC40=XuTdY2MCr0xy3m3FiBV3+Q@mail.gmail.com/ [1] Link: https://lkml.kernel.org/r/20230314-doc-checkpatch-closes-tag-v4-5-d26d1fa66f9f@tessares.net Signed-off-by: Matthieu Baerts Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Bagas Sanjaya Cc: Daniel Vetter Cc: David Airlie Cc: Dwaipayan Ray Cc: Jonathan Corbet Cc: Kai Wasserbäch Cc: Konstantin Ryabitsev Cc: Linus Torvalds Cc: Lukas Bulwahn Cc: Thorsten Leemhuis Signed-off-by: Andrew Morton commit 44c31888098a590b8ec5ba37009e5a983f7c4b46 Author: Matthieu Baerts Date: Mon Apr 3 18:23:49 2023 +0200 checkpatch: allow Closes tags with links As a follow-up of a previous patch modifying the documentation to allow using the "Closes:" tag, checkpatch.pl is updated accordingly. checkpatch.pl now no longer complain when the "Closes:" tag is used by itself: commit 76f381bb77a0 ("checkpatch: warn when unknown tags are used for links") ... or after the "Reported-by:" tag: commit d7f1d71e5ef6 ("checkpatch: warn when Reported-by: is not followed by Link:") Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/373 Link: https://lkml.kernel.org/r/20230314-doc-checkpatch-closes-tag-v4-4-d26d1fa66f9f@tessares.net Signed-off-by: Matthieu Baerts Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Bagas Sanjaya Cc: Daniel Vetter Cc: David Airlie Cc: Dwaipayan Ray Cc: Jonathan Corbet Cc: Kai Wasserbäch Cc: Konstantin Ryabitsev Cc: Linus Torvalds Cc: Lukas Bulwahn Cc: Thorsten Leemhuis Signed-off-by: Andrew Morton commit f94e40ea272b9847833de1114677eb5ad8b12a0a Author: Matthieu Baerts Date: Mon Apr 3 18:23:48 2023 +0200 checkpatch: use a list of "link" tags The following commit will allow the use of a similar "link" tag. Because there is a possibility that other similar tags will be added in the future and to reduce the number of places where the code will be modified to allow this new tag, a list with all these "link" tags is now used. Two variables are created from it: one to search for such tags and one to print all tags in a warning message. Link: https://lkml.kernel.org/r/20230314-doc-checkpatch-closes-tag-v4-3-d26d1fa66f9f@tessares.net Signed-off-by: Matthieu Baerts Suggested-by: Joe Perches Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Bagas Sanjaya Cc: Daniel Vetter Cc: David Airlie Cc: Dwaipayan Ray Cc: Jonathan Corbet Cc: Kai Wasserbäch Cc: Konstantin Ryabitsev Cc: Linus Torvalds Cc: Lukas Bulwahn Cc: Thorsten Leemhuis Signed-off-by: Andrew Morton commit c917a872cee480d1fc8461da9be93e27e7977877 Author: Matthieu Baerts Date: Mon Apr 3 18:23:47 2023 +0200 checkpatch: don't print the next line if not defined When checking if "Reported-by" tag is followed by "Link:", there is no need to print the next line if there is no next line. While at it, also mention in this case that the "Link:" tag should be followed by a URL, similar to the next warning. By doing that, the code is now similar to what is done above when checking if the Co-developed-by tag is properly used. Link: https://lkml.kernel.org/r/20230314-doc-checkpatch-closes-tag-v4-2-d26d1fa66f9f@tessares.net Fixes: d7f1d71e5ef6 ("checkpatch: warn when Reported-by: is not followed by Link:") Signed-off-by: Matthieu Baerts Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Bagas Sanjaya Cc: Daniel Vetter Cc: David Airlie Cc: Dwaipayan Ray Cc: Jonathan Corbet Cc: Kai Wasserbäch Cc: Konstantin Ryabitsev Cc: Linus Torvalds Cc: Lukas Bulwahn Cc: Thorsten Leemhuis Signed-off-by: Andrew Morton commit 0d828200ad56505a827610af876ca0b138b943a6 Author: Matthieu Baerts Date: Mon Apr 3 18:23:46 2023 +0200 docs: process: allow Closes tags with links Since v6.3, checkpatch.pl now complains about the use of "Closes:" tags followed by a link [1]. It also complains if a "Reported-by:" tag is followed by a "Closes:" one [2]. As detailed in the first patch, this "Closes:" tag is used for a bit of time, mainly by DRM and MPTCP subsystems. It is used by some bug trackers to automate the closure of issues when a patch is accepted. It is even planned to use this tag with bugzilla.kernel.org [3]. The first patch updates the documentation to explain what is this "Closes:" tag and how/when to use it. The second patch modifies checkpatch.pl to stop complaining about it. The DRM maintainers and their mailing list have been added in Cc as they are probably interested by these two patches as well. [1] https://lore.kernel.org/all/3b036087d80b8c0e07a46a1dbaaf4ad0d018f8d5.1674217480.git.linux@leemhuis.info/ [2] https://lore.kernel.org/all/bb5dfd55ea2026303ab2296f4a6df3da7dd64006.1674217480.git.linux@leemhuis.info/ [3] https://lore.kernel.org/linux-doc/20230315181205.f3av7h6owqzzw64p@meerkat.local/ This patch (of 5): Making sure a bug tracker is up to date is not an easy task. For example, a first version of a patch fixing a tracked issue can be sent a long time after having created the issue. But also, it can take some time to have this patch accepted upstream in its final form. When it is done, someone -- probably not the person who accepted the patch -- has to remember about closing the corresponding issue. This task of closing and tracking the patch can be done automatically by bug trackers like GitLab [1], GitHub [2] and hopefully soon [3] bugzilla.kernel.org when the appropriated tag is used. The two first ones accept multiple tags but it is probably better to pick one. According to commit 76f381bb77a0 ("checkpatch: warn when unknown tags are used for links"), the "Closes" tag seems to have been used in the past by a few people and it is supported by popular bug trackers. Here is how it has been used in the past: $ git log --no-merges --format=email -P --grep='^Closes: http' | \ grep '^Closes: http' | cut -d/ -f3-5 | sort | uniq -c | sort -rn 391 gitlab.freedesktop.org/drm/intel 79 github.com/multipath-tcp/mptcp_net-next 8 gitlab.freedesktop.org/drm/msm 3 gitlab.freedesktop.org/drm/amd 2 gitlab.freedesktop.org/mesa/mesa 1 patchwork.freedesktop.org/series/73320 1 gitlab.freedesktop.org/lima/linux 1 gitlab.freedesktop.org/drm/nouveau 1 github.com/ClangBuiltLinux/linux 1 bugzilla.netfilter.org/show_bug.cgi?id=1579 1 bugzilla.netfilter.org/show_bug.cgi?id=1543 1 bugzilla.netfilter.org/show_bug.cgi?id=1436 1 bugzilla.netfilter.org/show_bug.cgi?id=1427 1 bugs.debian.org/625804 Likely here, the "Closes" tag was only properly used with GitLab and GitHub. We can also see that it has been used quite a few times (and still used recently) and this is then not a "random tag that makes no sense" like it was the case with "BugLink" recently [4]. It has also been misused but that was a long time ago, when it was common to use many different random tags. checkpatch.pl script should then stop complaining about this "Closes" tag. As suggested by Thorsten [5], if this tag is accepted, it should first be described in the documentation. This is what is done here in this patch. To avoid confusion, the "Closes" should be used with any public bug report. No need to check if the underlying bug tracker supports automations. Having this tag with any kind of public bug reports allows bots like regzbot to clearly identify patches fixing a specific bug and avoid false-positives, e.g. patches mentioning it is related to an issue but not fixing it. As suggested by Thorsten [6] again, if we follow the same logic, the "Closes" tag should then be used after a "Reported-by" one. Note that thanks to this "Closes" tag, the mentioned bug trackers can also locate where a patch has been applied in different branches and repositories. If only the "Link" tag is used, the tracking can also be done but the ticket will not be closed and a manual operation will be needed. Also, these bug trackers have some safeguards: the closure is only done if a commit having the "Closes:" tag is applied in a specific branch. It will then not be closed if a random commit having the same tag is published elsewhere. Also in case of closure, a notification is sent to the owners. Link: https://lkml.kernel.org/r/20230314-doc-checkpatch-closes-tag-v4-0-d26d1fa66f9f@tessares.net Link: https://docs.gitlab.com/ee/user/project/issues/managing_issues.html#default-closing-pattern [1] Link: https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests [2] Link: https://lore.kernel.org/linux-doc/20230315181205.f3av7h6owqzzw64p@meerkat.local/ [3] Link: https://lore.kernel.org/all/CAHk-=wgs38ZrfPvy=nOwVkVzjpM3VFU1zobP37Fwd_h9iAD5JQ@mail.gmail.com/ [4] Link: https://lore.kernel.org/all/688cd6cb-90ab-6834-a6f5-97080e39ca8e@leemhuis.info/ [5] Link: https://lore.kernel.org/linux-doc/2194d19d-f195-1a1e-41fc-7827ae569351@leemhuis.info/ [6] Link: https://github.com/multipath-tcp/mptcp_net-next/issues/373 Link: https://lkml.kernel.org/r/20230314-doc-checkpatch-closes-tag-v4-1-d26d1fa66f9f@tessares.net Signed-off-by: Matthieu Baerts Suggested-by: Thorsten Leemhuis Acked-by: Konstantin Ryabitsev Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Bagas Sanjaya Cc: Daniel Vetter Cc: David Airlie Cc: Dwaipayan Ray Cc: Jonathan Corbet Cc: Kai Wasserbäch Cc: Linus Torvalds Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit 8fc2a304f57cb304231a4b0564d5995b2dd04f63 Author: Peng Liu Date: Tue Mar 21 14:20:04 2023 +0800 scripts/gdb: fix lx-timerlist for HRTIMER_MAX_CLOCK_BASES printing HRTIMER_MAX_CLOCK_BASES is of enum type hrtimer_base_type. To print it as an integer, HRTIMER_MAX_CLOCK_BASES should be converted first. Link: https://lkml.kernel.org/r/TYCP286MB214640FF0E7F04AC3926A39EC6819@TYCP286MB2146.JPNP286.PROD.OUTLOOK.COM Signed-off-by: Peng Liu Reviewed-by: Jan Kiszka Cc: Florian Fainelli Cc: Kieran Bingham Signed-off-by: Andrew Morton commit 7362042f3556528e9e9b1eb5ce8d7a3a6331476b Author: Peng Liu Date: Tue Mar 21 14:19:29 2023 +0800 scripts/gdb: fix lx-timerlist for Python3 Below incompatibilities between Python2 and Python3 made lx-timerlist fail to run under Python3. o xrange() is replaced by range() in Python3 o bytes and str are different types in Python3 o the return value of Inferior.read_memory() is memoryview object in Python3 akpm: cc stable so that older kernels are properly debuggable under newer Python. Link: https://lkml.kernel.org/r/TYCP286MB2146EE1180A4D5176CBA8AB2C6819@TYCP286MB2146.JPNP286.PROD.OUTLOOK.COM Signed-off-by: Peng Liu Reviewed-by: Jan Kiszka Cc: Florian Fainelli Cc: Kieran Bingham Cc: Signed-off-by: Andrew Morton commit 747cd84f677cedb27db10d4ada777d7ec20431ee Author: Peng Liu Date: Tue Mar 21 14:18:43 2023 +0800 scripts/gdb: fix lx-timerlist for struct timequeue_head change commit 511885d7061e ("lib/timerqueue: Rely on rbtree semantics for next timer") changed struct timerqueue_head, and so print_active_timers() should be changed accordingly with its way to interpret the structure. Link: https://lkml.kernel.org/r/TYCP286MB21463BD277330B26DDC18903C6819@TYCP286MB2146.JPNP286.PROD.OUTLOOK.COM Signed-off-by: Peng Liu Reviewed-by: Jan Kiszka Cc: Kieran Bingham Cc: Florian Fainelli Signed-off-by: Andrew Morton commit f7b8f70ba44fb63df47b6fc3204d49ac2885de64 Author: Luca Vizzarro Date: Fri Apr 14 16:24:58 2023 +0100 memfd: pass argument of memfd_fcntl as int The interface for fcntl expects the argument passed for the command F_ADD_SEALS to be of type int. The current code wrongly treats it as a long. In order to avoid access to undefined bits, we should explicitly cast the argument to int. This commit changes the signature of all the related and helper functions so that they treat the argument as int instead of long. Link: https://lkml.kernel.org/r/20230414152459.816046-5-Luca.Vizzarro@arm.com Signed-off-by: Luca Vizzarro Cc: Alexander Viro Cc: Christian Brauner Cc: Jeff Layton Cc: Chuck Lever Cc: Kevin Brodsky Cc: Vincenzo Frascino Cc: Szabolcs Nagy Cc: "Theodore Ts'o" Cc: David Laight Cc: Mark Rutland Signed-off-by: Andrew Morton commit 7f63cf2d9b9bbe7b90f808927558a66ff737d399 Author: Kalesh Singh Date: Thu Apr 13 14:43:26 2023 -0700 mm: Multi-gen LRU: remove wait_event_killable() Android 14 and later default to MGLRU [1] and field telemetry showed occasional long tail latency (>100ms) in the reclaim path. Tracing revealed priority inversion in the reclaim path. In try_to_inc_max_seq(), when high priority tasks were blocked on wait_event_killable(), the preemption of the low priority task to call wake_up_all() caused those high priority tasks to wait longer than necessary. In general, this problem is not different from others of its kind, e.g., one caused by mutex_lock(). However, it is specific to MGLRU because it introduced the new wait queue lruvec->mm_state.wait. The purpose of this new wait queue is to avoid the thundering herd problem. If many direct reclaimers rush into try_to_inc_max_seq(), only one can succeed, i.e., the one to wake up the rest, and the rest who failed might cause premature OOM kills if they do not wait. So far there is no evidence supporting this scenario, based on how often the wait has been hit. And this begs the question how useful the wait queue is in practice. Based on Minchan's recommendation, which is in line with his commit 6d4675e60135 ("mm: don't be stuck to rmap lock on reclaim path") and the rest of the MGLRU code which also uses trylock when possible, remove the wait queue. [1] https://android-review.googlesource.com/q/I7ed7fbfd6ef9ce10053347528125dd98c39e50bf Link: https://lkml.kernel.org/r/20230413214326.2147568-1-kaleshsingh@google.com Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks") Signed-off-by: Kalesh Singh Suggested-by: Minchan Kim Reported-by: Wei Wang Acked-by: Yu Zhao Cc: Minchan Kim Cc: Jan Alexander Steffens (heftig) Cc: Oleksandr Natalenko Cc: Suleiman Souhlal Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit ed8f3f999e9270ccc542ac44e237e389a2687a9e Author: Yang Yang Date: Thu Apr 13 16:34:49 2023 +0800 mm: workingset: update description of the source file The calculation of workingset size is the core logic of handling refault, it had been updated several times[1][2] after workingset.c was created[3]. But the description hadn't been updated accordingly, this mismatch may confuse the readers. So we update the description to make it consistent to the code. [1] commit 34e58cac6d8f ("mm: workingset: let cache workingset challenge anon") [2] commit aae466b0052e ("mm/swap: implement workingset detection for anonymous LRU") [3] commit a528910e12ec ("mm: thrash detection-based file cache sizing") Link: https://lkml.kernel.org/r/202304131634494948454@zte.com.cn Signed-off-by: Yang Yang Cc: Johannes Weiner Cc: Joonsoo Kim Signed-off-by: Andrew Morton commit 1f6ab566cb3be9e8292e34b89e8be83d75aa232e Author: Pavankumar Kondeti Date: Thu Apr 13 15:38:59 2023 +0530 printk: export console trace point for kcsan/kasan/kfence/kmsan The console tracepoint is used by kcsan/kasan/kfence/kmsan test modules. Since this tracepoint is not exported, these modules iterate over all available tracepoints to find the console trace point. Export the trace point so that it can be directly used. Link: https://lkml.kernel.org/r/20230413100859.1492323-1-quic_pkondeti@quicinc.com Signed-off-by: Pavankumar Kondeti Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: John Ogness Cc: Marco Elver Cc: Petr Mladek Cc: Sergey Senozhatsky Cc: Steven Rostedt Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit c7b23b68e2aa93f86a206222d23ccd9a21f5982a Author: Yosry Ahmed Date: Thu Apr 13 10:40:34 2023 +0000 mm: vmscan: refactor updating current->reclaim_state During reclaim, we keep track of pages reclaimed from other means than LRU-based reclaim through scan_control->reclaim_state->reclaimed_slab, which we stash a pointer to in current task_struct. However, we keep track of more than just reclaimed slab pages through this. We also use it for clean file pages dropped through pruned inodes, and xfs buffer pages freed. Rename reclaimed_slab to reclaimed, and add a helper function that wraps updating it through current, so that future changes to this logic are contained within include/linux/swap.h. Link: https://lkml.kernel.org/r/20230413104034.1086717-4-yosryahmed@google.com Signed-off-by: Yosry Ahmed Acked-by: Michal Hocko Cc: Alexander Viro Cc: Christoph Lameter Cc: Darrick J. Wong Cc: Dave Chinner Cc: David Hildenbrand Cc: David Rientjes Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Johannes Weiner Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Miaohe Lin Cc: NeilBrown Cc: Peter Xu Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tim Chen Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton commit ef05e68936ff06e64919b3428ac92c4de002366c Author: Yosry Ahmed Date: Thu Apr 13 10:40:33 2023 +0000 mm: vmscan: move set_task_reclaim_state() near flush_reclaim_state() Move set_task_reclaim_state() near flush_reclaim_state() so that all helpers manipulating reclaim_state are in close proximity. Link: https://lkml.kernel.org/r/20230413104034.1086717-3-yosryahmed@google.com Signed-off-by: Yosry Ahmed Acked-by: Michal Hocko Cc: Alexander Viro Cc: Christoph Lameter Cc: Darrick J. Wong Cc: Dave Chinner Cc: David Hildenbrand Cc: David Rientjes Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Johannes Weiner Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Miaohe Lin Cc: NeilBrown Cc: Peter Xu Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tim Chen Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton commit 583c27a167c2bc6088ec80be0d16ef44dd9fc6b0 Author: Yosry Ahmed Date: Thu Apr 13 10:40:32 2023 +0000 mm: vmscan: ignore non-LRU-based reclaim in memcg reclaim Patch series "Ignore non-LRU-based reclaim in memcg reclaim", v6. Upon running some proactive reclaim tests using memory.reclaim, we noticed some tests flaking where writing to memory.reclaim would be successful even though we did not reclaim the requested amount fully Looking further into it, I discovered that *sometimes* we overestimate the number of reclaimed pages in memcg reclaim. Reclaimed pages through other means than LRU-based reclaim are tracked through reclaim_state in struct scan_control, which is stashed in current task_struct. These pages are added to the number of reclaimed pages through LRUs. For memcg reclaim, these pages generally cannot be linked to the memcg under reclaim and can cause an overestimated count of reclaimed pages. This short series tries to address that. Patch 1 ignores pages reclaimed outside of LRU reclaim in memcg reclaim. The pages are uncharged anyway, so even if we end up under-reporting reclaimed pages we will still succeed in making progress during charging. Patches 2-3 are just refactoring. Patch 2 moves set_reclaim_state() helper next to flush_reclaim_state(). Patch 3 adds a helper that wraps updating current->reclaim_state, and renames reclaim_state->reclaimed_slab to reclaim_state->reclaimed. This patch (of 3): We keep track of different types of reclaimed pages through reclaim_state->reclaimed_slab, and we add them to the reported number of reclaimed pages. For non-memcg reclaim, this makes sense. For memcg reclaim, we have no clue if those pages are charged to the memcg under reclaim. Slab pages are shared by different memcgs, so a freed slab page may have only been partially charged to the memcg under reclaim. The same goes for clean file pages from pruned inodes (on highmem systems) or xfs buffer pages, there is no simple way to currently link them to the memcg under reclaim. Stop reporting those freed pages as reclaimed pages during memcg reclaim. This should make the return value of writing to memory.reclaim, and may help reduce unnecessary reclaim retries during memcg charging. Writing to memory.reclaim on the root memcg is considered as cgroup_reclaim(), but for this case we want to include any freed pages, so use the global_reclaim() check instead of !cgroup_reclaim(). Generally, this should make the return value of try_to_free_mem_cgroup_pages() more accurate. In some limited cases (e.g. freed a slab page that was mostly charged to the memcg under reclaim), the return value of try_to_free_mem_cgroup_pages() can be underestimated, but this should be fine. The freed pages will be uncharged anyway, and we can charge the memcg the next time around as we usually do memcg reclaim in a retry loop. Link: https://lkml.kernel.org/r/20230413104034.1086717-1-yosryahmed@google.com Link: https://lkml.kernel.org/r/20230413104034.1086717-2-yosryahmed@google.com Fixes: f2fe7b09a52b ("mm: memcg/slab: charge individual slab objects instead of pages") Signed-off-by: Yosry Ahmed Acked-by: David Hildenbrand Acked-by: Michal Hocko Cc: Alexander Viro Cc: Christoph Lameter Cc: Darrick J. Wong Cc: Dave Chinner Cc: David Rientjes Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Johannes Weiner Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Miaohe Lin Cc: NeilBrown Cc: Peter Xu Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tim Chen Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton commit d905ae2b0f7eaf8fb37febfe4833ccf3f8c1c27a Author: Alexander Potapenko Date: Thu Apr 13 15:12:23 2023 +0200 mm: apply __must_check to vmap_pages_range_noflush() To prevent errors when vmap_pages_range_noflush() or __vmap_pages_range_noflush() silently fail (see the link below for an example), annotate them with __must_check so that the callers do not unconditionally assume the mapping succeeded. Link: https://lkml.kernel.org/r/20230413131223.4135168-4-glider@google.com Signed-off-by: Alexander Potapenko Reported-by: Dipanjan Das Link: https://lore.kernel.org/linux-mm/CANX2M5ZRrRA64k0hOif02TjmY9kbbO2aCBPyq79es34RXZ=cAw@mail.gmail.com/ Reviewed-by: Marco Elver Cc: Christoph Hellwig Cc: Dmitry Vyukov Cc: Uladzislau Rezki (Sony) Signed-off-by: Andrew Morton commit bb1508c24c9c361e6344308c8de2cb81d7f228ba Author: Alexander Potapenko Date: Thu Apr 13 15:12:22 2023 +0200 mm: kmsan: apply __must_check to non-void functions Non-void KMSAN hooks may return error codes that indicate that KMSAN failed to reflect the changed memory state in the metadata (e.g. it could not create the necessary memory mappings). In such cases the callers should handle the errors to prevent the tool from using the inconsistent metadata in the future. We mark non-void hooks with __must_check so that error handling is not skipped. Link: https://lkml.kernel.org/r/20230413131223.4135168-3-glider@google.com Signed-off-by: Alexander Potapenko Reviewed-by: Marco Elver Cc: Christoph Hellwig Cc: Dipanjan Das Cc: Dmitry Vyukov Cc: Uladzislau Rezki (Sony) Signed-off-by: Andrew Morton commit 1cb9dc4b475c7418f925ab0c97b6750007d9f52e Author: Liu Shixin Date: Thu Apr 13 21:13:49 2023 +0800 mm: hwpoison: support recovery from HugePage copy-on-write faults copy-on-write of hugetlb user pages with uncorrectable errors will result in a kernel crash. This is because the copy is performed in kernel mode and in general we can not handle accessing memory with such errors while in kernel mode. Commit a873dfe1032a ("mm, hwpoison: try to recover from copy-on write faults") introduced the routine copy_user_highpage_mc() to gracefully handle copying of user pages with uncorrectable errors. However, the separate hugetlb copy-on-write code paths were not modified as part of commit a873dfe1032a. Modify hugetlb copy-on-write code paths to use copy_mc_user_highpage() so that they can also gracefully handle uncorrectable errors in user pages. This involves changing the hugetlb specific routine copy_user_large_folio() from type void to int so that it can return an error. Modify the hugetlb userfaultfd code in the same way so that it can return -EHWPOISON if it encounters an uncorrectable error. Link: https://lkml.kernel.org/r/20230413131349.2524210-1-liushixin2@huawei.com Signed-off-by: Liu Shixin Acked-by: Mike Kravetz Reviewed-by: Naoya Horiguchi Cc: Miaohe Lin Cc: Muchun Song Cc: Tony Luck Signed-off-by: Andrew Morton commit ec342603e6d7404c17936a6b53670c28355d3bc3 Author: Yosry Ahmed Date: Wed Apr 12 00:34:51 2023 +0000 memcg: page_cgroup_ino() get memcg from the page's folio In a kernel with added WARN_ON_ONCE(PageTail) in page_memcg_check(), we observed a warning from page_cgroup_ino() when reading /proc/kpagecgroup. This warning was added to catch fragile reads of a page memcg. Make page_cgroup_ino() get memcg from the page's folio using folio_memcg_check(): that gives it the correct memcg for each page of a folio, so is the right fix. Note that page_folio() is racy, the page's folio can change from under us, but the entire function is racy and documented as such. I dithered between the right fix and the safer "fix": it's unlikely but conceivable that some userspace has learnt that /proc/kpagecgroup gives no memcg on tail pages, and compensates for that in some (racy) way: so continuing to give no memcg on tails, without warning, might be safer. But hwpoison_filter_task(), the only other user of page_cgroup_ino(), persuaded me. It looks as if it currently leaves out tail pages of the selected memcg, by mistake: whereas hwpoison_inject() uses compound_head() and expects the tails to be included. So hwpoison testing coverage has probably been restricted by the wrong output from page_cgroup_ino() (if that memcg filter is used at all): in the short term, it might be safer not to enable wider coverage there, but long term we would regret that. This is based on a patch originally written by Hugh Dickins and retains most of the original commit log [1] The patch was changed to use folio_memcg_check(page_folio(page)) instead of page_memcg_check(compound_head(page)) based on discussions with Matthew Wilcox; where he stated that callers of page_memcg_check() should stop using it due to the ambiguity around tail pages -- instead they should use folio_memcg_check() and handle tail pages themselves. Link: https://lkml.kernel.org/r/20230412003451.4018887-1-yosryahmed@google.com Link: https://lore.kernel.org/linux-mm/20230313083452.1319968-1-yosryahmed@google.com/ [1] Signed-off-by: Yosry Ahmed Cc: Hugh Dickins Cc: Johannes Weiner Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Muchun Song Cc: Naoya Horiguchi Cc: Roman Gushchin Cc: Shakeel Butt Cc: Vladimir Davydov Signed-off-by: Andrew Morton commit 0b376f1e0ff555435597fa16823ae0f30b2883e3 Author: Aneesh Kumar K.V Date: Wed Apr 12 10:30:25 2023 +0530 mm/hugetlb_vmemmap: rename ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP Now we use ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP config option to indicate devdax and hugetlb vmemmap optimization support. Hence rename that to a generic ARCH_WANT_OPTIMIZE_VMEMMAP Link: https://lkml.kernel.org/r/20230412050025.84346-2-aneesh.kumar@linux.ibm.com Signed-off-by: Aneesh Kumar K.V Reviewed-by: Muchun Song Cc: Joao Martins Cc: Dan Williams Cc: Mike Kravetz Cc: Tarun Sahu Signed-off-by: Andrew Morton commit 87a7ae75d7383afa998f57656d1d14e2a730cc47 Author: Aneesh Kumar K.V Date: Tue Apr 11 19:52:13 2023 +0530 mm/vmemmap/devdax: fix kernel crash when probing devdax devices commit 4917f55b4ef9 ("mm/sparse-vmemmap: improve memory savings for compound devmaps") added support for using optimized vmmemap for devdax devices. But how vmemmap mappings are created are architecture specific. For example, powerpc with hash translation doesn't have vmemmap mappings in init_mm page table instead they are bolted table entries in the hardware page table vmemmap_populate_compound_pages() used by vmemmap optimization code is not aware of these architecture-specific mapping. Hence allow architecture to opt for this feature. I selected architectures supporting HUGETLB_PAGE_OPTIMIZE_VMEMMAP option as also supporting this feature. This patch fixes the below crash on ppc64. BUG: Unable to handle kernel data access on write at 0xc00c000100400038 Faulting instruction address: 0xc000000001269d90 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 7 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc5-150500.34-default+ #2 5c90a668b6bbd142599890245c2fb5de19d7d28a Hardware name: IBM,9009-42G POWER9 (raw) 0x4e0202 0xf000005 of:IBM,FW950.40 (VL950_099) hv:phyp pSeries NIP: c000000001269d90 LR: c0000000004c57d4 CTR: 0000000000000000 REGS: c000000003632c30 TRAP: 0300 Not tainted (6.3.0-rc5-150500.34-default+) MSR: 8000000000009033 CR: 24842228 XER: 00000000 CFAR: c0000000004c57d0 DAR: c00c000100400038 DSISR: 42000000 IRQMASK: 0 .... NIP [c000000001269d90] __init_single_page.isra.74+0x14/0x4c LR [c0000000004c57d4] __init_zone_device_page+0x44/0xd0 Call Trace: [c000000003632ed0] [c000000003632f60] 0xc000000003632f60 (unreliable) [c000000003632f10] [c0000000004c5ca0] memmap_init_zone_device+0x170/0x250 [c000000003632fe0] [c0000000005575f8] memremap_pages+0x2c8/0x7f0 [c0000000036330c0] [c000000000557b5c] devm_memremap_pages+0x3c/0xa0 [c000000003633100] [c000000000d458a8] dev_dax_probe+0x108/0x3e0 [c0000000036331a0] [c000000000d41430] dax_bus_probe+0xb0/0x140 [c0000000036331d0] [c000000000cef27c] really_probe+0x19c/0x520 [c000000003633260] [c000000000cef6b4] __driver_probe_device+0xb4/0x230 [c0000000036332e0] [c000000000cef888] driver_probe_device+0x58/0x120 [c000000003633320] [c000000000cefa6c] __device_attach_driver+0x11c/0x1e0 [c0000000036333a0] [c000000000cebc58] bus_for_each_drv+0xa8/0x130 [c000000003633400] [c000000000ceefcc] __device_attach+0x15c/0x250 [c0000000036334a0] [c000000000ced458] bus_probe_device+0x108/0x110 [c0000000036334f0] [c000000000ce92dc] device_add+0x7fc/0xa10 [c0000000036335b0] [c000000000d447c8] devm_create_dev_dax+0x1d8/0x530 [c000000003633640] [c000000000d46b60] __dax_pmem_probe+0x200/0x270 [c0000000036337b0] [c000000000d46bf0] dax_pmem_probe+0x20/0x70 [c0000000036337d0] [c000000000d2279c] nvdimm_bus_probe+0xac/0x2b0 [c000000003633860] [c000000000cef27c] really_probe+0x19c/0x520 [c0000000036338f0] [c000000000cef6b4] __driver_probe_device+0xb4/0x230 [c000000003633970] [c000000000cef888] driver_probe_device+0x58/0x120 [c0000000036339b0] [c000000000cefd08] __driver_attach+0x1d8/0x240 [c000000003633a30] [c000000000cebb04] bus_for_each_dev+0xb4/0x130 [c000000003633a90] [c000000000cee564] driver_attach+0x34/0x50 [c000000003633ab0] [c000000000ced878] bus_add_driver+0x218/0x300 [c000000003633b40] [c000000000cf1144] driver_register+0xa4/0x1b0 [c000000003633bb0] [c000000000d21a0c] __nd_driver_register+0x5c/0x100 [c000000003633c10] [c00000000206a2e8] dax_pmem_init+0x34/0x48 [c000000003633c30] [c0000000000132d0] do_one_initcall+0x60/0x320 [c000000003633d00] [c0000000020051b0] kernel_init_freeable+0x360/0x400 [c000000003633de0] [c000000000013764] kernel_init+0x34/0x1d0 [c000000003633e50] [c00000000000de14] ret_from_kernel_thread+0x5c/0x64 Link: https://lkml.kernel.org/r/20230411142214.64464-1-aneesh.kumar@linux.ibm.com Fixes: 4917f55b4ef9 ("mm/sparse-vmemmap: improve memory savings for compound devmaps") Signed-off-by: Aneesh Kumar K.V Reported-by: Tarun Sahu Reviewed-by: Joao Martins Cc: Muchun Song Cc: Dan Williams Cc: Mike Kravetz Cc: Signed-off-by: Andrew Morton commit 43759d44dc346273efd79e99ba5d195ed6c2bfa2 Author: Peter Xu Date: Wed Apr 12 12:45:48 2023 -0400 selftests/mm: add uffdio register ioctls test This new test tests against the returned ioctls from UFFDIO_REGISTER, where put into uffdio_register.ioctls. This also tests the expected failure cases of UFFDIO_REGISTER, aka: - Register with empty mode should fail with -EINVAL - Register minor without page cache (anon) should fail with -EINVAL Link: https://lkml.kernel.org/r/20230412164548.329376-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 5aec236fdd69d39f9fa5e579d10f7a45ed11b005 Author: Peter Xu Date: Wed Apr 12 12:45:46 2023 -0400 selftests/mm: add shmem-private test to uffd-stress The userfaultfd stress test never tested private shmem, which I think was overlooked long due. Add it so it matches with uffd unit test and it'll cover all memory supported with the three memory types. Meanwhile, rename the memory types a bit. Considering shared mem is the major use case for both shmem / hugetlbfs, changing from: anon, hugetlb, hugetlb_shared, shmem To (with shmem-private added): anon, hugetlb, hugetlb-private, shmem, shmem-private Add the shmem-private to run_vmtests.sh too. Link: https://lkml.kernel.org/r/20230412164546.329355-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 111fd29b2aed34f1841015df2196a9b489da06b0 Author: Peter Xu Date: Wed Apr 12 12:45:25 2023 -0400 selftests/mm: drop sys/dev test in uffd-stress test With the new uffd unit test covering the /dev/userfaultfd path and syscall path of uffd initializations, we can safely drop the devnode test in the old stress test. One thing is to avoid duplication of running the stress test twice which is an overkill to only test the /dev/ interface in run_vmtests.sh. The other benefit is now all uffd tests (that uses userfaultfd_open) can run automatically as long as any type of interface is enabled (either syscall or dev), so it's more likely to succeed rather than fail due to unprivilege. With this patch lands, we can drop all the "mem_type:XXX" handlings too. Link: https://lkml.kernel.org/r/20230412164525.329176-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit f9da24263db43da12f1e105cb8ac5e02c66f12d0 Author: Peter Xu Date: Wed Apr 12 12:45:20 2023 -0400 selftests/mm: allow uffd test to skip properly with no privilege Allow skip a unit test properly due to no privilege (e.g. sigbus and events tests). [colin.i.king@gmail.com: fix spelling mistake "priviledge" -> "privilege"] Link: https://lkml.kernel.org/r/20230414081506.1678998-1-colin.i.king@gmail.com Link: https://lkml.kernel.org/r/20230412164520.329163-1-peterx@redhat.com Signed-off-by: Peter Xu Signed-off-by: Colin Ian King Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 4df9cefa9419718c32259c105ac8fbbc680410f7 Author: Peter Xu Date: Wed Apr 12 12:45:17 2023 -0400 selftests/mm: workaround no way to detect uffd-minor + wp Userfaultfd minor+wp mode was very recently added. The test will fail on the old kernels at ioctl(UFFDIO_CONTINUE) which is misterious. Unfortunately there's no feature bit to detect for this support. Add a hack to leverage WP_UNPOPULATED to detect whether that feature existed, since WP_UNPOPULATED was merged right after minor+wp. Link: https://lkml.kernel.org/r/20230412164517.329152-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit c3315502c92406ec5bf36ba687f9651b43f838f6 Author: Peter Xu Date: Wed Apr 12 12:44:04 2023 -0400 selftests/mm: move zeropage test into uffd unit tests Simplifies it a bit along the way, e.g., drop the never used offset field (which was always the 1st page so offset=0). Introduce uffd_register_with_ioctls() out of uffd_register() to detect uffdio_register.ioctls got returned. Check that automatically when testing UFFDIO_ZEROPAGE on different types of memory (and kernel). Link: https://lkml.kernel.org/r/20230412164404.328815-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 73c1ea939b658962345e81e8bcff1439ede25eff Author: Peter Xu Date: Wed Apr 12 12:44:00 2023 -0400 selftests/mm: move uffd sig/events tests into uffd unit tests Move the two tests into the unit test, and convert it into 20 standalone tests: - events test on all 5 mem types, with wp on/off - signal test on all 5 mem types, with wp on/off Testing sigbus on anon... done Testing sigbus on shmem... done Testing sigbus on shmem-private... done Testing sigbus on hugetlb... done Testing sigbus on hugetlb-private... done Testing sigbus-wp on anon... done Testing sigbus-wp on shmem... done Testing sigbus-wp on shmem-private... done Testing sigbus-wp on hugetlb... done Testing sigbus-wp on hugetlb-private... done Testing events on anon... done Testing events on shmem... done Testing events on shmem-private... done Testing events on hugetlb... done Testing events on hugetlb-private... done Testing events-wp on anon... done Testing events-wp on shmem... done Testing events-wp on shmem-private... done Testing events-wp on hugetlb... done Testing events-wp on hugetlb-private... done It'll also remove a lot of global references along the way, e.g. test_uffdio_wp will be replaced with the wp value passed over. Link: https://lkml.kernel.org/r/20230412164400.328798-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 62515b5f9fdabf740efd28d5746c219f1b2e75cc Author: Peter Xu Date: Wed Apr 12 12:43:57 2023 -0400 selftests/mm: move uffd minor test to unit test This moves the minor test to the new unit test. Rewrite the content check with char* opeartions to avoid fiddling with my_bcmp(). Drop global vars test_uffdio_minor and test_collapse, just assume test them always in common code for now. OTOH make this single test into five tests: - minor test on [shmem, hugetlb] with wp=false - minor test on [shmem, hugetlb] with wp=true - minor test + collapse on shmem only One thing to mention that we used to test COLLAPSE+WP but that doesn't sound right at all. It's possible it's silently broken but unnoticed because COLLAPSE is not part of the default test suite. Make the MADV_COLLAPSE test fail-able (by skip it when failing), because it's not guaranteed to success anyway. Drop a bunch of useless code after the move, because the unit test always use aligned num of pages and has nothing to do with n_cpus. Link: https://lkml.kernel.org/r/20230412164357.328779-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Zach O'Keefe Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Signed-off-by: Andrew Morton commit 8bda424fca0a0cc056c49a2500df03590648d029 Author: Peter Xu Date: Wed Apr 12 12:43:52 2023 -0400 selftests/mm: move uffd pagemap test to unit test Move it over and make it split into two tests, one for pagemap and one for the new WP_UNPOPULATED (to be a separate one). The thp pagemap test wasn't really working (with MADV_HUGEPAGE). Let's just drop it (since it never really worked anyway..) and leave that for later. Link: https://lkml.kernel.org/r/20230412164352.328733-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Mike Rapoport (IBM) Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 16a45b57cbf2312215fbac79df4b58a0d70e1f2b Author: Peter Xu Date: Wed Apr 12 12:43:48 2023 -0400 selftests/mm: add framework for uffd-unit-test Add a framework to be prepared to move unit tests from uffd-stress.c into uffd-unit-tests.c. The goal is to allow detection of uffd features for each test, and also loop over specified types of memory that a test support. Link: https://lkml.kernel.org/r/20230412164348.328710-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit be39fec4f97f01329ef48a5a3836f592f6a82766 Author: Peter Xu Date: Wed Apr 12 12:43:45 2023 -0400 selftests/mm: allow allocate_area() to fail properly Mostly to detect hugetlb allocation errors and skip hugetlb tests when pages are not allocated. Link: https://lkml.kernel.org/r/20230412164345.328659-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 0210c43ef623a3c35cafd7dbe25b1b3c1699e7e9 Author: Peter Xu Date: Wed Apr 12 12:43:41 2023 -0400 selftests/mm: let uffd_handle_page_fault() take wp parameter Make the handler optionally apply WP bit when resolving page faults for either missing or minor page faults. This moves towards removing global test_uffdio_wp outside of the common code. Link: https://lkml.kernel.org/r/20230412164341.328618-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 508340845dd1423b6c81fccf082039dff202fb9f Author: Peter Xu Date: Wed Apr 12 12:43:37 2023 -0400 selftests/mm: rename uffd_stats to uffd_args Prepare for adding more fields into the struct. Link: https://lkml.kernel.org/r/20230412164337.328607-1-peterx@redhat.com Signed-off-by: Peter Xu Suggested-by: Mike Rapoport (IBM) Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 265818ef988b3a4cd12fc8885966413b78f06d96 Author: Peter Xu Date: Wed Apr 12 12:43:33 2023 -0400 selftests/mm: drop global hpage_size in uffd tests hpage_size was wrongly used. Sometimes it means hugetlb default size, sometimes it was used as thp size. Remove the global variable and use the right one at each place. Link: https://lkml.kernel.org/r/20230412164333.328596-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Mike Rapoport (IBM) Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit c5cb903646f4df0ab3760dcb2e5571b528b6db59 Author: Peter Xu Date: Wed Apr 12 12:43:31 2023 -0400 selftests/mm: drop global mem_fd in uffd tests Drop it by creating the memfd dynamically in the tests. Link: https://lkml.kernel.org/r/20230412164331.328584-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Mike Rapoport (IBM) Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit d5433ce84d2572d43a3c58e5cab21db200669bfd Author: Peter Xu Date: Wed Apr 12 12:42:57 2023 -0400 selftests/mm: UFFDIO_API test Add one simple test for UFFDIO_API. With that, I also added a bunch of small but handy helpers along the way. Link: https://lkml.kernel.org/r/20230412164257.328375-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 78391f6460ee2cb43f64bbdd7a7cf840e5a118a6 Author: Peter Xu Date: Wed Apr 12 12:42:54 2023 -0400 selftests/mm: uffd_open_{dev|sys}() Provide two helpers to open an uffd handle. Drop the error checks around SKIPs because it's inside an errexit() anyway, which IMHO doesn't really help much if the test will not continue. Link: https://lkml.kernel.org/r/20230412164254.328335-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Reviewed-by: Axel Rasmussen Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit c4277cb6c8e5dc60d425f3a148b3e2bf40d8d778 Author: Peter Xu Date: Wed Apr 12 12:42:47 2023 -0400 selftests/mm: uffd_[un]register() Add two helpers to register/unregister to an uffd. Use them to drop duplicate codes. This patch also drops assert_expected_ioctls_present() and get_expected_ioctls(). Reasons: - It'll need a lot of effort to pass test_type==HUGETLB into it from the upper, so it's the simplest way to get rid of another global var - The ioctls returned in UFFDIO_REGISTER is hardly useful at all, because any app can already detect kernel support on any ioctl via its corresponding UFFD_FEATURE_*. The check here is for sanity mostly but it's probably destined no user app will even use it. - It's not friendly to one future goal of uffd to run on old kernels, the problem is get_expected_ioctls() compiles against UFFD_API_RANGE_IOCTLS, which is a value that can change depending on where the test is compiled, rather than reflecting what the kernel underneath has. It means it'll report false negatives on old kernels so it's against our will. So let's make our lives easier. [peterx@redhat.com; tools/testing/selftests/mm/hugepage-mremap.c: add headers] Link: https://lkml.kernel.org/r/ZDxrvZh/cw357D8P@x1n Link: https://lkml.kernel.org/r/20230412164247.328293-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 686a8bb723497197022c73807cdd29eb5a1aeec8 Author: Peter Xu Date: Wed Apr 12 12:42:44 2023 -0400 selftests/mm: split uffd tests into uffd-stress and uffd-unit-tests In many ways it's weird and unwanted to keep all the tests in the same userfaultfd.c at least when still in the current way. For example, it doesn't make much sense to run the stress test for each method we can create an userfaultfd handle (either via syscall or /dev/ node). It's a waste of time running this twice for the whole stress as the stress paths are the same, only the open path is different. It's also just weird to need to manually specify different types of memory to run all unit tests for the userfaultfd interface. We should be able to just run a single program and that should go through all functional uffd tests without running the stress test at all. The stress test was more for torturing and finding race conditions. We don't want to wait for stress to finish just to regress test a functional test. When we start to pile up more things on top of the same file and same functions, things start to go a bit chaos and the code is just harder to maintain too with tons of global variables. This patch creates a new test uffd-unit-tests to keep userfaultfd unit tests in the future, currently empty. Meanwhile rename the old userfaultfd.c test to uffd-stress.c. Link: https://lkml.kernel.org/r/20230412164244.328270-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Mike Rapoport (IBM) Reviewed-by: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 33be4e892877eec7c8eb32988b95f5c42c87f0f0 Author: Peter Xu Date: Wed Apr 12 12:42:41 2023 -0400 selftests/mm: create uffd-common.[ch] Move common utility functions into uffd-common.[ch] files from the original userfaultfd.c. This prepares for a split of userfaultfd.c into two tests: one to only cover the old but powerful stress test, the other one covers all the functional tests. This movement is kind of a brute-force effort for now, with light touch-ups but nothing should really change. There's chances to optimize more, but let's leave that for later. Link: https://lkml.kernel.org/r/20230412164241.328259-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Mike Rapoport (IBM) Reviewed-by: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 618aeb5d6255a7c2db2ac9cb850e5e044dd916c5 Author: Peter Xu Date: Wed Apr 12 12:42:38 2023 -0400 selftests/mm: drop test_uffdio_zeropage_eexist The idea was trying to flip this var in the alarm handler from time to time to test -EEXIST of UFFDIO_ZEROPAGE, but firstly it's only used in the zeropage test so probably only used once, meanwhile we passed "retry==false" so it'll never got tested anyway. Drop both sides so we always test UFFDIO_ZEROPAGE retries if has_zeropage is set (!hugetlb). One more thing to do is doing UFFDIO_REGISTER for the alias buffer too, because otherwise the test won't even pass! We were just lucky that this test never really got ran at all. Link: https://lkml.kernel.org/r/20230412164238.328238-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Mike Kravetz Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Axel Rasmussen Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 4af9ff29816ac011af143c9d5cd16ab75429a600 Author: Peter Xu Date: Wed Apr 12 12:42:34 2023 -0400 selftests/mm: test UFFDIO_ZEROPAGE only when !hugetlb Make the check as simple as "test_type == TEST_HUGETLB" because that's the only mem that doesn't support ZEROPAGE. Link: https://lkml.kernel.org/r/20230412164234.328168-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Axel Rasmussen Cc: David Hildenbrand Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 366e93c46576e77f1ccfdeab31127f40537e7484 Author: Peter Xu Date: Wed Apr 12 12:42:31 2023 -0400 selftests/mm: reuse pagemap_get_entry() in vm_util.h Meanwhile drop pagemap_read_vaddr(). Link: https://lkml.kernel.org/r/20230412164231.328157-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Axel Rasmussen Reviewed-by: Mike Kravetz Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 9f74696bd23da71ab19b1825f813421904cd4169 Author: Peter Xu Date: Wed Apr 12 12:42:27 2023 -0400 selftests/mm: use PM_* macros in vm_utils.h We've got the macros in uffd-stress.c, move it over and use it in vm_util.h. Link: https://lkml.kernel.org/r/20230412164227.328145-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Axel Rasmussen Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit bd4d67e76f699688d15e6194f1505b8bdfee0dd7 Author: Peter Xu Date: Wed Apr 12 12:42:23 2023 -0400 selftests/mm: merge default_huge_page_size() into one There're already 3 same definitions of the three functions. Move it into vm_util.[ch]. Link: https://lkml.kernel.org/r/20230412164223.328134-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Axel Rasmussen Reviewed-by: Mike Kravetz Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 4b54f5a758b7ac521d4658cb0d18b132b87597c0 Author: Peter Xu Date: Wed Apr 12 12:42:20 2023 -0400 selftests/mm: link vm_util.c always We do have plenty of files that want to link against vm_util.c. Just make it simple by linking it always. Link: https://lkml.kernel.org/r/20230412164220.328123-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Axel Rasmussen Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit aef6fde75d8c6c1cad4a0e017a8d4cbee2143723 Author: Peter Xu Date: Wed Apr 12 12:42:18 2023 -0400 selftests/mm: use TEST_GEN_PROGS where proper TEST_GEN_PROGS and TEST_GEN_FILES are used randomly in the mm/Makefile to specify programs that need to build. Logically all these binaries should all fall into TEST_GEN_PROGS. Replace those TEST_GEN_FILES with TEST_GEN_PROGS, so that we can reference all the tests easily later. [peterx@redhat.com: tools/testing/selftests/mm/Makefile: don't wipe out TEST_GEN_PROGS] Link: https://lkml.kernel.org/r/ZDxrvZh/cw357D8P@x1n Link: https://lkml.kernel.org/r/20230412164218.328104-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Axel Rasmussen Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit af605d26a8f26e9e46fa82246dc1241efd3834a5 Author: Peter Xu Date: Wed Apr 12 12:41:20 2023 -0400 selftests/mm: merge util.h into vm_util.h There're two util headers under mm/ kselftest. Merge one with another. It turns out util.h is the easy one to move. When merging, drop PAGE_SIZE / PAGE_SHIFT because they're unnecessary wrappers to page_size() / page_shift(), meanwhile rename them to psize() and pshift() so as to not conflict with some existing definitions in some test files that includes vm_util.h. Link: https://lkml.kernel.org/r/20230412164120.327731-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Axel Rasmussen Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit c7c55fc4e39aed6a5a4d47f2201e53b1efb24ca6 Author: Peter Xu Date: Wed Apr 12 12:41:17 2023 -0400 selftests/mm: dump a summary in run_vmtests.sh Dump a summary after running whatever test specified. Useful for human runners to identify any kind of failures (besides exit code). Link: https://lkml.kernel.org/r/20230412164117.327720-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Axel Rasmussen Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit c14ef37871fcee9dbcaebb1bc73ac4da21547c13 Author: Peter Xu Date: Wed Apr 12 12:41:14 2023 -0400 selftests/mm: update .gitignore with two missing tests Patch series "selftests/mm: Split / Refactor userfault test", v2. This patchset splits userfaultfd.c into two tests: - uffd-stress: the "vanilla", old and powerful stress test - uffd-unit-tests: all the unit tests will be moved here This is on my todo list for a long time but I never did it for real. The uffd test is growing into a small and cute monster. I start to notice it's going harder to maintain such a test and make it useful. A few issues I found when looking at userfaultfd test: - We have a bunch of unit tests in userfaultfd.c, but they always need to be run only after a stress type. No way to not do it. - We can only run an unit test for one memory type only, if we want to do a quick smoke test to check regressions, there's no good way. The best to come currently is "bash ./run_vmtests.sh -t userfaultfd" thanks to the most recent changes to run_vmtests.sh on tagging. Still, that needs to run the stress tests always and hard to see what's wrong. - It's hard to add a new unit test to userfaultfd.c, we don't really know what's happening, not until we mostly read the whole file. - We did a bunch of useless tests, e.g. we run twice the whole suite of stress test just to verify both syscall and /dev/userfaultfd. They're all using userfaultfd_new() to create the handle, everything should really be the same underneath. One simple unit test should cover that! - We have tens of global variables in one file but shared with all the tests. Some of them are not suitable to be a global var from maintainance pov. It enforces every unit test to consider how these vars affects the stress test and vice versa, but that's logically not necessary. - Userfaultfd test is not friendly to old kernels. Mostly it only works on the latest kernel tree. It's preferrable to be run on all kernels and properly report what's missing. I'll stop here, I feel like I can still list some.. This patchset should resolve all issues above, and actually we can do even more on top. I stopped doing that until I found I already got 29 patches and 2000+ LOC changes. That's already a patchset terrible enough so we should move in small steps. After the whole set applied, "./run_vmtests.sh -t userfaultfd" looks like this: ===8<=== vm.nr_hugepages = 1024 ------------------------- running ./uffd-unit-tests ------------------------- Testing UFFDIO_API (with syscall)... done Testing UFFDIO_API (with /dev/userfaultfd)... done Testing register-ioctls on anon... done Testing register-ioctls on shmem... done Testing register-ioctls on shmem-private... done Testing register-ioctls on hugetlb... done Testing register-ioctls on hugetlb-private... done Testing zeropage on anon... done Testing zeropage on shmem... done Testing zeropage on shmem-private... done Testing zeropage on hugetlb... done Testing zeropage on hugetlb-private... done Testing pagemap on anon... done Testing wp-unpopulated on anon... done Testing minor on shmem... done Testing minor on hugetlb... done Testing minor-wp on shmem... done Testing minor-wp on hugetlb... done Testing minor-collapse on shmem... done Testing sigbus on anon... done Testing sigbus on shmem... done Testing sigbus on shmem-private... done Testing sigbus on hugetlb... done Testing sigbus on hugetlb-private... done Testing sigbus-wp on anon... done Testing sigbus-wp on shmem... done Testing sigbus-wp on shmem-private... done Testing sigbus-wp on hugetlb... done Testing sigbus-wp on hugetlb-private... done Testing events on anon... done Testing events on shmem... done Testing events on shmem-private... done Testing events on hugetlb... done Testing events on hugetlb-private... done Testing events-wp on anon... done Testing events-wp on shmem... done Testing events-wp on shmem-private... done Testing events-wp on hugetlb... done Testing events-wp on hugetlb-private... done Userfaults unit tests: pass=39, skip=0, fail=0 (total=39) [PASS] -------------------------------- running ./uffd-stress anon 20 16 -------------------------------- nr_pages: 5120, nr_pages_per_cpu: 640 bounces: 15, mode: rnd racing ver poll, userfaults: 345 missing (26+48+61+102+30+12+59+7) 1596 wp (120+139+317+346+215+67+306+86) [...] [PASS] ------------------------------------ running ./uffd-stress hugetlb 128 32 ------------------------------------ nr_pages: 64, nr_pages_per_cpu: 8 bounces: 31, mode: rnd racing ver poll, userfaults: 29 missing (6+6+6+5+4+2+0+0) 104 wp (20+19+22+18+7+12+5+1) [...] [PASS] -------------------------------------------- running ./uffd-stress hugetlb-private 128 32 -------------------------------------------- nr_pages: 64, nr_pages_per_cpu: 8 bounces: 31, mode: rnd racing ver poll, userfaults: 33 missing (12+9+7+0+5+0+0+0) 111 wp (24+25+14+14+11+17+5+1) [...] [PASS] --------------------------------- running ./uffd-stress shmem 20 16 --------------------------------- nr_pages: 5120, nr_pages_per_cpu: 640 bounces: 15, mode: rnd racing ver poll, userfaults: 247 missing (15+17+34+60+81+37+3+0) 2038 wp (180+114+276+400+381+318+165+204) [...] [PASS] ----------------------------------------- running ./uffd-stress shmem-private 20 16 ----------------------------------------- nr_pages: 5120, nr_pages_per_cpu: 640 bounces: 15, mode: rnd racing ver poll, userfaults: 235 missing (52+29+55+56+13+9+16+5) 2849 wp (218+406+461+531+328+284+430+191) [...] [PASS] SUMMARY: PASS=6 SKIP=0 FAIL=0 ===8<=== The output may be different if we miss some features (e.g., hugetlb not allocated, old kernel, less privilege of uffd handle), but they should show up with good reasons. E.g., I tried to run the unit test on my Fedora kernel and it gives me: ===8<=== UFFDIO_API (with syscall)... failed [reason: UFFDIO_API should fail with wrong api but didn't] UFFDIO_API (with /dev/userfaultfd)... skipped [reason: cannot open userfaultfd handle] zeropage on anon... done zeropage on shmem... done zeropage on shmem-private... done zeropage-hugetlb on hugetlb... done zeropage-hugetlb on hugetlb-private... done pagemap on anon... pagemap on anon... pagemap on anon... done wp-unpopulated on anon... skipped [reason: feature missing] minor on shmem... done minor on hugetlb... done minor-wp on shmem... skipped [reason: feature missing] minor-wp on hugetlb... skipped [reason: feature missing] minor-collapse on shmem... done sigbus on anon... skipped [reason: possible lack of priviledge] sigbus on shmem... skipped [reason: possible lack of priviledge] sigbus on shmem-private... skipped [reason: possible lack of priviledge] sigbus on hugetlb... skipped [reason: possible lack of priviledge] sigbus on hugetlb-private... skipped [reason: possible lack of priviledge] sigbus-wp on anon... skipped [reason: possible lack of priviledge] sigbus-wp on shmem... skipped [reason: possible lack of priviledge] sigbus-wp on shmem-private... skipped [reason: possible lack of priviledge] sigbus-wp on hugetlb... skipped [reason: possible lack of priviledge] sigbus-wp on hugetlb-private... skipped [reason: possible lack of priviledge] events on anon... skipped [reason: possible lack of priviledge] events on shmem... skipped [reason: possible lack of priviledge] events on shmem-private... skipped [reason: possible lack of priviledge] events on hugetlb... skipped [reason: possible lack of priviledge] events on hugetlb-private... skipped [reason: possible lack of priviledge] events-wp on anon... skipped [reason: possible lack of priviledge] events-wp on shmem... skipped [reason: possible lack of priviledge] events-wp on shmem-private... skipped [reason: possible lack of priviledge] events-wp on hugetlb... skipped [reason: possible lack of priviledge] events-wp on hugetlb-private... skipped [reason: possible lack of priviledge] Userfaults unit tests: pass=9, skip=24, fail=1 (total=34) ===8<=== Patch layout: - Revert "userfaultfd: don't fail on unrecognized features" Something I found when I got the UFFDIO_API test below. Axel, I still propose to revert it as a whole, but feel free to continue the discussion from the original patch thread. - selftests/mm: Update .gitignore with two missing tests - selftests/mm: Dump a summary in run_vmtests.sh - selftests/mm: Merge util.h into vm_util.h - selftests/mm: Use TEST_GEN_PROGS where proper - selftests/mm: Link vm_util.c always - selftests/mm: Merge default_huge_page_size() into one - selftests/mm: Use PM_* macros in vm_utils.h - selftests/mm: Reuse pagemap_get_entry() in vm_util.h - selftests/mm: Test UFFDIO_ZEROPAGE only when !hugetlb - selftests/mm: Drop test_uffdio_zeropage_eexist Until here, all cleanups here and there. I wanted to keep going, but I found that maybe it'll take a few more days to split the test. Hence I did a split starting from the next one, so we have a working thing first. - selftests/mm: Create uffd-common.[ch] - selftests/mm: Split uffd tests into uffd-stress and uffd-unit-tests This did the major brute force split of common codes into uffd-common.[ch]. That'll be the so far common base for stress and unit tests. Then a new unit test is created. - selftests/mm: uffd_[un]register() - selftests/mm: uffd_open_{dev|sys}() - selftests/mm: UFFDIO_API test This patch hides here to start writting the 1st unit test with UFFDIO_API, also detection of userfaultfd privileges. - selftests/mm: Drop global mem_fd in uffd tests - selftests/mm: Drop global hpage_size in uffd tests - selftests/mm: Rename uffd_stats to uffd_args - selftests/mm: Let uffd_handle_page_fault() takes wp parameter - selftests/mm: Allow allocate_area() to fail properly Some further cleanup that I noticed otherwise hard to move the tests. - selftests/mm: Add framework for uffd-unit-test The major patch provides the framework for most of the rest unit tests. - selftests/mm: Move uffd pagemap test to unit test - selftests/mm: Move uffd minor test to unit test - selftests/mm: Move uffd sig/events tests into uffd unit tests - selftests/mm: Move zeropage test into uffd unit tests Move unit tests and suite them into the new file. - selftests/mm: Workaround no way to detect uffd-minor + wp - selftests/mm: Allow uffd test to skip properly with no privilege - selftests/mm: Drop sys/dev test in uffd-stress test - selftests/mm: Add shmem-private test to uffd-stress A bunch of changes to do better on error reportings, and add shmem-private to the stress test which was long missing. - selftests/mm: Add uffdio register ioctls test One more patch to test uffdio_register.ioctls. This patch (of 30): Update .gitignore with two missing tests. Link: https://lkml.kernel.org/r/20230412163922.327282-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20230412164114.327709-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport (IBM) Cc: Axel Rasmussen Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 54c4fe08f65e4c39c3d62f5d181f958e9c6c97f7 Author: Haifeng Xu Date: Tue Apr 11 06:17:57 2023 +0000 mm/vmscan: simplify shrink_node() The difference between sc->nr_reclaimed and nr_reclaimed is computed three times. Introduce a new variable to record the value, so it only needs to be computed once. Link: https://lkml.kernel.org/r/20230411061757.12041-1-haifeng.xu@shopee.com Signed-off-by: Haifeng Xu Reviewed-by: David Hildenbrand Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 09a607c9cd23d9521e7be3ab5eb94f217d7a37f5 Author: Pankaj Raghav Date: Tue Apr 11 14:29:20 2023 +0200 mpage: use folios in bio end_io handler Use folios in the bio end_io handler. This conversion does the appropriate handling on the folios in the respective end_io callback and removes the call to page_endio(), which is soon to be removed. Link: https://lkml.kernel.org/r/20230411122920.30134-4-p.raghav@samsung.com Signed-off-by: Pankaj Raghav Reviewed-by: Christoph Hellwig Cc: Alexander Viro Cc: Christian Brauner Cc: Jens Axboe Cc: Luis Chamberlain Cc: Martin Brandenburg Cc: Matthew Wilcox (Oracle) Cc: Mike Marshall Cc: Minchan Kim Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton commit f0d6ca46d68670d04a43116fe07309643bac596e Author: Pankaj Raghav Date: Tue Apr 11 14:29:19 2023 +0200 mpage: split submit_bio and bio end_io handler for reads and writes Split the submit_bio() and bio end_io handler for reads and writes similar to other aops. This is a prep patch before we convert end_io handlers to use folios. Link: https://lkml.kernel.org/r/20230411122920.30134-3-p.raghav@samsung.com Signed-off-by: Pankaj Raghav Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Cc: Alexander Viro Cc: Christian Brauner Cc: Jens Axboe Cc: Luis Chamberlain Cc: Martin Brandenburg Cc: Matthew Wilcox (Oracle) Cc: Mike Marshall Cc: Minchan Kim Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton commit cd01049d9ca3788a9d1537b64aec26edc96ad0bd Author: Pankaj Raghav Date: Tue Apr 11 14:29:18 2023 +0200 orangefs: use folios in orangefs_readahead Patch series "remove page_endio()", v3. It was decided to remove the page_endio() as per the previous RFC discussion[1] of this series and move that functionality into the caller itself. One of the side benefit of doing that is the callers have been modified to directly work on folios as page_endio() already worked on folios. As Christoph is doing ZRAM cleanups[4] which will get rid of page_endio() function usage, I removed the final patch that removes page_endio()[5]. I will send it separately after rc-1 once the zram cleanups are merged. mpage changes were tested with a simple boot testing and running a fio workload on ext2 filesystem. orangefs was tested by Mike Marshall (No code changes since he tested). This patch (of 3): Convert orangefs_readahead() from using struct page to struct folio. This conversion removes the call to page_endio() which is soon to be removed, and simplifies the final page handling. The page error flags is not required to be set in the error case as orangefs doesn't depend on them. Link: https://lkml.kernel.org/r/20230411122920.30134-1-p.raghav@samsung.com Link: https://lkml.kernel.org/r/20230411122920.30134-2-p.raghav@samsung.com Link: https://lore.kernel.org/linux-mm/ZBHcl8Pz2ULb4RGD@infradead.org/ [1] Link: https://lore.kernel.org/linux-mm/20230322135013.197076-1-p.raghav@samsung.com/ [2] Link: https://lore.kernel.org/linux-mm/8adb0770-6124-e11f-2551-6582db27ed32@samsung.com/ [3] Link: https://lore.kernel.org/linux-block/20230404150536.2142108-1-hch@lst.de/T/#t [4] Link: https://lore.kernel.org/lkml/20230403132221.94921-6-p.raghav@samsung.com/ [5] Signed-off-by: Pankaj Raghav Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Tested-by: Mike Marshall Cc: Alexander Viro Cc: Christian Brauner Cc: Jens Axboe Cc: Luis Chamberlain Cc: Martin Brandenburg Cc: Minchan Kim Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton commit 1462c52e9f2b99e72022ed8979bfc969894bb3da Author: David Hildenbrand Date: Tue Apr 11 16:25:12 2023 +0200 mm/huge_memory: conditionally call maybe_mkwrite() and drop pte_wrprotect() in __split_huge_pmd_locked() No need to call maybe_mkwrite() to then wrprotect if the source PMD was not writable. It's worth nothing that this now allows for PTEs to be writable even if the source PMD was not writable: if vma->vm_page_prot includes write permissions. As documented in commit 931298e103c2 ("mm/userfaultfd: rely on vma->vm_page_prot in uffd_wp_range()"), any mechanism that intends to have pages wrprotected (COW, writenotify, mprotect, uffd-wp, softdirty, ...) has to properly adjust vma->vm_page_prot upfront, to not include write permissions. If vma->vm_page_prot includes write permissions, the PTE/PMD can be writable as default. This now mimics the handling in mm/migrate.c:remove_migration_pte() and in mm/huge_memory.c:remove_migration_pmd(), which has been in place for a long time (except that 96a9c287e25d ("mm/migrate: fix wrongly apply write bit after mkdirty on sparc64") temporarily changed it). Link: https://lkml.kernel.org/r/20230411142512.438404-7-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: David S. Miller Cc: Hugh Dickins Cc: Peter Xu Cc: Sam Ravnborg Cc: Shuah Khan Cc: Yu Zhao Signed-off-by: Andrew Morton commit 5436d6556937de6236ffa1829550d13702569dab Author: David Hildenbrand Date: Tue Apr 11 16:25:11 2023 +0200 mm/huge_memory: revert "Partly revert "mm/thp: carry over dirty bit when thp splits on pmd"" This reverts commit 624a2c94f5b7 ("Partly revert "mm/thp: carry over dirty bit when thp splits on pmd"") and the fixup in commit e833bc503405 ("mm/thp: re-apply mkdirty for small pages after split"). Now that sparc64 mkdirty handling is fixed and no longer sets a PTE/PMD writable that shouldn't be writable, let's revert the temporary fix and remove the stale comment. The mkdirty mm selftest still passes with this change on sparc64. Note that loongarch handling was fixed in commit bf2f34a506e6 ("LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty()") Link: https://lkml.kernel.org/r/20230411142512.438404-6-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: David S. Miller Cc: Hugh Dickins Cc: Peter Xu Cc: Sam Ravnborg Cc: Shuah Khan Cc: Yu Zhao Signed-off-by: Andrew Morton commit 3c811f7883c4ee5a34ba4354381bde062888dd31 Author: David Hildenbrand Date: Tue Apr 11 16:25:10 2023 +0200 mm/migrate: revert "mm/migrate: fix wrongly apply write bit after mkdirty on sparc64" This reverts commit 96a9c287e25d ("mm/migrate: fix wrongly apply write bit after mkdirty on sparc64"). Now that sparc64 mkdirty handling is fixed and no longer sets a PTE/PMD writable that shouldn't be writable, let's revert the temporary fix. The mkdirty mm selftest still passes with this change on sparc64. Note that loongarch handling was fixed in commit bf2f34a506e6 ("LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty()"). Link: https://lkml.kernel.org/r/20230411142512.438404-5-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: David S. Miller Cc: Hugh Dickins Cc: Peter Xu Cc: Sam Ravnborg Cc: Shuah Khan Cc: Yu Zhao Signed-off-by: Andrew Morton commit fa2e71a6fcee495e16176bd606e7121332627a16 Author: David Hildenbrand Date: Tue Apr 11 16:25:09 2023 +0200 sparc/mm: don't unconditionally set HW writable bit when setting PTE dirty on 64bit On sparc64, there is no HW modified bit, therefore, SW tracks via a SW bit if the PTE is dirty via pte_mkdirty(). However, pte_mkdirty() currently also unconditionally sets the HW writable bit, which is wrong. pte_mkdirty() is not supposed to make a PTE actually writable, unless the SW writable bit -- pte_write() -- indicates that the PTE is not write-protected. Fortunately, sparc64 also defines a SW writable bit. For example, this already turned into a problem in the context of THP splitting as documented in commit 624a2c94f5b7 ("Partly revert "mm/thp: carry over dirty bit when thp splits on pmd""), and for page migration, as documented in commit 96a9c287e25d ("mm/migrate: fix wrongly apply write bit after mkdirty on sparc64"). Also, we might want to use the dirty PTE bit in the context of KSM with shared zeropage [1], whereby setting the page writable would be problematic. But more general, any code that might end up setting a PTE/PMD dirty inside a VM without write permissions is possibly broken, Before this commit (sun4u in QEMU): root@debian:~/linux/tools/testing/selftests/mm# ./mkdirty # [INFO] detected THP size: 8192 KiB TAP version 13 1..6 # [INFO] PTRACE write access not ok 1 SIGSEGV generated, page not modified # [INFO] PTRACE write access to THP not ok 2 SIGSEGV generated, page not modified # [INFO] Page migration ok 3 SIGSEGV generated, page not modified # [INFO] Page migration of THP ok 4 SIGSEGV generated, page not modified # [INFO] PTE-mapping a THP ok 5 SIGSEGV generated, page not modified # [INFO] UFFDIO_COPY not ok 6 SIGSEGV generated, page not modified Bail out! 3 out of 6 tests failed # Totals: pass:3 fail:3 xfail:0 xpass:0 skip:0 error:0 Test #3,#4,#5 pass ever since we added some MM workarounds, the underlying issue remains. Let's fix the remaining issues and prepare for reverting the workarounds by setting the HW writable bit only if both, the SW dirty bit and the SW writable bit are set. We have to move pte_dirty() and pte_write() up. The code patching mechanism and handling constants > 22bit is a bit special on sparc64. The ASM logic in pte_mkdirty() and pte_mkwrite() match the logic in pte_mkold() to create the mask depending on the machine type. The ASM logic in __pte_mkhwwrite() matches the logic in pte_present(), just using an "or" instead of an "and" instruction. With this commit (sun4u in QEMU): root@debian:~/linux/tools/testing/selftests/mm# ./mkdirty # [INFO] detected THP size: 8192 KiB TAP version 13 1..6 # [INFO] PTRACE write access ok 1 SIGSEGV generated, page not modified # [INFO] PTRACE write access to THP ok 2 SIGSEGV generated, page not modified # [INFO] Page migration ok 3 SIGSEGV generated, page not modified # [INFO] Page migration of THP ok 4 SIGSEGV generated, page not modified # [INFO] PTE-mapping a THP ok 5 SIGSEGV generated, page not modified # [INFO] UFFDIO_COPY ok 6 SIGSEGV generated, page not modified # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 This handling seems to have been in place forever. [1] https://lkml.kernel.org/r/533a7c3d-3a48-b16b-b421-6e8386e0b142@redhat.com Link: https://lkml.kernel.org/r/20230411142512.438404-4-david@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: David S. Miller Cc: Hugh Dickins Cc: Peter Xu Cc: Sam Ravnborg Cc: Shuah Khan Cc: Yu Zhao Signed-off-by: Andrew Morton commit 9eac40fc0cc7b5bbc405af3b94cbe8aeb680ab26 Author: David Hildenbrand Date: Tue Apr 11 16:25:08 2023 +0200 selftests/mm: mkdirty: test behavior of (pte|pmd)_mkdirty on VMAs without write permissions Let's add some tests that trigger (pte|pmd)_mkdirty on VMAs without write permissions. If an architecture implementation is wrong, we might accidentally set the PTE/PMD writable and allow for write access in a VMA without write permissions. The tests include reproducers for the two issues recently discovered and worked-around in core-MM for now: (1) commit 624a2c94f5b7 ("Partly revert "mm/thp: carry over dirty bit when thp splits on pmd"") (2) commit 96a9c287e25d ("mm/migrate: fix wrongly apply write bit after mkdirty on sparc64") In addition, some other tests that reveal further issues. All tests pass under x86_64: ./mkdirty # [INFO] detected THP size: 2048 KiB TAP version 13 1..6 # [INFO] PTRACE write access ok 1 SIGSEGV generated, page not modified # [INFO] PTRACE write access to THP ok 2 SIGSEGV generated, page not modified # [INFO] Page migration ok 3 SIGSEGV generated, page not modified # [INFO] Page migration of THP ok 4 SIGSEGV generated, page not modified # [INFO] PTE-mapping a THP ok 5 SIGSEGV generated, page not modified # [INFO] UFFDIO_COPY ok 6 SIGSEGV generated, page not modified # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 But some fail on sparc64: ./mkdirty # [INFO] detected THP size: 8192 KiB TAP version 13 1..6 # [INFO] PTRACE write access not ok 1 SIGSEGV generated, page not modified # [INFO] PTRACE write access to THP not ok 2 SIGSEGV generated, page not modified # [INFO] Page migration ok 3 SIGSEGV generated, page not modified # [INFO] Page migration of THP ok 4 SIGSEGV generated, page not modified # [INFO] PTE-mapping a THP ok 5 SIGSEGV generated, page not modified # [INFO] UFFDIO_COPY not ok 6 SIGSEGV generated, page not modified Bail out! 3 out of 6 tests failed # Totals: pass:3 fail:3 xfail:0 xpass:0 skip:0 error:0 Reverting both above commits makes all tests fail on sparc64: ./mkdirty # [INFO] detected THP size: 8192 KiB TAP version 13 1..6 # [INFO] PTRACE write access not ok 1 SIGSEGV generated, page not modified # [INFO] PTRACE write access to THP not ok 2 SIGSEGV generated, page not modified # [INFO] Page migration not ok 3 SIGSEGV generated, page not modified # [INFO] Page migration of THP not ok 4 SIGSEGV generated, page not modified # [INFO] PTE-mapping a THP not ok 5 SIGSEGV generated, page not modified # [INFO] UFFDIO_COPY not ok 6 SIGSEGV generated, page not modified Bail out! 6 out of 6 tests failed # Totals: pass:0 fail:6 xfail:0 xpass:0 skip:0 error:0 The tests are useful to detect other problematic archs, to verify new arch fixes, and to stop such issues from reappearing in the future. For now, we don't add any hugetlb tests. Link: https://lkml.kernel.org/r/20230411142512.438404-3-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: David S. Miller Cc: Hugh Dickins Cc: Peter Xu Cc: Sam Ravnborg Cc: Shuah Khan Cc: Yu Zhao Signed-off-by: Andrew Morton commit d6e61afb40e2208d90470f4b2012c4c8092863b9 Author: David Hildenbrand Date: Tue Apr 11 16:25:07 2023 +0200 selftests/mm: reuse read_pmd_pagesize() in COW selftest Patch series "mm: (pte|pmd)_mkdirty() should not unconditionally allow for write access". This is the follow-up on [1], adding selftests (testing for known issues we added workarounds for and other issues that haven't been fixed yet), fixing sparc64, reverting the workarounds, and perform one cleanup. The patch from [1] was modified slightly (updated/extended patch description, dropped one unnecessary NOP instruction from the ASM in __pte_mkhwwrite()). Retested on x86_64 and sparc64 (sun4u in QEMU). I scanned most architectures to make sure their (pte|pmd)_mkdirty() handling is correct. To be sure, we can run the selftests and find out if other architectures are still affectes (loongarch was fixed recently as well). Based on master for now. I don't expect surprises regarding mm-tress, but I can rebase if there are any problems. This patch (of 6): The COW selftest can deal with THP not being configured. So move error handling of read_pmd_pagesize() into the callers such that we can reuse it in the COW selftest. Link: https://lkml.kernel.org/r/20230411142512.438404-1-david@redhat.com Link: https://lkml.kernel.org/r/20221212130213.136267-1-david@redhat.com [1] Link: https://lkml.kernel.org/r/20230411142512.438404-2-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: David S. Miller Cc: Hugh Dickins Cc: Peter Xu Cc: Sam Ravnborg Cc: Shuah Khan Cc: Yu Zhao Signed-off-by: Andrew Morton commit 1e9460d132cc728941621f0f7a7b03a7d1c469af Author: Christoph Hellwig Date: Tue Apr 11 19:14:59 2023 +0200 zram: return errors from read_from_bdev_sync Propagate read errors to the caller instead of dropping them on the floor, and stop returning the somewhat dangerous 1 on success from read_from_bdev*. Link: https://lkml.kernel.org/r/20230411171459.567614-18-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit 4e3c87b9421df497d849ae61aab9762de7f66afb Author: Christoph Hellwig Date: Tue Apr 11 19:14:58 2023 +0200 zram: fix synchronous reads Currently nothing waits for the synchronous reads before accessing the data. Switch them to an on-stack bio and submit_bio_wait to make sure the I/O has actually completed when the work item has been flushed. This also removes the call to page_endio that would unlock a page that has never been locked. Drop the partial_io/sync flag, as chaining only makes sense for the asynchronous reads of the entire page. Link: https://lkml.kernel.org/r/20230411171459.567614-17-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit 0cd97a0372f21a66d1591114d0a12391e8d977d7 Author: Christoph Hellwig Date: Tue Apr 11 19:14:57 2023 +0200 zram: don't return errors from read_from_bdev_async bio_alloc will never return a NULL bio when it is allowed to sleep, and adding a single page to bio with a single vector also can't fail, so switch to the asserting __bio_add_page variant and drop the error returns. Link: https://lkml.kernel.org/r/20230411171459.567614-16-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit fd45af53e220b2fe13a5e8db88c5e92bc3296754 Author: Christoph Hellwig Date: Tue Apr 11 19:14:56 2023 +0200 zram: pass a page to read_from_bdev read_from_bdev always reads a whole page, so pass a page to it instead of the bvec and remove the now pointless zram_bvec_read_from_bdev wrapper. Link: https://lkml.kernel.org/r/20230411171459.567614-15-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit a0b81ae7a4ff8a779e9f16152563d614cb91f13c Author: Christoph Hellwig Date: Tue Apr 11 19:14:55 2023 +0200 zram: refactor zram_bdev_write Split the read/modify/write case into a separate helper. Link: https://lkml.kernel.org/r/20230411171459.567614-14-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Cc: Jens Axboe Signed-off-by: Andrew Morton commit 6aa4b839e7a481cc20b243168dc3333fc3d87eb0 Author: Christoph Hellwig Date: Tue Apr 11 19:14:54 2023 +0200 zram: don't pass a bvec to __zram_bvec_write __zram_bvec_write only extracts the page from __zram_bvec_write and always expects a full page of input. Pass the page directly instead of the bvec and rename the function to zram_write_page. Link: https://lkml.kernel.org/r/20230411171459.567614-13-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit 889ae9169b45f0fc3fc05f93c3c6fa8a851eab67 Author: Christoph Hellwig Date: Tue Apr 11 19:14:53 2023 +0200 zram: refactor zram_bdev_read Split the partial read into a separate helper. Link: https://lkml.kernel.org/r/20230411171459.567614-12-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit 79c744eeaa8eaa2d8fbb4f2c1edf292df7163c8a Author: Christoph Hellwig Date: Tue Apr 11 19:14:52 2023 +0200 zram: directly call zram_read_page in writeback_store writeback_store always reads a full page, so just call zram_read_page directly and bypass the boune buffer handling. Link: https://lkml.kernel.org/r/20230411171459.567614-11-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit ffb0a9e66562083cc0fb0a93d2de85cecd23a0e8 Author: Christoph Hellwig Date: Tue Apr 11 19:14:51 2023 +0200 zram: rename __zram_bvec_read to zram_read_page __zram_bvec_read doesn't get passed a bvec, but always read a whole page. Rename it to make the usage more clear. Link: https://lkml.kernel.org/r/20230411171459.567614-10-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit f575a5add8a9a3ca593e58e218f2113e5bd3e50e Author: Christoph Hellwig Date: Tue Apr 11 19:14:50 2023 +0200 zram: don't use highmem for the bounce buffer in zram_bvec_{read,write} There is no point in allocation a highmem page when we instantly need to copy from it. Link: https://lkml.kernel.org/r/20230411171459.567614-9-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit 82ca875d2549f6843d0d16e897c9e1e0a13c8a74 Author: Christoph Hellwig Date: Tue Apr 11 19:14:49 2023 +0200 zram: refactor highlevel read and write handling Instead of having an outer loop in __zram_make_request and then branch out for reads vs writes for each loop iteration in zram_bvec_rw, split the main handler into separat zram_bio_read and zram_bio_write handlers that also include the functionality formerly in zram_bvec_rw. Link: https://lkml.kernel.org/r/20230411171459.567614-8-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Cc: Jens Axboe Signed-off-by: Andrew Morton commit 57de7bd830dae90301329748d60e196fab4c4125 Author: Christoph Hellwig Date: Tue Apr 11 19:14:48 2023 +0200 zram: return early on error in zram_bvec_rw When the low-level access fails, don't clear the idle flag or clear the caches, and just return. Link: https://lkml.kernel.org/r/20230411171459.567614-7-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Cc: Jens Axboe Signed-off-by: Andrew Morton commit d6eea0097e26769fb58c2773214c3bda85d1678a Author: Christoph Hellwig Date: Tue Apr 11 19:14:47 2023 +0200 zram: move discard handling to zram_submit_bio Switch on the bio operation in zram_submit_bio and only call into __zram_make_request for read and write operations. Link: https://lkml.kernel.org/r/20230411171459.567614-6-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit af8b04c63708fa730c0257084fab91fb2a9cecc4 Author: Christoph Hellwig Date: Tue Apr 11 19:14:46 2023 +0200 zram: simplify bvec iteration in __zram_make_request bio_for_each_segment synthetize bvecs that never cross page boundaries, so don't duplicate that work in an inner loop. Link: https://lkml.kernel.org/r/20230411171459.567614-5-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit 0120dd6e4e202e19a0e011e486fb2da40a5ea279 Author: Christoph Hellwig Date: Tue Apr 11 19:14:45 2023 +0200 zram: make zram_bio_discard more self-contained Derive the index and offset variables inside the function, and complete the bio directly in preparation for cleaning up the I/O path. Link: https://lkml.kernel.org/r/20230411171459.567614-4-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit 9fe95babc7420722d39a1ded379027a1e1825d3a Author: Christoph Hellwig Date: Tue Apr 11 19:14:44 2023 +0200 zram: remove valid_io_request All bios hande to drivers from the block layer are checked against the device size and for logical block alignment already (and have been since long before zram was merged), so don't duplicate those checks. Link: https://lkml.kernel.org/r/20230411171459.567614-3-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Jens Axboe Signed-off-by: Andrew Morton commit a70aae12502b130b0c30dda44dff09e575c1aaeb Author: Christoph Hellwig Date: Tue Apr 11 19:14:43 2023 +0200 zram: always compile read_from_bdev_sync Patch series "zram I/O path cleanups and fixups", v3. This series cleans up the zram I/O path, and fixes the handling of synchronous I/O to the underlying device in the writeback_store function or for > 4K PAGE_SIZE systems. The fixes are at the end, as I could not fully reason about them being safe before untangling the callchain. This patch (of 17): read_from_bdev_sync is currently only compiled for non-4k PAGE_SIZE, which means it won't be built with the most common configurations. Replace the ifdef with a check for the PAGE_SIZE in an if instead. The check uses an extra symbol and IS_ENABLED to allow the compiler to eliminate the dead code, leading to the same generated code size: text data bss dec hex filename 16709 1428 12 18149 46e5 drivers/block/zram/zram_drv.o.old 16709 1428 12 18149 46e5 drivers/block/zram/zram_drv.o.new Link: https://lkml.kernel.org/r/20230411171459.567614-1-hch@lst.de Link: https://lkml.kernel.org/r/20230411171459.567614-2-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit 3b7939c8e5345fb84309f2605a4b6f7ac8dd7fce Author: Peng Zhang Date: Tue Apr 11 12:10:05 2023 +0800 maple_tree: add a test case to check maple_alloc Add a test case to check whether the number of maple_alloc structures is actually equal to mas->alloc->total. Link: https://lkml.kernel.org/r/20230411041005.26205-2-zhangpeng.00@bytedance.com Signed-off-by: Peng Zhang Cc: Liam R. Howlett Signed-off-by: Andrew Morton commit f6365881bf797c734bf4cf1353bfa59ffd444f8f Author: Tom Rix Date: Sat Apr 8 10:16:09 2023 -0400 mm: backing-dev: set variables dev_attr_min,max_bytes storage-class-specifier to static smatch reports mm/backing-dev.c:266:1: warning: symbol 'dev_attr_min_bytes' was not declared. Should it be static? mm/backing-dev.c:294:1: warning: symbol 'dev_attr_max_bytes' was not declared. Should it be static? These variables are only used in one file so should be static. Link: https://lkml.kernel.org/r/20230408141609.2703647-1-trix@redhat.com Signed-off-by: Tom Rix Reviewed-by: Christoph Hellwig Signed-off-by: Andrew Morton commit fb20e99a74f8f08c53061e0186d0c26d546dc843 Author: Peng Zhang Date: Tue Apr 11 10:35:13 2023 +0800 maple_tree: use correct variable type in sizeof The type of variable pointed to by pivs is unsigned long, but the type used in sizeof is a pointer type. Change it to unsigned long. This change has no runtime effect, as sizeof(ul) == sizeof(ul *). Link: https://lkml.kernel.org/r/20230411023513.15227-1-zhangpeng.00@bytedance.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang Reported-by: David Binderman Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit d7be6d7eee1bbf98671d7a2c95654322241e2ae4 Author: ZhangPeng Date: Mon Apr 10 21:39:32 2023 +0800 userfaultfd: convert mfill_atomic() to use a folio Convert mfill_atomic_pte_copy(), shmem_mfill_atomic_pte() and mfill_atomic_pte() to take in a folio pointer. Convert mfill_atomic() to use a folio. Convert page_kaddr to kaddr in mfill_atomic(). Link: https://lkml.kernel.org/r/20230410133932.32288-7-zhangpeng362@huawei.com Signed-off-by: ZhangPeng Reviewed-by: Mike Kravetz Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Muchun Song Cc: Nanyong Sun Cc: Sidhartha Kumar Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit c0e8150e144b62ae467520d0b51c4707c09e897b Author: ZhangPeng Date: Mon Apr 10 21:39:31 2023 +0800 mm: convert copy_user_huge_page() to copy_user_large_folio() Replace copy_user_huge_page() with copy_user_large_folio(). copy_user_large_folio() does the same as copy_user_huge_page(), but takes in folios instead of pages. Remove pages_per_huge_page from copy_user_large_folio(), because we can get that from folio_nr_pages(dst). Convert copy_user_gigantic_page() to take in folios. Link: https://lkml.kernel.org/r/20230410133932.32288-6-zhangpeng362@huawei.com Signed-off-by: ZhangPeng Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Cc: Nanyong Sun Cc: Sidhartha Kumar Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 0169fd518a8934d8d723659752b07589ecc9f692 Author: ZhangPeng Date: Mon Apr 10 21:39:30 2023 +0800 userfaultfd: convert mfill_atomic_hugetlb() to use a folio Convert hugetlb_mfill_atomic_pte() to take in a folio pointer instead of a page pointer. Convert mfill_atomic_hugetlb() to use a folio. Link: https://lkml.kernel.org/r/20230410133932.32288-5-zhangpeng362@huawei.com Signed-off-by: ZhangPeng Reviewed-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Muchun Song Cc: Nanyong Sun Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit e87340ca5c9cecc8a11daf1a2dcabf23f06a4e10 Author: ZhangPeng Date: Mon Apr 10 21:39:29 2023 +0800 userfaultfd: convert copy_huge_page_from_user() to copy_folio_from_user() Replace copy_huge_page_from_user() with copy_folio_from_user(). copy_folio_from_user() does the same as copy_huge_page_from_user(), but takes in a folio instead of a page. Convert page_kaddr to kaddr in copy_folio_from_user() to do indenting cleanup. Link: https://lkml.kernel.org/r/20230410133932.32288-4-zhangpeng362@huawei.com Signed-off-by: ZhangPeng Reviewed-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Muchun Song Cc: Nanyong Sun Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 0d508c1f0e2c7cec76c141e9d2ebc3020d9e4be4 Author: ZhangPeng Date: Mon Apr 10 21:39:28 2023 +0800 userfaultfd: use kmap_local_page() in copy_huge_page_from_user() kmap() and kmap_atomic() are being deprecated in favor of kmap_local_page() which is appropriate for any thread local context.[1] Let's replace the kmap() and kmap_atomic() with kmap_local_page() in copy_huge_page_from_user(). When allow_pagefault is false, disable page faults to prevent potential deadlock.[2] [1] https://lore.kernel.org/all/20220813220034.806698-1-ira.weiny@intel.com/ [2] https://lkml.kernel.org/r/20221025220136.2366143-1-ira.weiny@intel.com Link: https://lkml.kernel.org/r/20230410133932.32288-3-zhangpeng362@huawei.com Signed-off-by: ZhangPeng Reviewed-by: Mike Kravetz Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Muchun Song Cc: Nanyong Sun Cc: Sidhartha Kumar Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 07e6d4095c75bcf0bf511b36eecaceb3fbb91ad9 Author: ZhangPeng Date: Mon Apr 10 21:39:27 2023 +0800 userfaultfd: convert mfill_atomic_pte_copy() to use a folio Patch series "userfaultfd: convert userfaultfd functions to use folios", v6. This patch series converts several userfaultfd functions to use folios. This patch (of 6): Call vma_alloc_folio() directly instead of alloc_page_vma() and convert page_kaddr to kaddr in mfill_atomic_pte_copy(). Removes several calls to compound_head(). Link: https://lkml.kernel.org/r/20230410133932.32288-1-zhangpeng362@huawei.com Link: https://lkml.kernel.org/r/20230410133932.32288-2-zhangpeng362@huawei.com Signed-off-by: ZhangPeng Reviewed-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Muchun Song Cc: Nanyong Sun Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit b4aca54792e76556bb9f8661bab07b4bf2eb4e5f Author: Steven Price Date: Wed Apr 5 11:38:19 2023 +0100 smaps: fix defined but not used smaps_shmem_walk_ops When !CONFIG_SHMEM smaps_shmem_walk_ops is defined but not used, triggering a compiler warning. To avoid the warning remove the #ifdef around the usage. This has no effect because shmem_mapping() is a stub returning false when !CONFIG_SHMEM so the code will be compiled out, however we now need to also provide a stub for shmem_swap_usage(). Link: https://lkml.kernel.org/r/20230405103819.151246-1-steven.price@arm.com Fixes: 7b86ac3371b7 ("pagewalk: separate function pointers from iterator data") Signed-off-by: Steven Price Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304031749.UiyJpxzF-lkp@intel.com/ Reviewed-by: Jason Gunthorpe Cc: Christoph Hellwig Cc: Alexey Dobriyan Cc: Thomas Hellström Signed-off-by: Andrew Morton commit 8666925c498674426de44ecba79fd8bf42d3cda3 Author: Vlastimil Babka Date: Wed Apr 5 16:28:40 2023 +0200 mm, page_alloc: use check_pages_enabled static key to check tail pages Commit 700d2e9a36b9 ("mm, page_alloc: reduce page alloc/free sanity checks") has introduced a new static key check_pages_enabled to control when struct pages are sanity checked during allocation and freeing. Mel Gorman suggested that free_tail_pages_check() could use this static key as well, instead of relying on CONFIG_DEBUG_VM. That makes sense, so do that. Also rename the function to free_tail_page_prepare() because it works on a single tail page and has a struct page preparation component as well as the optional checking component. Also remove some unnecessary unlikely() within static_branch_unlikely() statements that Mel pointed out for commit 700d2e9a36b9. Link: https://lkml.kernel.org/r/20230405142840.11068-1-vbabka@suse.cz Signed-off-by: Vlastimil Babka Suggested-by: Mel Gorman Acked-by: Mel Gorman Cc: Alexander Halbuer Cc: Kees Cook Signed-off-by: Andrew Morton commit 27da93d8e6d5633ac065c9316afc0f0240303c0a Author: David Hildenbrand Date: Wed Apr 5 18:02:36 2023 +0200 mm/userfaultfd: don't consider uffd-wp bit of writable migration entries If we end up with a writable migration entry that has the uffd-wp bit set, we already messed up: the source PTE/PMD was writable, which means we could have modified the page without notifying uffd first. Setting the uffd-wp bit always implies converting migration entries to !writable migration entries. Commit 8f34f1eac382 ("mm/userfaultfd: fix uffd-wp special cases for fork()") documents that "3. Forget to carry over uffd-wp bit for a write migration huge pmd entry", but it doesn't really say why that should be relevant. So let's remove that code to avoid hiding an eventual underlying issue (in the future, we might want to warn when creating writable migration entries that have the uffd-wp bit set -- or even better when turning a PTE writable that still has the uffd-wp bit set). This now matches the handling for hugetlb migration entries in hugetlb_change_protection(). In copy_huge_pmd()/copy_nonpresent_pte()/copy_hugetlb_page_range(), we still transfer the uffd-bit also for writable migration entries, but simply because we have unified handling for "writable" and "readable-exclusive" migration entries, and we care about transferring the uffd-wp bit for the latter. Link: https://lkml.kernel.org/r/20230405160236.587705-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Peter Xu Cc: Muhammad Usama Anjum Signed-off-by: Andrew Morton commit 2bd7f621130b47cab8bed82234cac1f9f105efb7 Author: Qi Zheng Date: Thu Apr 6 00:18:54 2023 +0800 mm: mlock: use folios_put() in mlock_folio_batch() Since we have updated mlock to use folios, it's better to call folios_put() instead of calling release_pages() directly. Link: https://lkml.kernel.org/r/20230405161854.6931-2-zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: Mel Gorman Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ddc65971bb677aa9f6a4c21f76d3133e106f88eb Author: Josh Triplett Date: Tue Apr 4 21:31:48 2023 +0900 prctl: add PR_GET_AUXV to copy auxv to userspace If a library wants to get information from auxv (for instance, AT_HWCAP/AT_HWCAP2), it has a few options, none of them perfectly reliable or ideal: - Be main or the pre-main startup code, and grub through the stack above main. Doesn't work for a library. - Call libc getauxval. Not ideal for libraries that are trying to be libc-independent and/or don't otherwise require anything from other libraries. - Open and read /proc/self/auxv. Doesn't work for libraries that may run in arbitrarily constrained environments that may not have /proc mounted (e.g. libraries that might be used by an init program or a container setup tool). - Assume you're on the main thread and still on the original stack, and try to walk the stack upwards, hoping to find auxv. Extremely bad idea. - Ask the caller to pass auxv in for you. Not ideal for a user-friendly library, and then your caller may have the same problem. Add a prctl that copies current->mm->saved_auxv to a userspace buffer. Link: https://lkml.kernel.org/r/d81864a7f7f43bca6afa2a09fc2e850e4050ab42.1680611394.git.josh@joshtriplett.org Signed-off-by: Josh Triplett Signed-off-by: Andrew Morton commit 97f7e09481f312b143db53cadbdfe81abac97e73 Author: Peng Zhang Date: Tue Mar 14 20:42:02 2023 +0800 maple_tree: simplify mas_wr_node_walk() Simplify code of mas_wr_node_walk() without changing functionality, and improve readability. Remove some special judgments. Instead of dynamically recording the min and max in the loop, get the final min and max directly at the end. Link: https://lkml.kernel.org/r/20230314124203.91572-3-zhangpeng.00@bytedance.com Signed-off-by: Peng Zhang Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 9bc47f11525fb666a370063888904160188b024e Author: David Hildenbrand Date: Tue Apr 4 10:56:36 2023 +0200 m68k/mm: use correct bit number in _PAGE_SWP_EXCLUSIVE comment As noticed by Geert, commit b5c88f21531c ("microblaze/mm: support __HAVE_ARCH_PTE_SWP_EXCLUSIVE") modified m68k code by accident. While replacing 0x080 by CF_PAGE_NOCACHE is correct, although it should have been part of commit ed4154067a08 ("m68k/mm: support __HAVE_ARCH_PTE_SWP_EXCLUSIVE"), replacing "bit 7" by "bit 24" in the comment was wrong. Let's revert to the previous, correct, comment. Link: https://lkml.kernel.org/r/20230404085636.121409-1-david@redhat.com Signed-off-by: David Hildenbrand Reported-by: Geert Uyt